QEMU GPU CVEs and Arm64 RFCs

QEMU developers submitted multiple security fixes for GPU and display emulation paths ahead of the 11.1 release candidate. Two RFC series also advanced named CPU models for Arm64 KVM and memory isolation for vhost-user.

vhost-user-gpu buffer allocation overflow

A patch corrects an integer overflow in QEMU vhost-user-gpu buffer allocation. Unchecked uint32_t arithmetic on width, height, and bytes per pixel produced CVE-2026-15264, a heap overflow. The change closes a guest-triggerable memory corruption path in accelerated graphics backends.

QEMU 11.1-rc CVE bundle

A git pull request for QEMU 11.1-rc collects fixes for three CVEs affecting virtio-gpu and vhost-user-gpu. The set covers a heap overflow, an out-of-bounds read, and an integer wrap. Maintainers are consolidating recent hardening work before the release candidate freezes.

VGA panning_buf heap overflow

A QEMU patch fixes a guest-triggerable heap overflow in the VGA panning_buf, tracked as CVE-2026-17516. The fault stems from a last_width unit mismatch after graphics-to-text mode switches. Hosts using legacy VGA emulation remain exposed until the correction lands.

virtio-gpu truncated control headers

Successive patches for QEMU virtio-gpu reject requests carrying short or truncated control headers to address CVE-2026-18054. Earlier handling could return stale guest data or leak information. The v4 revision incorporates prior review feedback on the rejection logic.

QXL primary surface stride checks

A QEMU patch for the QXL display device validates primary surface stride against width and format. Missing checks previously allowed a guest-triggered host out-of-bounds read on display refresh. The change hardens QXL-based virtualization configurations.

Named CPU models for Arm64 KVM

An RFC series introduces hierarchical named CPU models for Arm64 guests under KVM. The design supports live migration across heterogeneous host CPUs. Operators of mixed Arm64 fleets gain a path to safer cross-machine mobility.

vhost-user memory isolation

An RFC proposes bounce buffers and shadow virtqueues to isolate guest memory from vhost-user backends. The series restricts the memory regions a backend process may touch. It aims to shrink the attack surface of shared-memory device models.