QEMU patches libvduse OOB write via unchecked virtqueue size
CVE-2026-61402 let an untrusted vq size overrun the inflight log because libvduse trusted kernel-supplied values without a bounds check.
QEMU has fixed CVE-2026-61402, an out-of-bounds write in libvduse caused by accepting an oversized virtqueue without validation.
libvduse maps its inflight log on the assumption that a virtqueue’s size stays at or below the virtio maximum of 1024. When enabling a queue it took the size returned by VDUSE_VQ_GET_INFO at face value. A value above that limit overran the log and produced out-of-bounds writes in the inflight-tracking path.
The virtio specification only allows a queue size to shrink from its configured maximum, but the kernel VDUSE module does not enforce that rule, and libvduse cannot safely trust another process to obey the spec. Michael S. Tsirkin’s fix rejects any reported size above the maximum and leaves the queue disabled, closing the hole. The issue was reported by Jia Jia.