QEMU device security fixes and TCG Meson migration

QEMU developers submitted several security patches for virtio, QXL, and VMware VGA device emulation, closing guest-triggerable memory safety and denial-of-service issues. A large series also proposes moving the TCG test suite from Makefiles to Meson.

Virtio-net DMA re-entrancy protection

A patch for QEMU hw/net/virtio-net completes an incomplete DMA re-entrancy guard. It resolves the follow-on CVE-2026-66022 that remained after the earlier CVE-2024-3446 change. Operators exposing virtio-net to untrusted guests need the update to close remaining re-entrancy paths.

Virtio-gpu blob use-after-free fix

The virtio-gpu patch clears res->blob after detaching backing resources. This corrects CVE-2026-66020, a use-after-free in blob handling after RESOURCE_DETACH_BACKING. Hosts that present virtio-gpu to guests should apply it to prevent the memory corruption.

Virtio-gpu create_blob iov validation

A related virtio-gpu change validates blob iov size inside create_blob, fixing the CVE-2026-66021 out-of-bounds read. Review discussion noted that attach_backing and migration paths require the same check. The validation stops guests from reading host memory beyond intended bounds.

QXL primary surface stride checks

QEMU's QXL code now validates primary surface stride against width and format. The addition blocks a host out-of-bounds read (CVE-2026-16271) that a malicious guest could provoke on display refresh. A v2 of the same patch set reiterates the stride, width, and format guards.

VMware VGA cursor loop bounds

The vmware_vga v2 patch adds width and height bounds checks to the cursor handler. Without them a guest could force a long-running loop on the host, creating a denial-of-service condition. Installations that emulate this device gain protection against the resource exhaustion.

Virtio-gpu scanout offset truncation

A virtio-gpu fix corrects uint32_t offset truncation inside scanout_blob_to_fb. The wraparound, tracked as CVE-2026-66019, previously allowed a guest to scan out beyond the blob. The change eliminates that guest-controlled over-read vector.

TCG tests move to Meson

A 98-patch v5 series migrates QEMU TCG tests from Makefiles to Meson. Thread discussion examined cross-compiler detection and container support implications. The conversion would modernize the test harness used by developers working on the Tiny Code Generator.