When a blob resource backing is cleaned up (for ex via detach_backing), any scanouts referencing it must be disabled first to prevent the dmabuf from outliving its backing memory.
Fixes: CVE-2026-66020 Reported-by: Akihiko Odaki <[email protected]> Signed-off-by: Marc-André Lureau <[email protected]> --- hw/display/virtio-gpu.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index 46ddfeeaba87..e547cac60398 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -982,6 +982,16 @@ void virtio_gpu_cleanup_mapping_iov(VirtIOGPU *g, void virtio_gpu_cleanup_mapping(VirtIOGPU *g, struct virtio_gpu_simple_resource *res) { + if (res->blob) { + int i, max_outputs = g->parent_obj.conf.max_outputs; + + for (i = 0; i < max_outputs; i++) { + if (g->parent_obj.scanout[i].resource_id == res->resource_id) { + virtio_gpu_disable_scanout(g, i); + } + } + } + virtio_gpu_cleanup_mapping_iov(g, res->iov, res->iov_cnt); res->iov = NULL; res->iov_cnt = 0; -- 2.55.0.543.g5ebe2ebe4ea8
