Hi, While working on CVE-2026-66020 (which had a few revision on list), I kept finding several places where virtio-gpu scanout and dmabuf ownership was unclear.
The CVE comes from using a blob after RESOURCE_DETACH_BACKING has unmapped its memory. Following that path also found stale dmabuf references, duplicated scanout bookkeeping, and inconsistent cleanup between display backends. This series makes each virtio_gpu_scanout own its current dmabuf and uses resource_id to track which resource it displays. It also makes QemuDmaBuf own its file descriptors and moves GTK fence state out of the dmabuf. Those changes touch a lot of area and I have done basic testing with the various backends. I would not recommend backporting them to stable: there is a high risk of introducing regressions. Yet, I don't know how to address all the problems uncovered by CVE-2026-66020 in a simple patch series. Help welcome! thanks Signed-off-by: Marc-André Lureau <[email protected]> --- Marc-André Lureau (18): ui/gtk: move GL fence tracking from QemuDmaBuf to VirtualGfxConsole ui/dbus: disable scanout iff dmabuf is current virtio-gpu: store the scanout DMABUF in virtio_gpu_scanout ui/console: disable GL scanout when dmabuf is the active one ui/sdl2: clear guest_fb.dmabuf on release ui/dmabuf: own and close fds on free virtio-gpu: release the dmabuf when a scanout is disabled contrib/vhost-user-gpu: drop scanout_bitmask bookkeeping virtio-gpu-rutabaga: fix scanout handling virtio-gpu: disable blob scanouts on mapping cleanup virtio-gpu: drop scanout_bitmask bookkeeping virtio-gpu: release dmabuf when switching to a surface virtio-gpu/virgl: release dmabuf when a texture replaces a scanout virtio-gpu: consolidate disabling scanout virtio-gpu: minor refactoring virtio-gpu/virgl: disable scanouts on resource unref virtio-gpu: initialize dmabuf_fd to -1 virtio-gpu: fix use-after-free on blob cursor after detach contrib/vhost-user-gpu/vhost-user-gpu.c | 28 +++------- hw/display/vhost-user-gpu.c | 1 - hw/display/virtio-gpu-rutabaga.c | 26 +++++++--- hw/display/virtio-gpu-udmabuf-stubs.c | 2 +- hw/display/virtio-gpu-udmabuf.c | 90 +++++++++++---------------------- hw/display/virtio-gpu-virgl.c | 75 +++++++++++++++------------ hw/display/virtio-gpu.c | 82 +++++++++++++++++++----------- hw/vfio/display.c | 1 - include/hw/virtio/virtio-gpu.h | 18 ++----- include/ui/dmabuf.h | 5 -- include/ui/egl-helpers.h | 4 +- include/ui/gtk.h | 8 +-- ui/console.c | 3 ++ ui/dbus-listener.c | 69 +++++++++++++++++-------- ui/dmabuf.c | 51 +++---------------- ui/egl-helpers.c | 15 +++--- ui/gtk-egl.c | 30 ++++++----- ui/gtk-gl-area.c | 12 ++--- ui/gtk.c | 31 +++++++++--- ui/sdl2-gl.c | 5 ++ 20 files changed, 277 insertions(+), 279 deletions(-) --- base-commit: 82706188517bd102ed25f1931c4cb041ecf3ef50 change-id: 20260825-virtio-gpu-cleanup-dfb2ba185936 Best regards, -- Marc-André Lureau <[email protected]>
