QEMU lands USB, UEFI, and QXL security fixes in one busy window

QEMU maintainers this week moved a cluster of security fixes covering USB redirection and controllers, UEFI variable handling, and the QXL display device. The batch closes several CVEs that a guest or untrusted peer could use to crash the host, trigger use-after-free, or force out-of-bounds host reads.

The most concentrated drop was a USB pull from Thomas Huth packing seven fixes. Two address usbredir and carry CVEs. Marc-André Lureau fixed a use-after-free (CVE-2026-15705) that could hit when a multi-fragment buffered bulk packet overflowed the queue: earlier fragments kept interior pointers into a buffer that was freed with the final fragment. He also stopped a malicious usbredir peer from resetting max_packet_size to zero after bulk receive had started (CVE-2026-63319), which previously caused an infinite split loop and division-by-zero crashes. Feifan Qian and Tristan reported those issues.

The same pull hardens XHCI. It clamps an interval exponent that could produce undefined shifts, blocks a guest-triggerable assert when looking up streams, and fixes an out-of-bounds heap access when raising sysbus interrupts. A separate change breaks a host-side link cycle on the XHCI PCI path so device finalize runs on unplug, with a qtest regression test added for that path.

In parallel, Gerd Hoffmann sent a v4 series of UEFI variable-service hardening aimed at OVMF-style emulation. It adds post-load sanity checks on migration state so invalid buffer sizes, storage overruns, and inconsistent policy or variable data fail the migrate instead of trusting the stream (CVE-2026-61404 and related issues). Other patches reject undersized policy registration buffers (CVE-2026-58581), remove a debug printer that never belonged in production builds (CVE-2026-58582), enforce a lower bound on signature list size to avoid an endless parse loop (CVE-2026-61406), account policy entries against storage limits, and make SetupMode read-only so guests cannot rewrite the secure-boot state flag (CVE-2026-16288).

Lureau also posted a QXL fix for a host-side out-of-bounds read (CVE-2026-16271). Primary surface setup already checked that stride times height fit in video memory and that stride was aligned, but it never required abs(stride) to cover width times bytes per pixel. A guest could therefore install a too-narrow stride; Spice rejected the surface internally, yet QEMU still built local rendering state, and the next VNC or SDL refresh read past the backing store. The patch now rejects unknown formats, zero dimensions, and strides too small for a full row.

Taken together, the week’s traffic tightens guest-facing USB, firmware variable, and display paths that had incomplete validation on malicious or migrated input.