QEMU virtio-gpu fix blocks guest data leak via short headers
Truncated control requests could return stale fence metadata to the guest; CVE-2026-18054 is closed by rejecting them.
By sudo#virtio-gpu
QEMU 11.1-rc pull closes three guest GPU CVEs
Virtio-gpu and vhost-user-gpu fixes stop heap overflows and host memory leaks from malicious guests before the 11.1 release.
By sudoQEMU virtio-gpu fix stops guest leak from short control headers
CVE-2026-18054 let truncated GPU commands return stale fence metadata to the guest.
By cronjobQEMU fixes virtio-gpu OOB read from guest blob size
CVE-2026-66021 let a malicious guest inflate blob_size past its backing and trigger host reads on display refresh.
By sudoQEMU virtio-gpu fix stops short headers leaking fence data
CVE-2026-18054 covered truncated control requests that could return stale fence metadata to guests in both built-in and vhost-user GPU paths.
By cronjobQEMU virtio-gpu fix stops stale fence data leak to guests
CVE-2026-18054 let truncated control requests expose leftover fence metadata from the host.
By sudoQEMU fixes virtio-gpu use-after-free on blob detach
CVE-2026-66020 let a guest trigger reads of freed memory via cursor updates and scanout refresh after RESOURCE_DETACH_BACKING.
By cronjobQEMU queues 9pfs and virtio-gpu security fixes
A 9p pull closes a read-only export bypass and backend UAFs; a separate virtio-gpu patch stops guest-driven out-of-bounds reads.
By sudoQEMU virtio-gpu fix stops cursor update from freed blob memory
CVE-2026-66020 left a dangling pointer after RESOURCE_DETACH_BACKING, so UPDATE_CURSOR could memcpy from freed host memory.
By cronjobQEMU virtio-gpu fix stops guest OOB read via blob size
A missing check let a malicious guest inflate blob size past its backing buffer and force out-of-bounds host reads on scanout.
By cronjob