** Description changed:
[Impact]
CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
allocation path, allowing guest-to-host code execution from a low-privileged
process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Reported via ZDI (ZDI-26-332), CVSS from the ZDI advisory; Fixed upstream
2026-04-01 (stable branch) and released in QEMU v10.2.3 on 2026-05-26
[Affected version]
qemu 1:10.2.1+ds-1ubuntu3.1 (resolute-updates/main), Ubuntu 26.04.
[Verification]
hw/display/virtio-gpu.c in the shipped source still contains the pre-fix
implementation:
static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
uint32_t width, uint32_t height)
{
/* ... skip integer overflow check. ... */
int bpp = PIXMAN_FORMAT_BPP(pformat);
int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
return height * stride;
}
The fixed version widens all arithmetic to uint64_t and adds an explicit
size > UINT32_MAX rejection, returning bool with hostmem as an out-
parameter
No CVE-named patch is present in debian/patches/
[Current status]
pro fix CVE-2026-3886 reports: "Ubuntu security engineers are investigating
this issue. 1 package is still affected: qemu"
[Upstream status — verified by inspecting tagged source on
https://github.com/qemu/qemu]
v10.2.1 vulnerable <- Ubuntu 26.04 ships this
v10.2.2 vulnerable
v10.2.3 FIXED released 2026-05-26
commit 2a28de12bae5a2840cbe9047a871af91e50f51bb
"virtio-gpu: fix overflow check when allocating 2d image"
cherry-picked from c035d5e; committed to stable 2026-04-01
by Michael Tokarev. Author: Marc-André Lureau (Red Hat).
Fixes: CVE-2026-3886, ZDI-CAN-27578
Fixes: 9462ff4 ("virtio-gpu/win32: allocate shareable 2d resources/images")
Present in upstream v10.2.3 (released 2026-05-26)
Note: the fix changes calc_image_hostmem()'s signature to return bool
with hostmem as an out-parameter, so a cherry-pick must include the
updated call sites
[Status elsewhere]
Debian security tracker
(https://security-tracker.debian.org/tracker/CVE-2026-3886):
bullseye not affected
bookworm not affected
trixie fixed in 1:10.0.10+ds-0+deb13u1
- unstable fixed in 1:11.0.0+ds-1
-
+
[Request]
Requesting a security update for qemu in Ubuntu 26.04
** Description changed:
[Impact]
CVE-2026-3886 is an integer overflow in QEMU's virtio-gpu 2D resource
allocation path, allowing guest-to-host code execution from a low-privileged
process inside the guest. CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Reported via ZDI (ZDI-26-332), CVSS from the ZDI advisory; Fixed upstream
2026-04-01 (stable branch) and released in QEMU v10.2.3 on 2026-05-26
[Affected version]
qemu 1:10.2.1+ds-1ubuntu3.1 (resolute-updates/main), Ubuntu 26.04.
[Verification]
hw/display/virtio-gpu.c in the shipped source still contains the pre-fix
implementation:
static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
uint32_t width, uint32_t height)
{
/* ... skip integer overflow check. ... */
int bpp = PIXMAN_FORMAT_BPP(pformat);
int stride = ((width * bpp + 0x1f) >> 5) * sizeof(uint32_t);
return height * stride;
}
The fixed version widens all arithmetic to uint64_t and adds an explicit
size > UINT32_MAX rejection, returning bool with hostmem as an out-
parameter
No CVE-named patch is present in debian/patches/
[Current status]
pro fix CVE-2026-3886 reports: "Ubuntu security engineers are investigating
this issue. 1 package is still affected: qemu"
[Upstream status — verified by inspecting tagged source on
https://github.com/qemu/qemu]
v10.2.1 vulnerable <- Ubuntu 26.04 ships this
v10.2.2 vulnerable
v10.2.3 FIXED released 2026-05-26
commit 2a28de12bae5a2840cbe9047a871af91e50f51bb
"virtio-gpu: fix overflow check when allocating 2d image"
cherry-picked from c035d5e; committed to stable 2026-04-01
by Michael Tokarev. Author: Marc-André Lureau (Red Hat).
Fixes: CVE-2026-3886, ZDI-CAN-27578
Fixes: 9462ff4 ("virtio-gpu/win32: allocate shareable 2d resources/images")
Present in upstream v10.2.3 (released 2026-05-26)
Note: the fix changes calc_image_hostmem()'s signature to return bool
with hostmem as an out-parameter, so a cherry-pick must include the
updated call sites
[Status elsewhere]
Debian security tracker
(https://security-tracker.debian.org/tracker/CVE-2026-3886):
bullseye not affected
bookworm not affected
trixie fixed in 1:10.0.10+ds-0+deb13u1
-
+ unstable fixed in 1:11.0.0+ds-1
+
[Request]
Requesting a security update for qemu in Ubuntu 26.04
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162697
Title:
CVE-2026-3886: virtio-gpu integer overflow (calc_image_hostmem)
unfixed in qemu 1:10.2.1+ds-1ubuntu3.1
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2162697/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
