@@ -42,6 +42,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
file://CVE-2025-14876_p1.patch \
file://CVE-2025-14876_p2.patch \
file://0012-linux-user-Check-if-RESOLVE_CACHED-flag-is-defined-b.patch \
+ file://CVE-2026-48914.patch \
"
# file index at download.qemu.org isn't reliable: https://gitlab.com/qemu-project/qemu-web/-/issues/9
UPSTREAM_CHECK_URI = "https://www.qemu.org"
new file mode 100644
@@ -0,0 +1,60 @@
+From f5e2c6906cad9a84140e232f2e3eb7a46bf07f62 Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Tue, 26 May 2026 11:49:57 -0400
+Subject: [PATCH] virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check
+ (CVE-2026-48914)
+
+Check that the iovec containing struct virtio_scsi_inhdr is large enough
+before storing an error value there.
+
+Feifan Qian <bea1e@proton.me> pointed out that this can be used to
+corrupt heap memory when the descriptor uses an MMIO address and a
+length of 1, forcing QEMU to allocate a 1-byte heap bounce buffer.
+virtio_stl_p() stores 4 bytes and therefore corrupts whatever is beyond
+the bounce buffer.
+
+Fixes: CVE-2026-48914
+Fixes: f34e73cd69bd ("virtio-blk: report non-zero status when failing SG_IO requests")
+
+CVE: CVE-2026-48914
+
+Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/f5e2c6906cad9a84140e232f2e3eb7a46bf07f62]
+
+Reported-by: Feifan Qian <bea1e@proton.me>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20260526154957.1741622-1-stefanha@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit aeea0c2804c42f24915467a1e4c70e649e39b8e0)
+Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
+Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
+---
+ hw/block/virtio-blk.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
+index 9cb9f1fb2b..6b92066aff 100644
+--- a/hw/block/virtio-blk.c
++++ b/hw/block/virtio-blk.c
+@@ -199,10 +199,16 @@ static void virtio_blk_handle_scsi(VirtIOBlockReq *req)
+
+ /*
+ * The scsi inhdr is placed in the second-to-last input segment, just
+- * before the regular inhdr.
++ * before the regular inhdr. VIRTIO implementations normally do not rely on
++ * the precise message framing, but legacy implementations did and so we do
++ * too for the legacy virtio-blk SCSI request type.
+ *
+ * Just put anything nonzero so that the ioctl fails in the guest.
+ */
++ if (elem->in_sg[elem->in_num - 2].iov_len != sizeof(*scsi)) {
++ status = VIRTIO_BLK_S_IOERR;
++ goto fail;
++ }
+ scsi = (void *)elem->in_sg[elem->in_num - 2].iov_base;
+ virtio_stl_p(vdev, &scsi->errors, 255);
+ status = VIRTIO_BLK_S_UNSUPP;
+--
+GitLab
+
flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2026-48914] [https://security-tracker.debian.org/tracker/CVE-2026-48914] Backport the patch to fix CVE-2026-48914: [https://gitlab.com/qemu-project/qemu/-/commit/f5e2c6906cad9a84140e232f2e3eb7a46bf07f62] Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com> --- meta/recipes-devtools/qemu/qemu.inc | 1 + .../qemu/qemu/CVE-2026-48914.patch | 60 +++++++++++++++++++ 2 files changed, 61 insertions(+) create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2026-48914.patch