On Fri, Jul 24, 2026 at 06:57:02AM -0400, Michael S. Tsirkin wrote:
> vhost user currently saves the inflight buffer to the migration stream
> using VMSTATE_VBUFFER_UINT64. The size is controlled by the vhost-user
> backend.
>
> But the implementation of that is broken if size is >2G: it stores the
> buffer size in a uint64_t field, but vmstate_size() always reads the
> size field as int32_t regardless of the macro used. This, in turn,
> causes negative or truncated lengths on load, leading to undersized
> allocations and down the road out-of-bounds buffer access.
>
> There's no practical reason to support such large sizes, so it's enough
> to validate: read the field as uint64_t when VMS_VBUFFER_UINT64 is set,
> reject negative or oversized values, and propagate errors to
> vmstate_load_vmsd().
>
> Note: the large value is coming from the backend, not guest, so this
> shouldn't be considered a security issue. The CVE was assigned before
> the qemu security policy was updated to exclude this class of bugs.
>
> Fixes: CVE-2026-6426
> Fixes: f6fdd8b2bd ("vmstate: introduce VMSTATE_VBUFFER_UINT64")
> Cc: Alexandr Moshkov <[email protected]>
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3675
> Signed-off-by: Michael S. Tsirkin <[email protected]>
Just to keep a record in case anyone needs, the review discussion is in the
pull request:
https://lore.kernel.org/qemu-devel/[email protected]/
--
Peter Xu
