The inflight buffer size is migrated as a uint64_t, but vmstate_size() reads VMS_VBUFFER sizes as int32_t. Values above INT32_MAX therefore become negative and are converted to a very large size_t while loading the buffer, allowing writes beyond the smaller memfd-backed mapping.
Reject sizes that cannot be represented by vmstate_size() before allocating the destination buffer. Fixes: CVE-2026-6426 Reported-by: Seungjung Kim <[email protected]> Signed-off-by: Seungjung Kim <[email protected]> diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c index af41841b52..82eb9407ae 100644 --- a/hw/virtio/vhost.c +++ b/hw/virtio/vhost.c @@ -2022,11 +2022,18 @@ void vhost_get_features_ex(struct vhost_dev *hdev, static bool vhost_inflight_buffer_pre_load(void *opaque, Error **errp) { struct vhost_inflight *inflight = opaque; - int fd = -1; - void *addr = qemu_memfd_alloc("vhost-inflight", inflight->size, - F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL, - &fd, errp); + void *addr; + + if (inflight->size > INT32_MAX) { + error_setg(errp, "inflight buffer size %" PRIu64 + " exceeds maximum %d", inflight->size, INT32_MAX); + return false; + } + + addr = qemu_memfd_alloc("vhost-inflight", inflight->size, + F_SEAL_GROW | F_SEAL_SHRINK | F_SEAL_SEAL, + &fd, errp); if (!addr) { return false; } -- 2.50.1 (Apple Git-155)
