QEMU virtio CVEs and helper-to-TCG work

QEMU activity focused on security fixes across virtio, vhost, and related device paths, with several CVE patches advanced. A large series also proposed LLVM-driven translation of C helpers into TCG.

Pull request merges virtio, vhost, and IOMMU fixes

A pull request landed thirty patches for QEMU covering bugfixes in the pci, vhost, virtio, and iommu areas. The set includes multiple CVE resolutions for those subsystems. Operators running virtualized workloads depend on these components for device emulation and isolation, so the fixes reduce exposure in common guest setups.

Helper-to-TCG subproject proposed with LLVM

A fifty-patch series introduces a helper-to-tcg subproject that uses LLVM to auto-translate C helpers into TCG. The work is shown against the Hexagon frontend. Maintainers of TCG frontends gain a path to cut manual helper work and keep generated code consistent.

Virtio-GPU blob iov size check closes OOB read

A v3 patch for hw/display/virtio-gpu validates blob iov size to fix CVE-2026-66021. Guest-controlled blob_size could previously trigger an out-of-bounds read on display refresh. The change blocks that path for guests using virtio-gpu.

Virtio-balloon free-page BH teardown use-after-free fixed

A patch corrects free-page bottom-half teardown on unrealize in virtio-balloon, resolving CVE-2026-66899. The use-after-free appeared during hot-unplug. Hosts that balloon memory and support device hot-unplug avoid the resulting crash or corruption risk.

USB CCID bulk-in ring OOB read addressed

A fix for hw/usb/dev-smartcard-reader stops an out-of-bounds read from the pending bulk-in ring under CVE-2026-18204. The patch moves the slot decrement to the release path. This hardens the smartcard reader emulation against malformed bulk-in traffic.

Virtio-GPU create_blob adds matching size validation

Another virtio-gpu patch validates blob_size against iov backing inside create_blob, also targeting CVE-2026-66021. Discussion notes that attach and migration paths still need equivalent checks. The work tightens the remaining surfaces around guest-supplied blob sizes.

Virtio migration load paths reject crafted streams cleanly

A seven-patch series hardens virtio migration load paths by replacing asserts and exits with error returns. Crafted migration streams no longer crash the process. Live-migration users gain more reliable handling of untrusted or corrupted state.

TCG tests converted from Makefiles to Meson

A 103-patch series moves QEMU TCG tests to Meson. The goal is tighter build integration and easier maintenance. Contributors who extend or run TCG tests obtain a more uniform test harness.