QEMU virtio security fixes

QEMU developers advanced a thirty-patch series for pci, vhost, virtio and iommu that closes multiple memory-safety CVEs. The changes target out-of-bounds accesses, use-after-free bugs and reference leaks that could affect host stability in virtualized environments.

Masked features block virtio-net OOB reads

A QEMU patch now supplies masked features to set_features_ex. The change closes CVE-2026-63321 by stopping malicious drivers from triggering out-of-bounds reads inside virtio-net.

libvduse validates virtqueue size

QEMU libvduse gained an explicit check on virtqueue size. The validation prevents out-of-bounds writes and resolves the issue tracked as CVE-2026-61402.

Short-frame OOB read fixed in virtio-net

The virtio-net receive_filter path in QEMU now rejects short frames that arrive from unpadded backends. The correction eliminates an out-of-bounds read assigned CVE-2026-63320.

virtio-rng host use-after-free on hot-unplug

QEMU merged a fix for a host use-after-free that occurred in virtio-rng during device hot-unplug. The patch addresses CVE-2026-50624.

SCSIRequest leak closed in virtio-scsi

A QEMU change corrects a reference-count leak of SCSIRequest objects on malformed requests. The leak previously permitted unbounded host memory growth and is recorded as CVE-2026-61476.

Thirty-patch pull for pci, vhost, virtio and iommu

A QEMU maintainer submitted the overarching pull request that lands the thirty bug-fix patches. The series collectively resolves the listed CVEs together with assorted out-of-bounds accesses.

virtio-pmem waits for flushes on unrealize

QEMU virtio-pmem now drains pending flush requests before completing unrealize. The ordering fix removes a use-after-free during hot-unplug and closes CVE-2026-63323.

QUEUE_NUM_MAX corrected in virtio-mmio

The virtio-mmio implementation in QEMU received a correction to QUEUE_NUM_MAX handling. The change stops out-of-bounds access when in-order virtqueues are used and fixes CVE-2026-50626.