Sync Collecting Fix Commits: Tue Aug 25 21:20:13 UTC 2026

Signed-off-by: AboutCode Automation <automation@aboutcode.org>

Author: aboutcode-automation

data/fix-commits/advisory-database-b78f1d41.json

@@ -1,6 +1,12 @@
 {
   "vcs_url": "https://gitlab.com/qemu-project/qemu",
   "vulnerabilities": {
+    "CVE-2026-77913": {
+      "418396be8013386a81f8d8d89ac0effcf03a64b6": "hw/display/vga: fix text-mode OOB write after a graphics surface switch\n\nvga_draw_text() decides whether the console surface needs a resize from\nits geometry cache, but none of the cache terms observe the graphics\nrenderer having replaced the console surface in between:\n\n- last_width/last_height are shared with vga_draw_graphic(), which\n  stores them in pixels while the text path stores characters;\n- last_depth stays 0 for legacy (non-VBE) graphics modes, because\n  vga_get_bpp() only reports a depth when VBE is enabled, so the\n  \"s->last_depth\" term that normally forces a resize after a graphics\n  frame does not fire.\n\nSo a graphics frame that shrinks the console surface (e.g. 80x25\npixels) followed by a text frame with matching character geometry\n(80x25 chars) skips the resize, and the glyph loop then paints\nwidth*cw x height*cheight pixels into the smaller surface, out of\nbounds, with guest-controlled (DAC palette) values, on every display\nrefresh.\n\nSeparate the geometry cache per renderer: text paths (vga_draw_text,\nvga_update_text, and the text handling in vga_invalidate_display /\nvga_common_reset) now only manipulate last_text_{width,height}, in\ncharacters; last_{width,height} become graphics-only, in pixels.\nAdditionally, make the text path compare the pixel size it is about\nto paint against the console surface's actual dimensions.  The\nsurface check is the load-bearing term: caches in either unit cannot\nsee the other renderer swapping the surface, the surface can.\n\nFixes: CVE-2026-77913\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/4215\nCc: qemu-stable@nongnu.org\nSigned-off-by: Warisjeet Singh (sin99xx) <sinxx198@gmail.com>\nMessage-ID: <vga-v3-20260824.sinxx198@gmail.com>"
+    },
+    "CVE-2026-16271": {
+      "ab7183ed4eecb4727532e3ffe5953d127e102c72": "hw/display/qxl: validate primary surface stride against width\n\nThe existing validation in qxl_create_guest_primary() checks that\nabs(stride) * height fits in vgamem_size and that stride is 4-byte\naligned, but never checks that abs(stride) is large enough to hold one\nrow of pixels for the declared width and format.\n\nA malicious guest can create a primary surface with a stride much\nsmaller than width * bytes_per_pixel (e.g. stride=4 for a 64-wide 32bpp\nsurface). The spice server rejects this via red_validate_surface(), but\nthe return is void and QEMU unconditionally proceeds to set up the local\nrendering state. On the next display refresh, VNC or SDL reads width *\nbytes_pp per scanline from a region backed by only stride bytes per\nrow, causing a host-side out-of-bounds read.\n\nAdd three checks in qxl_create_guest_primary() before creating the\nsurface:\n - reject unknown surface formats\n - reject zero width or height\n - reject surfaces where abs(stride) < width * bytes_per_pixel\n\nAlso fix three related issues in qxl-render.c:\n - qxl_blit() used abs_stride to advance the dst pointer into the\n   DisplaySurface, but when stride is negative the DisplaySurface is a\n   packed buffer whose stride may be smaller. Use surface_stride()\n   instead.\n - qxl_render_update_area_unlocked() uses guest_head0_width (set via\n   QXL_IO_MONITORS_CONFIG_ASYNC) without validating it against\n   abs_stride, bypassing the new validation. Clamp the effective width\n   to abs_stride / bytes_pp to prevent out-of-bounds access while\n   tolerating the normal transient where the monitor config arrives\n   before the primary surface is resized to match.