From: Michael S. Tsirkin Date: Fri, 24 Jul 2026 11:26:29 +0000 (-0400) Subject: libvhost-user: fix heap overflow in vu_check_queue_inflights X-Git-Tag: v11.1.0-rc2~6^2~14 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b9d248dfaca5e31377ea4f7204aae788a050bafd;p=thirdparty%2Fqemu.git libvhost-user: fix heap overflow in vu_check_queue_inflights vu_check_queue_inflights counts inflight descriptors using inflight == 1 but copies entries using inflight != 0. If the inflight field contains an unexpected non-0/1 value, the function copies more entries than it allocates and overflows the heap buffer. Stop the copy pass once resubmit_num reaches the counted inuse value. Note: the value is not guest-accessible so not a security vulnerability. Fixes: CVE-2026-63110 Fixes: 5f9ff1eff3 ("libvhost-user: Support tracking inflight I/O in shared memory") Cc: Xie Yongji Cc: Stefano Garzarella Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3974 Reported-by: BB CC Signed-off-by: Michael S. Tsirkin Message-Id: --- diff --git a/subprojects/libvhost-user/libvhost-user.c b/subprojects/libvhost-user/libvhost-user.c index c1c13dbc90..a74d814bb4 100644 --- a/subprojects/libvhost-user/libvhost-user.c +++ b/subprojects/libvhost-user/libvhost-user.c @@ -1408,6 +1408,13 @@ vu_check_queue_inflights(VuDev *dev, VuVirtq *vq) for (i = 0; i < vq->inflight->desc_num; i++) { if (vq->inflight->desc[i].inflight) { + /* + * We earlier counted exactly vq->inuse in flight - + * what is going on? + */ + if (vq->resubmit_num >= vq->inuse) { + return -1; + } vq->resubmit_list[vq->resubmit_num].index = i; vq->resubmit_list[vq->resubmit_num].counter = vq->inflight->desc[i].counter;