@samitouri / QOSamiQemu / commits / a6e0519ea8

virtio: use masked features with set_features_ex

virtio_set_features_nocheck() calls set_features_ex with guest-supplied feature bits, without masking the value with host features (unlike set_features which gets the correct val & host_features). This does not matter if the driver matches spec, but drivers can be malicious or buggy and set bit outside the host mask. Devices don't expect this, so unsupported guest feature bits getting set can break the host. In virtio-net, this can enable RSC without vnet header support and cause out-of-bounds reads from short packets. Pass the masked features to set_features_ex, consistent with set_features. Fixes: CVE-2026-63321 Fixes: 64a6a336f4 ("virtio: add support for negotiating extended features") Cc: Jason Wang <jasowangio@gmail.com> Cc: Yuri Benditovich <ybendito@redhat.com> Cc: Paolo Abeni <pabeni@redhat.com> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3623 Reported-by: huntr bubble <bubblehuntr@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <dfd27c9b26e442a2076f6ddc9bb3d38363d9b2da.1784891251.git.mst@redhat.com>

Michael S. Tsirkin committed Jul 8, 2026 at 11:31 UTC a6e0519ea8ed6fc84fab9bf9ca82c7a55780f880

1 file changed +1 -1

hw/virtio/virtio.c

+1 -1

@@ -3320,7 +3320,7 @@ static int virtio_set_features_nocheck(VirtIODevice *vdev, const uint64_t *val)

3320 virtio_features_and(tmp, val, vdev->host_features_ex);

3321

3322 if (k->set_features_ex) {

3323 - k->set_features_ex(vdev, val);

3323 + k->set_features_ex(vdev, tmp);

3324 } else if (k->set_features) {

3325 bad = bad || virtio_features_use_ex(tmp);

3326 k->set_features(vdev, tmp[0]);