[OE-core][wrynose][PATCH] qemu: fix CVE-2026-48914

[Roopa Kalmath <Roopa.Kalmath@windriver.com>]

flaw was found in QEMU's virtio-blk device. The issue arises
because the device does not properly validate the size of input
descriptors before writing data. A malicious guest with high privileges could
exploit this vulnerability by submitting a malformed virtio-blk SCSI
request, leading to an out-of-bounds write in the host heap memory
and a potential denial of service (DoS) for the QEMU process.

 Reference: [https://nvd.nist.gov/vuln/detail/CVE-2026-48914]

            [https://security-tracker.debian.org/tracker/CVE-2026-48914]

Backport the patch to fix CVE-2026-48914:

            [https://gitlab.com/qemu-project/qemu/-/commit/f5e2c6906cad9a84140e232f2e3eb7a46bf07f62]

Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
---
 meta/recipes-devtools/qemu/qemu.inc           |  1 +
 .../qemu/qemu/CVE-2026-48914.patch            | 60 +++++++++++++++++++
 2 files changed, 61 insertions(+)
 create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2026-48914.patch

diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
index cc8f2ecdfa..6a217cdaeb 100644
--- a/meta/recipes-devtools/qemu/qemu.inc
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -42,6 +42,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
            file://CVE-2025-14876_p1.patch \
            file://CVE-2025-14876_p2.patch \
            file://0012-linux-user-Check-if-RESOLVE_CACHED-flag-is-defined-b.patch \
+           file://CVE-2026-48914.patch \
            "
 # file index at download.qemu.org isn't reliable: https://gitlab.com/qemu-project/qemu-web/-/issues/9
 UPSTREAM_CHECK_URI = "https://www.qemu.org"
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2026-48914.patch b/meta/recipes-devtools/qemu/qemu/CVE-2026-48914.patch
new file mode 100644
index 0000000000..e38292d471
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2026-48914.patch
@@ -0,0 +1,60 @@
+From f5e2c6906cad9a84140e232f2e3eb7a46bf07f62 Mon Sep 17 00:00:00 2001
+From: Stefan Hajnoczi <stefanha@redhat.com>
+Date: Tue, 26 May 2026 11:49:57 -0400
+Subject: [PATCH] virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check
+ (CVE-2026-48914)
+
+Check that the iovec containing struct virtio_scsi_inhdr is large enough
+before storing an error value there.
+
+Feifan Qian <bea1e@proton.me> pointed out that this can be used to
+corrupt heap memory when the descriptor uses an MMIO address and a
+length of 1, forcing QEMU to allocate a 1-byte heap bounce buffer.
+virtio_stl_p() stores 4 bytes and therefore corrupts whatever is beyond
+the bounce buffer.
+
+Fixes: CVE-2026-48914
+Fixes: f34e73cd69bd ("virtio-blk: report non-zero status when failing SG_IO requests")
+
+CVE: CVE-2026-48914
+
+Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/f5e2c6906cad9a84140e232f2e3eb7a46bf07f62]
+
+Reported-by: Feifan Qian <bea1e@proton.me>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-ID: <20260526154957.1741622-1-stefanha@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+(cherry picked from commit aeea0c2804c42f24915467a1e4c70e649e39b8e0)
+Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
+Signed-off-by: Roopa Kalmath <Roopa.Kalmath@windriver.com>
+---
+ hw/block/virtio-blk.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
+index 9cb9f1fb2b..6b92066aff 100644
+--- a/hw/block/virtio-blk.c
++++ b/hw/block/virtio-blk.c
+@@ -199,10 +199,16 @@ static void virtio_blk_handle_scsi(VirtIOBlockReq *req)
+ 
+     /*
+      * The scsi inhdr is placed in the second-to-last input segment, just
+-     * before the regular inhdr.
++     * before the regular inhdr. VIRTIO implementations normally do not rely on
++     * the precise message framing, but legacy implementations did and so we do
++     * too for the legacy virtio-blk SCSI request type.
+      *
+      * Just put anything nonzero so that the ioctl fails in the guest.
+      */
++    if (elem->in_sg[elem->in_num - 2].iov_len != sizeof(*scsi)) {
++        status = VIRTIO_BLK_S_IOERR;
++        goto fail;
++    }
+     scsi = (void *)elem->in_sg[elem->in_num - 2].iov_base;
+     virtio_stl_p(vdev, &scsi->errors, 255);
+     status = VIRTIO_BLK_S_UNSUPP;
+-- 
+GitLab
+
-- 
2.49.1