QEMU fixes virtio-mmio queue size OOB (CVE-2026-50626)
virtio-mmio always advertised a 1024-entry maximum, which becomes unsafe once QEMU itself allocates in-order virtqueue resources.
QEMU has fixed an out-of-bounds memory access in its virtio-mmio transport that could be triggered when guests used in-order virtqueues, tracked as CVE-2026-50626.
The MMIO backend always told the guest that every queue could hold 1024 entries, ignoring the size the device actually registered. That mismatch was mostly harmless while the guest alone allocated ring memory. With in-order virtqueues, QEMU allocates the backing resources itself, so a guest that selected a larger queue than had been reserved walked past the end of the buffer.
Michael S. Tsirkin’s fix makes new machine types report the true per-queue maximum. Older machine types keep the historical advertisement and instead force 1024-entry allocations through a compatibility property, preserving migration and guest compatibility.
Anyone running virtio-mmio guests with in-order queues should take the update; legacy setups without that feature were not exposed in the same way.