QEMU fixes VGA text-mode out-of-bounds write after graphics switch

QEMU maintainers are landing a fix for CVE-2026-77913, an out-of-bounds write in the emulated VGA text renderer that could fire after a switch from graphics mode.

The flaw sits in how the display code decides whether to resize the console surface. Text and graphics paths shared geometry cache fields measured in different units, and legacy (non-VBE) graphics modes left the depth field at zero, so a shrink in graphics mode was not always noticed when text mode returned with matching character dimensions. The glyph painter then wrote a full text frame into the smaller surface, past its bounds, using guest-controlled DAC palette values on every refresh.

Warisjeet Singh's patch separates the geometry caches so text and graphics no longer share ambiguous width and height state, and adds a direct check that the pixel size about to be painted fits the console surface that is actually installed. That surface comparison is what catches the cross-renderer swap; cache units alone cannot.

Marc-André Lureau pushed for a fuller split so text paths only touch text-side cache fields. Singh followed up with a revised series that completes that separation and confirms the fix against the reported reproducer under ASAN, while leaving ordinary SeaBIOS text boot output intact. The change is marked for stable QEMU releases.