QEMU plugs libvduse out-of-bounds write via virtqueue size check

QEMU has fixed CVE-2026-61402, an out-of-bounds write in libvduse that stemmed from trusting an unvalidated virtqueue size.

libvduse sized its inflight log on the assumption that a queue’s size stays at or below the virtio maximum of 1024. The path that enables a queue took the size returned by VDUSE_VQ_GET_INFO at face value. A value above that limit overran the log and produced out-of-bounds writes when inflight state was updated.

The virtio specification only allows a queue size to shrink from its configured maximum, but the kernel VDUSE module does not enforce that bound for userspace, and another process cannot be assumed to follow the spec. Michael S. Tsirkin’s change rejects sizes above the maximum and leaves the queue disabled, closing the hole. The issue was reported by Jia Jia.