QEMU virtio security patches address multiple CVEs

QEMU developers posted a series of security patches to qemu-devel covering virtio subsystem flaws. The changes address use-after-free, out-of-bounds access, memory leaks, and related issues under several CVEs.

virtio-pmem waits for flushes on unrealize

A patch to QEMU virtio-pmem ensures flush requests complete before unrealize. It tracks in-flight flushes to close a use-after-free on hot-unplug, fixing CVE-2026-63323. Operators using pmem devices with hotplug should apply it to protect host memory safety.

virtio queue size validation against allocated maximum

A QEMU virtio patch tightens queue size checks against the allocated maximum. It rejects oversized guest queues to stop out-of-bounds read and write, resolving CVE-2026-50626. This matters for any host exposing virtio devices to untrusted guests.

libvduse validates vq size

A patch adds vq size validation inside QEMU libvduse. The change blocks out-of-bounds writes and fixes CVE-2026-61402. Users of vDUSE-based setups need the update to keep the host process isolated from malformed queues.

virtio-rng host use-after-free on hot-unplug

QEMU received a fix for a host use-after-free in virtio-rng after device hot-unplug. The patch closes CVE-2026-50624. Hosts that hot-unplug RNG devices for guests remain exposed until the change lands.

virtio-mmio QUEUE_NUM_MAX reporting

A virtio-mmio patch corrects QUEUE_NUM_MAX reporting in QEMU. Proper limits prevent out-of-bounds access with in-order virtqueues and address CVE-2026-50626. Guests that rely on mmio transport can otherwise trigger host memory corruption.

virtio-scsi SCSIRequest leak on bad request

A QEMU virtio-scsi patch stops a reference-count leak on malformed requests. Repeated bad requests could otherwise exhaust host memory, which is tracked as CVE-2026-61476. Shared storage virtualization setups are the primary concern.

virtio masked features with set_features_ex

QEMU maintainers posted patches that force masked features when calling set_features_ex. Unmasked bits previously let buggy guests provoke host out-of-bounds reads in virtio-net receive-side coalescing, fixed as CVE-2026-63321. Network-heavy virtio deployments should take note.

virtio rejects zero-length indirect packed descriptors

A QEMU virtio patch rejects zero-length packed indirect descriptors. The check prevents an assertion abort when the driver runs in guest userspace and closes CVE-2026-63324. Hosts that allow userspace virtio drivers gain a denial-of-service defense.