\n - Similarly, guest_head0_height bypasses qxl_create_guest_primary()\n   validation. Without clamping, abs_stride * height can overrun\n   vgamem_size, and the product can also overflow 32 bits (e.g.\n   abs_stride=16 MiB, height=256 wraps to zero), defeating the\n   qxl_phys2virt() bounds check. Clamp height to\n   vgamem_size / abs_stride to prevent both.\n\nWhile touch it, fix some endianness issues.\n\nFixes: CVE-2026-16271\nFixes: a19cbfb34642 (\"spice: add qxl device\")\nFixes: 979f7ef8966b (\"qxl: use guest_monitor_config for local renderer.\")\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/3637\nReported-by: huntr bubble\nSigned-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>\nReviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>\nMessage-ID: <20260806094028.640676-1-marcandre.lureau@redhat.com>"
+    },
     "CVE-2026-18054": {
       "99853f2012dd2520741a75949c8db7bf14f69ceb": "virtio-gpu: reject requests with short/truncated control headers\n\nA short control request can leave command data partially initialized.\nFor the common header, guest-controlled flags can then cause stale fence\nmetadata to be returned to the guest.\n\nThe command fill helpers detect a short copy but only log and return.\nFor the common header this leaves the request without any completion;\nfor type-specific commands the caller still completes the request but\nreports VIRTIO_GPU_RESP_OK_NODATA, masking the error. Make\nVIRTIO_GPU_FILL_CMD() clear the partially copied object and complete the\nrequest with ERR_INVALID_PARAMETER. Make VUGPU_FILL_CMD() report the same\nerror through the existing vhost-user-gpu dispatcher. This also rejects\ntruncated type-specific commands.\n\nThe vhost-user-gpu common header is copied outside VUGPU_FILL_CMD(), so\nclear it and complete the request directly when that copy is short.\n\nFixes: CVE-2026-18054\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/4094\nReported-by: Ankur Saini <ankur98saini@gmail.com>\nSuggested-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>\nSigned-off-by: Ankur Saini <ankur98saini@gmail.com>\nReviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>\nReviewed-by: Marc-Andr\u00e9 Lureau <marcandre.lureau@redhat.com>\nMessage-ID: <20260803-virtio-gpu-short-header-v3-1-936c1daa8e61@gmail.com>\n(cherry picked from commit 1f24066fc88d33455ee54a20f29994d9e69997ba)\nSigned-off-by: Michael Tokarev <mjt@tls.msk.ru>",
       "5fbd2fe1cc54259d045d00d4966aa2db1ba990d6": "virtio-gpu: reject requests with short/truncated control headers\n\nA short control request can leave command data partially initialized.\nFor the common header, guest-controlled flags can then cause stale fence\nmetadata to be returned to the guest.\n\nThe command fill helpers detect a short copy but only log and return.\nFor the common header this leaves the request without any completion;\nfor type-specific commands the caller still completes the request but\nreports VIRTIO_GPU_RESP_OK_NODATA, masking the error. Make\nVIRTIO_GPU_FILL_CMD() clear the partially copied object and complete the\nrequest with ERR_INVALID_PARAMETER. Make VUGPU_FILL_CMD() report the same\nerror through the existing vhost-user-gpu dispatcher. This also rejects\ntruncated type-specific commands.\n\nThe vhost-user-gpu common header is copied outside VUGPU_FILL_CMD(), so\nclear it and complete the request directly when that copy is short.\n\nFixes: CVE-2026-18054\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/4094\nReported-by: Ankur Saini <ankur98saini@gmail.com>\nSuggested-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>\nSigned-off-by: Ankur Saini <ankur98saini@gmail.com>\nReviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>\nReviewed-by: Marc-Andr\u00e9 Lureau <marcandre.lureau@redhat.com>\nMessage-ID: <20260803-virtio-gpu-short-header-v3-1-936c1daa8e61@gmail.com>\n(cherry picked from commit 1f24066fc88d33455ee54a20f29994d9e69997ba)\nSigned-off-by: Michael Tokarev <mjt@tls.msk.ru>",

