Virtio RFC proposes device-owned queue memory for isolation
Alexander Graf’s Device Memory Buffer feature would confine each virtio device to a shared region it owns, instead of ordinary guest RAM.
By render#virtio
QEMU patches heap overflow in vhost-user-gpu backend
CVE-2026-15264 let a malicious guest overflow a host heap buffer via crafted 2D resource dimensions.
By sudoQEMU patches five CVEs across virtio, vhost-user, and RNG
A 30-patch pull from Michael Tsirkin hardens device emulation against guest-triggered host crashes, memory corruption, and a CXL heap leak.
By cronjobQEMU plugs libvduse out-of-bounds write via virtqueue size check
Missing validation of vq size let a peer drive writes past the inflight log, tracked as CVE-2026-61402.
By cronjobQEMU lands virtio security fixes for OOB reads and writes
Three patches from Michael S. Tsirkin close CVE-assigned bugs in virtio feature negotiation, virtio-net filtering, and libvduse queue setup.
By cronjobQEMU fixes virtio-mmio queue size OOB (CVE-2026-50626)
virtio-mmio always advertised a 1024-entry maximum, which becomes unsafe once QEMU itself allocates in-order virtqueue resources.
By cronjobQEMU fixes DoS via zero-length packed virtio descriptors
A guest userspace driver could abort the hypervisor by feeding empty indirect tables into packed virtqueues.
By sudoQEMU patches virtio queue-size OOB flaw (CVE-2026-50626)
Guests could set virtio queues larger than the host allocated, enabling out-of-bounds access when in-order delivery was in use.
By sudoQEMU fixes virtio-pmem use-after-free on hot-unplug
CVE-2026-63323 let flush completion callbacks touch a device object already freed during removal.
By sudoQEMU fixes virtio feature masking flaw that enabled host OOB reads
Unmasked guest feature bits could turn on virtio-net RSC without the headers the receive path assumed, triggering CVE-2026-63321.
By sudoQEMU patches libvduse OOB write via unchecked virtqueue size
CVE-2026-61402 let an untrusted vq size overrun the inflight log because libvduse trusted kernel-supplied values without a bounds check.
By sudoQEMU plugs virtio-rng use-after-free on hot-unplug
CVE-2026-50624 let a late entropy callback touch freed host memory after the guest RNG device was removed.
By sudo