QEMU security fixes for USB, UEFI, and device paths

QEMU developers circulated multiple security patches and a pull request covering USB, UEFI variable services, display, and audio subsystems. The work closes several CVEs that allow guest-triggered crashes, use-after-free, or out-of-bounds access, alongside continued refinement of local live migration for virtio-net.

USB bug-fix pull request merges two CVEs

A pull request collecting seven USB-related fixes was posted to qemu-devel, incorporating patches for a use-after-free and crashes from zero max_packet_size values. The set also addresses guest-triggerable out-of-bounds and assertion failures. These changes matter for hosts that expose USB redirection or passthrough, where a malicious guest could otherwise disrupt the hypervisor.

UEFI var-service patches close five CVEs

Gerd Hoffmann sent version 4 of a six-patch series hardening QEMU's UEFI variable service used with OVMF. One patch in the series adds post-load sanity checks on the migration stream to resolve CVE-2026-61404. Operators running UEFI guests should track these fixes because malformed migration data or variable state could previously compromise the host.

QXL primary surface stride validation

A patch adds missing checks that compare primary surface stride against width in the QXL display device. The change closes a host out-of-bounds read tracked as CVE-2026-16271. Guests that can program QXL surfaces gain a path to read host memory without the validation.

Intel HDA DMA paths restricted to memory

A patch extends the earlier CVE-2021-3611 mitigation by applying memory attributes to three additional DMA engine paths in the Intel HDA audio device. The update blocks guest-triggered MMIO reentry that could otherwise re-enter device emulation unsafely. Audio passthrough configurations remain a common attack surface for such reentrancy bugs.

usbredir zero max_packet_size fix

A dedicated patch addresses an infinite loop and SIGFPE in usbredir when a device reports a zero max_packet_size, fixing CVE-2026-63319. The issue is guest-triggerable through malicious USB device descriptors. Hosts that redirect USB devices to untrusted guests need the guard to avoid denial of service.

vfio-user client response validation

A five-patch series adds bounds checks and overflow guards so the vfio-user client rejects malformed replies from a server. The changes harden the protocol against unexpected or oversized messages. Deployments that use vfio-user for device offload benefit from rejecting bad server data before it reaches core emulation paths.

virtio-net local live migration with TAP

Version 19 of a fifteen-patch series enables live migration of virtio-net when backed by a TAP netdev, transferring both state and file descriptors for local migrations. The work also deprecates the script='no' option in related configuration. The feature reduces downtime for local guest moves that keep networking attached to host TAP devices.