mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-13 18:49:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

qemu: Fix CVE-2026-0665

Browse Source 
This patch applies the upstream v10.0.8 stable backport for
CVE-2026-0665. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2]. The individual
backported commit links are recorded in the embedded patch headers
when the fix expands to multiple commits.

[1] 4ba877461e
[2] https://access.redhat.com/security/cve/CVE-2026-0665

(From OE-Core rev: c66315d7276db8f65794cf514689301b027b13eb)

Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Ashishkumar Parmar
2026-06-12 05:18:16 -07:00
committed by Paul Barker
parent de00d925c6
commit 8f694f00c4
2 changed files with 39 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
meta/recipes-devtools/qemu/qemu.inc
View File

@@ -50,6 +50,7 @@ SRC_URI = "https://download.qemu.org/${BPN}-${PV}.tar.xz \
file://CVE-2024-6519.patch \
file://CVE-2025-14876_p1.patch \
file://CVE-2025-14876_p2.patch \
file://CVE-2026-0665.patch \
"
UPSTREAM_CHECK_REGEX = "qemu-(?P<pver>\d+(\.\d+)+)\.tar"

38
meta/recipes-devtools/qemu/qemu/CVE-2026-0665.patch Normal file
View File

@@ -0,0 +1,38 @@
From 91e98ce0a879010ef5b5ab5778cc71c0e9e92a57 Mon Sep 17 00:00:00 2001
From: Vulnerability Report <vr@darknavy.com>
Date: Fri, 9 Jan 2026 10:35:48 +0800
Subject: [PATCH] hw/i386/kvm: fix PIRQ bounds check in xen_physdev_map_pirq()
Reject pirq == s->nr_pirqs in xen_physdev_map_pirq().
CVE: CVE-2026-0665
Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/4ba877461e6b1a8637b15ff1a8c77ba97639c927]
Fixes: aa98ee38a5 ("hw/xen: Implement emulated PIRQ hypercall support")
Fixes: CVE-2026-0665
Reported-by: DARKNAVY (@DarkNavyOrg) <vr@darknavy.com>
Reviewed-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Vulnerability Report <vr@darknavy.com>
Link: https://lore.kernel.org/r/13FE03BE60EA78D6+20260109023548.4047-1-vr@darknavy.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit c7504ba2a560fd884557f6e5142f03b491aad0c7)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit 4ba877461e6b1a8637b15ff1a8c77ba97639c927)
Signed-off-by: Ashishkumar Parmar <asparmar@cisco.com>
---
hw/i386/kvm/xen_evtchn.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/i386/kvm/xen_evtchn.c b/hw/i386/kvm/xen_evtchn.c
index 02b8cbf8d..5a1ad3782 100644
--- a/hw/i386/kvm/xen_evtchn.c
+++ b/hw/i386/kvm/xen_evtchn.c
@@ -1843,7 +1843,7 @@ int xen_physdev_map_pirq(struct physdev_map_pirq *map)
return pirq;
}
map->pirq = pirq;
- } else if (pirq > s->nr_pirqs) {
+ } else if (pirq >= s->nr_pirqs) {
return -EINVAL;
} else {
/*