@samitouri / QOSamiQemu / commits / b9d248dfac

libvhost-user: fix heap overflow in vu_check_queue_inflights

vu_check_queue_inflights counts inflight descriptors using inflight == 1 but copies entries using inflight != 0. If the inflight field contains an unexpected non-0/1 value, the function copies more entries than it allocates and overflows the heap buffer. Stop the copy pass once resubmit_num reaches the counted inuse value. Note: the value is not guest-accessible so not a security vulnerability. Fixes: CVE-2026-63110 Fixes: 5f9ff1eff3 ("libvhost-user: Support tracking inflight I/O in shared memory") Cc: Xie Yongji <xieyongji@bytedance.com> Cc: Stefano Garzarella <sgarzare@redhat.com> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3974 Reported-by: BB CC <wywwzjj@gmail.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <e2315efc526c0ee918485df4be69e2b26e8b7a73.1784892981.git.mst@redhat.com>

Michael S. Tsirkin committed Jul 24, 2026 at 07:26 UTC b9d248dfaca5e31377ea4f7204aae788a050bafd
1 file changed +7
subprojects/libvhost-user/libvhost-user.c
+7
@@ -1408,6 +1408,13 @@ vu_check_queue_inflights(VuDev *dev, VuVirtq *vq)
1408
1409 for (i = 0; i < vq->inflight->desc_num; i++) {
1410 if (vq->inflight->desc[i].inflight) {
1411 + /*
1412 + * We earlier counted exactly vq->inuse in flight -
1413 + * what is going on?
1414 + */
1415 + if (vq->resubmit_num >= vq->inuse) {
1416 + return -1;
1417 + }
1418 vq->resubmit_list[vq->resubmit_num].index = i;
1419 vq->resubmit_list[vq->resubmit_num].counter =
1420 vq->inflight->desc[i].counter;