** Description changed:
[Impact]
CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
allocation path, allowing guest-to-host code execution from a
low-privileged process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/
S:C/C:H/I:H/A:H). Reported via ZDI (ZDI-26-332); fixed upstream in
March 2026 and shipped in QEMU 11.0.
[Affected version]
qemu 1:10.2.1+ds-1ubuntu3.1 (resolute-updates/main), Ubuntu 26.04.
[Verification]
hw/display/virtio-gpu.c in the shipped source still contains the
pre-fix implementation:
- static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
- uint32_t width, uint32_t height)
- {
- /* ... skip integer overflow check. ... */
- int bpp = PIXMAN_FORMAT_BPP(pformat);
- int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
- return height * stride;
- }
+ static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
+ uint32_t width, uint32_t height)
+ {
+ /* ... skip integer overflow check. ... */
+ int bpp = PIXMAN_FORMAT_BPP(pformat);
+ int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
+ return height * stride;
+ }
Upstream widens all arithmetic to uint64_t and adds an explicit
size > UINT32_MAX rejection, returning bool with hostmem and
rowstride_bytes as out-parameters.
No CVE-named patch is present in debian/patches/; the series file
contains no security patches.
`pro fix CVE-2026-3886` reports: "Ubuntu security engineers are
investigating this issue. 1 package is still affected: qemu"
[Status elsewhere]
- Debian: fixed in the 13.6 point release
- SUSE: SUSE-SU-2026:22550-1 (7 July 2026)
- - Fedora: fixed via the QEMU 11.0 rebase
- - RHEL/Oracle: ELSA-2026-50337
+ - Oracle: ELSA-2026-50337
[Notes]
Public technical analysis of this bug class has been available since
late April 2026. Requesting triage and an SRU for 26.04.
** Description changed:
[Impact]
CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
allocation path, allowing guest-to-host code execution from a
low-privileged process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/
S:C/C:H/I:H/A:H). Reported via ZDI (ZDI-26-332); fixed upstream in
March 2026 and shipped in QEMU 11.0.
[Affected version]
qemu 1:10.2.1+ds-1ubuntu3.1 (resolute-updates/main), Ubuntu 26.04.
[Verification]
hw/display/virtio-gpu.c in the shipped source still contains the
pre-fix implementation:
static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
uint32_t width, uint32_t height)
{
/* ... skip integer overflow check. ... */
int bpp = PIXMAN_FORMAT_BPP(pformat);
int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
return height * stride;
}
Upstream widens all arithmetic to uint64_t and adds an explicit
size > UINT32_MAX rejection, returning bool with hostmem and
rowstride_bytes as out-parameters.
No CVE-named patch is present in debian/patches/; the series file
contains no security patches.
`pro fix CVE-2026-3886` reports: "Ubuntu security engineers are
investigating this issue. 1 package is still affected: qemu"
[Status elsewhere]
- Debian: fixed in the 13.6 point release
- - SUSE: SUSE-SU-2026:22550-1 (7 July 2026)
- Oracle: ELSA-2026-50337
[Notes]
Public technical analysis of this bug class has been available since
late April 2026. Requesting triage and an SRU for 26.04.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162697
Title:
CVE-2026-3886: virtio-gpu integer overflow (calc_image_hostmem)
unfixed in qemu 1:10.2.1+ds-1ubuntu3.1
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2162697/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
