** Description changed:
[Impact]
CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
allocation path, allowing guest-to-host code execution from a
low-privileged process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/
S:C/C:H/I:H/A:H). Reported via ZDI (ZDI-26-332); fixed upstream in
March 2026 and shipped in QEMU 11.0.
[Affected version]
qemu 1:10.2.1+ds-1ubuntu3.1 (resolute-updates/main), Ubuntu 26.04.
[Verification]
hw/display/virtio-gpu.c in the shipped source still contains the
pre-fix implementation:
static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
uint32_t width, uint32_t height)
{
/* ... skip integer overflow check. ... */
int bpp = PIXMAN_FORMAT_BPP(pformat);
int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
return height * stride;
}
The fixed version widens all arithmetic to uint64_t and adds an
explicit size > UINT32_MAX rejection, returning bool with hostmem
as an out-parameter
No CVE-named patch is present in debian/patches/; the series file
contains no security patches.
[Current status]
pro fix CVE-2026-3886 reports: "Ubuntu security engineers are
investigating this issue. 1 package is still affected: qemu"
[Upstream status — verified by inspecting tagged source on
https://github.com/qemu/qemu]
- v10.2.1 vulnerable <- Ubuntu 26.04 ships this
- v10.2.2 vulnerable
- v10.2.3 FIXED released 2026-05-26
+ v10.2.1 vulnerable <- Ubuntu 26.04 ships this
+ v10.2.2 vulnerable
+ v10.2.3 FIXED released 2026-05-26
+ commit 2a28de12bae5a2840cbe9047a871af91e50f51bb
+ "virtio-gpu: fix overflow check when allocating 2d image"
+ cherry-picked from c035d5e; committed to stable 2026-04-01
+ by Michael Tokarev. Author: Marc-André Lureau (Red Hat).
+ Fixes: CVE-2026-3886, ZDI-CAN-27578
+ Fixes: 9462ff4 ("virtio-gpu/win32: allocate shareable 2d
+ resources/images")
+
+ Present in upstream v10.2.3 (released 2026-05-26)
[Status elsewhere]
Debian security tracker
(https://security-tracker.debian.org/tracker/CVE-2026-3886):
- bullseye not affected
- bookworm not affected
- trixie fixed in 1:10.0.10+ds-0+deb13u1
- unstable fixed in 1:11.0.0+ds-1
+ bullseye not affected
+ bookworm not affected
+ trixie fixed in 1:10.0.10+ds-0+deb13u1
+ unstable fixed in 1:11.0.0+ds-1
[Notes]
Public technical analysis of this bug class has been available since
late April 2026. Requesting triage and an SRU for 26.04.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162697
Title:
CVE-2026-3886: virtio-gpu integer overflow (calc_image_hostmem)
unfixed in qemu 1:10.2.1+ds-1ubuntu3.1
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2162697/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
