flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.
Reference: [https://nvd.nist.gov/vuln/detail/CVE-2026-48914] [https://security-tracker.debian.org/tracker/CVE-2026-48914] Backport the patch to fix CVE-2026-48914: [https://gitlab.com/qemu-project/qemu/-/commit/f5e2c6906cad9a84140e232f2e3eb7a46bf07f62] Signed-off-by: Roopa Kalmath <[email protected]> --- meta/recipes-devtools/qemu/qemu.inc | 1 + .../qemu/qemu/CVE-2026-48914.patch | 60 +++++++++++++++++++ 2 files changed, 61 insertions(+) create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2026-48914.patch diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc index cc8f2ecdfa..6a217cdaeb 100644 --- a/meta/recipes-devtools/qemu/qemu.inc +++ b/meta/recipes-devtools/qemu/qemu.inc @@ -42,6 +42,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \ file://CVE-2025-14876_p1.patch \ file://CVE-2025-14876_p2.patch \ file://0012-linux-user-Check-if-RESOLVE_CACHED-flag-is-defined-b.patch \ + file://CVE-2026-48914.patch \ " # file index at download.qemu.org isn't reliable: https://gitlab.com/qemu-project/qemu-web/-/issues/9 UPSTREAM_CHECK_URI = "https://www.qemu.org"; diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2026-48914.patch b/meta/recipes-devtools/qemu/qemu/CVE-2026-48914.patch new file mode 100644 index 0000000000..e38292d471 --- /dev/null +++ b/meta/recipes-devtools/qemu/qemu/CVE-2026-48914.patch @@ -0,0 +1,60 @@ +From f5e2c6906cad9a84140e232f2e3eb7a46bf07f62 Mon Sep 17 00:00:00 2001 +From: Stefan Hajnoczi <[email protected]> +Date: Tue, 26 May 2026 11:49:57 -0400 +Subject: [PATCH] virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check + (CVE-2026-48914) + +Check that the iovec containing struct virtio_scsi_inhdr is large enough +before storing an error value there. + +Feifan Qian <[email protected]> pointed out that this can be used to +corrupt heap memory when the descriptor uses an MMIO address and a +length of 1, forcing QEMU to allocate a 1-byte heap bounce buffer. +virtio_stl_p() stores 4 bytes and therefore corrupts whatever is beyond +the bounce buffer. + +Fixes: CVE-2026-48914 +Fixes: f34e73cd69bd ("virtio-blk: report non-zero status when failing SG_IO requests") + +CVE: CVE-2026-48914 + +Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/f5e2c6906cad9a84140e232f2e3eb7a46bf07f62] + +Reported-by: Feifan Qian <[email protected]> +Cc: Paolo Bonzini <[email protected]> +Signed-off-by: Stefan Hajnoczi <[email protected]> +Message-ID: <[email protected]> +Reviewed-by: Kevin Wolf <[email protected]> +Signed-off-by: Kevin Wolf <[email protected]> +(cherry picked from commit aeea0c2804c42f24915467a1e4c70e649e39b8e0) +Signed-off-by: Michael Tokarev <[email protected]> +Signed-off-by: Roopa Kalmath <[email protected]> +--- + hw/block/virtio-blk.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c +index 9cb9f1fb2b..6b92066aff 100644 +--- a/hw/block/virtio-blk.c ++++ b/hw/block/virtio-blk.c +@@ -199,10 +199,16 @@ static void virtio_blk_handle_scsi(VirtIOBlockReq *req) + + /* + * The scsi inhdr is placed in the second-to-last input segment, just +- * before the regular inhdr. ++ * before the regular inhdr. VIRTIO implementations normally do not rely on ++ * the precise message framing, but legacy implementations did and so we do ++ * too for the legacy virtio-blk SCSI request type. + * + * Just put anything nonzero so that the ioctl fails in the guest. + */ ++ if (elem->in_sg[elem->in_num - 2].iov_len != sizeof(*scsi)) { ++ status = VIRTIO_BLK_S_IOERR; ++ goto fail; ++ } + scsi = (void *)elem->in_sg[elem->in_num - 2].iov_base; + virtio_stl_p(vdev, &scsi->errors, 255); + status = VIRTIO_BLK_S_UNSUPP; +-- +GitLab + -- 2.49.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#246380): https://lists.openembedded.org/g/openembedded-core/message/246380 Mute This Topic: https://lists.openembedded.org/mt/121370912/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
