** Description changed:
[Impact]
CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
allocation path, allowing guest-to-host code execution from a
low-privileged process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/
S:C/C:H/I:H/A:H). Reported via ZDI (ZDI-26-332); fixed upstream in
March 2026 and shipped in QEMU 11.0.
[Affected version]
qemu 1:10.2.1+ds-1ubuntu3.1 (resolute-updates/main), Ubuntu 26.04.
[Verification]
hw/display/virtio-gpu.c in the shipped source still contains the
pre-fix implementation:
static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
uint32_t width, uint32_t height)
{
/* ... skip integer overflow check. ... */
int bpp = PIXMAN_FORMAT_BPP(pformat);
int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
return height * stride;
}
- Upstream widens all arithmetic to uint64_t and adds an explicit
- size > UINT32_MAX rejection, returning bool with hostmem and
- rowstride_bytes as out-parameters.
+ The fixed version widens all arithmetic to uint64_t and adds an
+ explicit size > UINT32_MAX rejection, returning bool with hostmem
+ as an out-parameter
No CVE-named patch is present in debian/patches/; the series file
contains no security patches.
`pro fix CVE-2026-3886` reports: "Ubuntu security engineers are
investigating this issue. 1 package is still affected: qemu"
[Status elsewhere]
- Debian: fixed in the 13.6 point release
[Notes]
Public technical analysis of this bug class has been available since
late April 2026. Requesting triage and an SRU for 26.04.
** Description changed:
[Impact]
CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
allocation path, allowing guest-to-host code execution from a
low-privileged process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/
S:C/C:H/I:H/A:H). Reported via ZDI (ZDI-26-332); fixed upstream in
March 2026 and shipped in QEMU 11.0.
[Affected version]
qemu 1:10.2.1+ds-1ubuntu3.1 (resolute-updates/main), Ubuntu 26.04.
[Verification]
hw/display/virtio-gpu.c in the shipped source still contains the
pre-fix implementation:
static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
uint32_t width, uint32_t height)
{
/* ... skip integer overflow check. ... */
int bpp = PIXMAN_FORMAT_BPP(pformat);
int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
return height * stride;
}
The fixed version widens all arithmetic to uint64_t and adds an
explicit size > UINT32_MAX rejection, returning bool with hostmem
as an out-parameter
No CVE-named patch is present in debian/patches/; the series file
contains no security patches.
- `pro fix CVE-2026-3886` reports: "Ubuntu security engineers are
+ [Current status]
+ pro fix CVE-2026-3886 reports: "Ubuntu security engineers are
investigating this issue. 1 package is still affected: qemu"
+ [Upstream status — verified by inspecting tagged source on
+ https://github.com/qemu/qemu]
+ v10.2.1 vulnerable <- Ubuntu 26.04 ships this
+ v10.2.2 vulnerable
+ v10.2.3 FIXED released 2026-05-26
+
[Status elsewhere]
- - Debian: fixed in the 13.6 point release
+ Debian security tracker
+ (https://security-tracker.debian.org/tracker/CVE-2026-3886):
+ bullseye not affected
+ bookworm not affected
+ trixie fixed in 1:10.0.10+ds-0+deb13u1
+ unstable fixed in 1:11.0.0+ds-1
[Notes]
Public technical analysis of this bug class has been available since
late April 2026. Requesting triage and an SRU for 26.04.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162697
Title:
CVE-2026-3886: virtio-gpu integer overflow (calc_image_hostmem)
unfixed in qemu 1:10.2.1+ds-1ubuntu3.1
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2162697/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
