QEMU security fixes for migration, display, and virtio

QEMU developers focused on hardening several device emulation paths against overflows, use-after-free conditions, and incomplete prior fixes. Multiple patches target the 11.1 release while one series prepares lifecycle changes for 11.2.

e1000e and igb migration overflow fix

Patches for the e1000e and igb network devices instruct QEMU to ignore untrusted rx_desc_len values supplied in a migration stream. The change prevents a stack buffer overflow on migration load. Operators who migrate guests between hosts gain protection against crafted migration images that could compromise the hypervisor.

UI and virtio-gpu fixes pulled for 11.1

A pull request merges fifteen UI and virtio-gpu changes into QEMU 11.1. Several of the fixes address out-of-bounds writes, allocation failures, and time-of-check-to-time-of-use races. The batch tightens the security boundary for graphical consoles and GPU-accelerated guests.

QXL hot-unplug use-after-free

A patch resolves a use-after-free that occurred when a QXL display device was hot-unplugged, tracked as CVE-2026-63322. The fix adds an exit callback that unregisters the VM change-state handler and associated bottom halves. Hosts that allow guests to trigger display device removal are no longer exposed to the dangling-pointer path.

Packed vring infinite-loop prevention

A targeted patch stops virtio_queue_empty() from spinning forever when presented with a broken packed vring, closing CVE-2026-16457. Split vrings already rejected the same malformed state. The correction improves resilience against malicious or faulty virtio backends ahead of the 11.1 release.

Intel HDA DMA path restrictions

A follow-up patch completes the earlier CVE-2021-3611 remediation by attaching memory attributes to three additional Intel HDA DMA engine paths. Guest-triggered MMIO reentry is thereby blocked on those remaining routes. Audio device models continue to present a useful attack surface, so the extended coverage reduces residual risk.

vfio-user client response validation

A five-patch series teaches the vfio-user client to validate every server response, correcting buffer overflows and missing size checks. The client now rejects malformed replies before they can corrupt local state. Deployments that offload devices over vfio-user obtain stronger isolation from a compromised or buggy server process.

qdev realization lifecycle enforcement

The third revision of a fifteen-patch series clarifies qdev realized-state tracking and adds a qdev_is_realized accessor for the 11.2 cycle. Device realization is now more strictly enforced throughout the object lifecycle. Cleaner state management lowers the likelihood of future bugs that arise from devices being used before or after they are properly realized.