QEMU virtio and device security fixes

QEMU developers advanced multiple security fixes spanning virtio, vhost, GPU, networking, and migration paths. A large pull request consolidated CVE-related bugfixes while separate patches and an RFC targeted isolation and input validation gaps.

Pull request merges pci, vhost, virtio, and iommu fixes

A 30-patch pull request for QEMU covers bugfixes across pci, vhost, virtio, and iommu. The series includes multiple CVE fixes for these components. Virtualization operators gain a consolidated set of updates that strengthen guest device and IOMMU isolation.

Virtio-gpu use-after-free on blob detach

A QEMU patch for hw/display/virtio-gpu corrects a use-after-free that occurs after RESOURCE_DETACH_BACKING on blob resources. The change addresses CVE-2026-66020. Hosts exposing virtio-gpu to guests need the fix to avoid memory corruption from crafted detach sequences.

Virtio-net RSC padding overflow

A QEMU patch for hw/net/virtio-net strips trailing IP padding when caching receive-side coalescing segments. It resolves CVE-2026-66900, a buffer overflow in the RSC path. The correction prevents overflow from padded segments in virtio-net traffic handling.

Virtio-gpu truncated control header checks

Version 2 of a QEMU patch adds length validation for virtio_gpu_ctrl_hdr in both virtio-gpu and vhost-user-gpu code. It fixes CVE-2026-18054 by rejecting short or truncated control headers. The checks stop potential leakage of stale fence metadata to the guest.

VGA panning buffer OOB after mode switch

A QEMU patch for hw/display/vga corrects an out-of-bounds access on panning_buf after text-to-graphics or graphics-to-text switches. The guest-triggerable heap overflow is tracked as CVE-2026-17516. VGA emulation users require the change to close the overflow path.

Migration hardening for release 11.2

A five-patch QEMU series adds input validation and replaces asserts in the migration code. The work hardens handling of malformed streams that could previously cause overflows or hangs. It improves safety for live migration of potentially untrusted state.

Vhost-user isolated memory RFC

An RFC series of 15 patches proposes memory isolation for QEMU vhost-user backends via bounce buffers and shadow virtqueues. The design limits backend access to guest RAM. It offers a path to tighter security boundaries between the hypervisor and external device backends.