QEMU patches virtio queue-size OOB flaw (CVE-2026-50626)
Guests could set virtio queues larger than the host allocated, enabling out-of-bounds access when in-order delivery was in use.
QEMU has fixed a virtio queue-size validation bug that let a guest trigger out-of-bounds reads and writes in the host, tracked as CVE-2026-50626.
The problem was a mismatch between how queues are allocated and how large a guest is allowed to make them. Queue backing structures are sized for a default maximum, but the path that accepts a guest-supplied size would still honor values up to the global virtqueue ceiling. When the VIRTIO_F_IN_ORDER feature was enabled, that gap let the guest drive accesses past the end of the allocated array.
Michael S. Tsirkin’s fix rejects any guest queue size larger than the default the device already allocated and marks the device broken instead of applying the oversized value. The change closes a host memory-safety hole reachable from an untrusted guest and is relevant anywhere QEMU exposes virtio with guest-configurable queue sizes.