data/fix-commits/camel-36fc325a.json

@@ -1,6 +1,12 @@
 {
   "vcs_url": "https://github.com/qemu/qemu",
   "vulnerabilities": {
+    "CVE-2026-77913": {
+      "418396be8013386a81f8d8d89ac0effcf03a64b6": "hw/display/vga: fix text-mode OOB write after a graphics surface switch\n\nvga_draw_text() decides whether the console surface needs a resize from\nits geometry cache, but none of the cache terms observe the graphics\nrenderer having replaced the console surface in between:\n\n- last_width/last_height are shared with vga_draw_graphic(), which\n  stores them in pixels while the text path stores characters;\n- last_depth stays 0 for legacy (non-VBE) graphics modes, because\n  vga_get_bpp() only reports a depth when VBE is enabled, so the\n  \"s->last_depth\" term that normally forces a resize after a graphics\n  frame does not fire.\n\nSo a graphics frame that shrinks the console surface (e.g. 80x25\npixels) followed by a text frame with matching character geometry\n(80x25 chars) skips the resize, and the glyph loop then paints\nwidth*cw x height*cheight pixels into the smaller surface, out of\nbounds, with guest-controlled (DAC palette) values, on every display\nrefresh.\n\nSeparate the geometry cache per renderer: text paths (vga_draw_text,\nvga_update_text, and the text handling in vga_invalidate_display /\nvga_common_reset) now only manipulate last_text_{width,height}, in\ncharacters; last_{width,height} become graphics-only, in pixels.\nAdditionally, make the text path compare the pixel size it is about\nto paint against the console surface's actual dimensions.  The\nsurface check is the load-bearing term: caches in either unit cannot\nsee the other renderer swapping the surface, the surface can.\n\nFixes: CVE-2026-77913\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/4215\nCc: qemu-stable@nongnu.org\nSigned-off-by: Warisjeet Singh (sin99xx) <sinxx198@gmail.com>\nMessage-ID: <vga-v3-20260824.sinxx198@gmail.com>"
+    },
+    "CVE-2026-16271": {
+      "ab7183ed4eecb4727532e3ffe5953d127e102c72": "hw/display/qxl: validate primary surface stride against width\n\nThe existing validation in qxl_create_guest_primary() checks that\nabs(stride) * height fits in vgamem_size and that stride is 4-byte\naligned, but never checks that abs(stride) is large enough to hold one\nrow of pixels for the declared width and format.\n\nA malicious guest can create a primary surface with a stride much\nsmaller than width * bytes_per_pixel (e.g. stride=4 for a 64-wide 32bpp\nsurface). The spice server rejects this via red_validate_surface(), but\nthe return is void and QEMU unconditionally proceeds to set up the local\nrendering state. On the next display refresh, VNC or SDL reads width *\nbytes_pp per scanline from a region backed by only stride bytes per\nrow, causing a host-side out-of-bounds read.\n\nAdd three checks in qxl_create_guest_primary() before creating the\nsurface:\n - reject unknown surface formats\n - reject zero width or height\n - reject surfaces where abs(stride) < width * bytes_per_pixel\n\nAlso fix three related issues in qxl-render.c:\n - qxl_blit() used abs_stride to advance the dst pointer into the\n   DisplaySurface, but when stride is negative the DisplaySurface is a\n   packed buffer whose stride may be smaller. Use surface_stride()\n   instead.\n - qxl_render_update_area_unlocked() uses guest_head0_width (set via\n   QXL_IO_MONITORS_CONFIG_ASYNC) without validating it against\n   abs_stride, bypassing the new validation. Clamp the effective width\n   to abs_stride / bytes_pp to prevent out-of-bounds access while\n   tolerating the normal transient where the monitor config arrives\n   before the primary surface is resized to match.