QEMU NBD server stops crashing on illegal client requests

QEMU's NBD server will reject malformed client requests instead of aborting, closing two low-severity denial-of-service bugs that a non-compliant peer could trigger over an unencrypted connection.

Eric Blake wrote that QEMU was dying with an assertion failure when a client sent inconsistent length fields in a metadata-context option. The protocol requires those lengths to add up; leftover garbage left the server out of sync with the next option and crashed it. That flaw is CVE-2026-125683, reported by TonySD. A second, similar crash came from a block-status command the protocol does not allow until status reporting has been negotiated. Sunday Jiang supplied a proof of concept. Blake turned both cases into regression tests that send deliberately illegal traffic over a raw socket, because libnbd will not emit those sequences.

Both issues are denial of service against QEMU acting as an NBD server, not a way to read or write guest data. Blake's security note says the practical risk drops if operators require TLS and check x509 client certificates, so an attacker must first compromise a client that QEMU already trusts. The project treats that class of bug as low severity and therefore eligible for a fix without an embargo.

The same update also picks up a client-side fix from Guillaume Vincke: if the remote NBD server hangs up immediately, QEMU's connection retry no longer hands back a channel that is already closed.