On 9/10/26 06:02, [email protected] wrote:
From: Marc-André Lureau<[email protected]>
The following changes since commit 257bf4f160c50ca8c4ebd603f519f5c786013fb7:
Merge tag 'for-upstream' ofhttps://gitlab.com/bonzini/qemu into staging
(2026-09-10 11:08:04 +0100)
are available in the Git repository at:
https://gitlab.com/marcandre.lureau/qemu.git tags/virtio-gpu-pr-v2
for you to fetch changes up to d6e516555805b95a7a935c3fd74568dabf7796f2:
contrib/vhost-user-gpu: disable scanouts on resource unref (2026-09-10
19:59:43 +0400)
----------------------------------------------------------------
Various virtio-gpu/dmabuf related fixes
While working on CVE-2026-66020 (which had a few revision on list), I
kept finding several places where virtio-gpu scanout and dmabuf
ownership was unclear.
The CVE comes from using a blob after RESOURCE_DETACH_BACKING has
unmapped its memory. Following that path also found stale dmabuf
references, duplicated scanout bookkeeping, and inconsistent cleanup
between display backends.
Those changes touch a lot of area and I have done basic testing with the
various backends. I would not recommend backporting them all to stable.
The first 2 patches address CVE-2026-66020 in the general case and
should be safe to backport.
Applied, thanks.
r~