\n - Similarly, guest_head0_height bypasses qxl_create_guest_primary()\n   validation. Without clamping, abs_stride * height can overrun\n   vgamem_size, and the product can also overflow 32 bits (e.g.\n   abs_stride=16 MiB, height=256 wraps to zero), defeating the\n   qxl_phys2virt() bounds check. Clamp height to\n   vgamem_size / abs_stride to prevent both.\n\nWhile touch it, fix some endianness issues.\n\nFixes: CVE-2026-16271\nFixes: a19cbfb34642 (\"spice: add qxl device\")\nFixes: 979f7ef8966b (\"qxl: use guest_monitor_config for local renderer.\")\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/3637\nReported-by: huntr bubble\nSigned-off-by: Marc-Andre Lureau <marcandre.lureau@redhat.com>\nReviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>\nMessage-ID: <20260806094028.640676-1-marcandre.lureau@redhat.com>"
+    },
     "CVE-2026-18054": {
       "99853f2012dd2520741a75949c8db7bf14f69ceb": "virtio-gpu: reject requests with short/truncated control headers\n\nA short control request can leave command data partially initialized.\nFor the common header, guest-controlled flags can then cause stale fence\nmetadata to be returned to the guest.\n\nThe command fill helpers detect a short copy but only log and return.\nFor the common header this leaves the request without any completion;\nfor type-specific commands the caller still completes the request but\nreports VIRTIO_GPU_RESP_OK_NODATA, masking the error. Make\nVIRTIO_GPU_FILL_CMD() clear the partially copied object and complete the\nrequest with ERR_INVALID_PARAMETER. Make VUGPU_FILL_CMD() report the same\nerror through the existing vhost-user-gpu dispatcher. This also rejects\ntruncated type-specific commands.\n\nThe vhost-user-gpu common header is copied outside VUGPU_FILL_CMD(), so\nclear it and complete the request directly when that copy is short.\n\nFixes: CVE-2026-18054\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/4094\nReported-by: Ankur Saini <ankur98saini@gmail.com>\nSuggested-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>\nSigned-off-by: Ankur Saini <ankur98saini@gmail.com>\nReviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>\nReviewed-by: Marc-Andr\u00e9 Lureau <marcandre.lureau@redhat.com>\nMessage-ID: <20260803-virtio-gpu-short-header-v3-1-936c1daa8e61@gmail.com>\n(cherry picked from commit 1f24066fc88d33455ee54a20f29994d9e69997ba)\nSigned-off-by: Michael Tokarev <mjt@tls.msk.ru>",
       "5fbd2fe1cc54259d045d00d4966aa2db1ba990d6": "virtio-gpu: reject requests with short/truncated control headers\n\nA short control request can leave command data partially initialized.\nFor the common header, guest-controlled flags can then cause stale fence\nmetadata to be returned to the guest.\n\nThe command fill helpers detect a short copy but only log and return.\nFor the common header this leaves the request without any completion;\nfor type-specific commands the caller still completes the request but\nreports VIRTIO_GPU_RESP_OK_NODATA, masking the error. Make\nVIRTIO_GPU_FILL_CMD() clear the partially copied object and complete the\nrequest with ERR_INVALID_PARAMETER. Make VUGPU_FILL_CMD() report the same\nerror through the existing vhost-user-gpu dispatcher. This also rejects\ntruncated type-specific commands.\n\nThe vhost-user-gpu common header is copied outside VUGPU_FILL_CMD(), so\nclear it and complete the request directly when that copy is short.\n\nFixes: CVE-2026-18054\nResolves: https://gitlab.com/qemu-project/qemu/-/work_items/4094\nReported-by: Ankur Saini <ankur98saini@gmail.com>\nSuggested-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>\nSigned-off-by: Ankur Saini <ankur98saini@gmail.com>\nReviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>\nReviewed-by: Marc-Andr\u00e9 Lureau <marcandre.lureau@redhat.com>\nMessage-ID: <20260803-virtio-gpu-short-header-v3-1-936c1daa8e61@gmail.com>\n(cherry picked from commit 1f24066fc88d33455ee54a20f29994d9e69997ba)\nSigned-off-by: Michael Tokarev <mjt@tls.msk.ru>",