From: Marc-André Lureau <marcandre.lureau@redhat.com>

virtio_gpu_cleanup_mapping() tears down the udmabuf mapping (or, for the
small-iov case, the guest memory mapping) via virtio_gpu_fini_udmabuf(),
but leaves res->blob pointing at it afterwards. Once a blob resource
goes through RESOURCE_DETACH_BACKING, res->blob is left dangling while
res->blob_size is still non-zero.

virtio_gpu_update_cursor_data() only checks res->blob_size before
copying from res->blob, so UPDATE_CURSOR on a detached blob resource
makes QEMU memcpy from freed memory.

Clear res->blob once its backing is torn down, and check it before
dereferencing in virtio_gpu_update_cursor_data(), logging both invalid
conditions.

Fixes: CVE-2026-66020
Fixes: bdd53f739273 ("virtio-gpu: Update cursor data using blob")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3881
Reported-by: 章鱼哥@aipy (www.aipyaipy.com) and swing (swing@mail.exp.sh)
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 hw/display/virtio-gpu.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index cc6dbd116618..36d2bd9edee6 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -57,8 +57,16 @@ void virtio_gpu_update_cursor_data(VirtIOGPU *g,
     }
 
     if (res->blob_size) {
+        if (!res->blob) {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: resource %d has no blob\n",
+                          __func__, resource_id);
+            return;
+        }
         if (res->blob_size < (s->current_cursor->width *
                               s->current_cursor->height * 4)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: blob size too small for resource %d\n",
+                          __func__, resource_id);
             return;
         }
         data = res->blob;
@@ -968,6 +976,7 @@ void virtio_gpu_cleanup_mapping(VirtIOGPU *g,
 
     if (res->blob) {
         virtio_gpu_fini_udmabuf(g, res);
+        res->blob = NULL;
     }
 }
 
-- 
2.55.0

On 2026/07/24 12:59, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> virtio_gpu_cleanup_mapping() tears down the udmabuf mapping (or, for the
> small-iov case, the guest memory mapping) via virtio_gpu_fini_udmabuf(),
> but leaves res->blob pointing at it afterwards. Once a blob resource
> goes through RESOURCE_DETACH_BACKING, res->blob is left dangling while
> res->blob_size is still non-zero.
> 
> virtio_gpu_update_cursor_data() only checks res->blob_size before
> copying from res->blob, so UPDATE_CURSOR on a detached blob resource
> makes QEMU memcpy from freed memory.
> 
> Clear res->blob once its backing is torn down, and check it before
> dereferencing in virtio_gpu_update_cursor_data(), logging both invalid
> conditions.

virtio_gpu_do_set_scanout() also creates scanout->ds over
res->blob + fb->offset. RESOURCE_DETACH_BACKING leaves that surface
installed, so a subsequent display refresh can still read the backing
after virtio_gpu_fini_udmabuf() has unmapped it. Clearing res->blob
alone therefore does not remove every dangling reference.

> 
> Fixes: CVE-2026-66020
> Fixes: bdd53f739273 ("virtio-gpu: Update cursor data using blob")
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3881
> Reported-by: 章鱼哥@aipy (www.aipyaipy.com) and swing (swing@mail.exp.sh)

This format deviates from the usual email address notation and confuses 
b4. More conventionally, it should be:

Reported-by: 章鱼哥@aipy (www.aipyaipy.com)
Reported-by: swing <swing@mail.exp.sh>

Regards,
Akihiko Odaki

> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>   hw/display/virtio-gpu.c | 9 +++++++++
>   1 file changed, 9 insertions(+)
> 
> diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
> index cc6dbd116618..36d2bd9edee6 100644
> --- a/hw/display/virtio-gpu.c
> +++ b/hw/display/virtio-gpu.c
> @@ -57,8 +57,16 @@ void virtio_gpu_update_cursor_data(VirtIOGPU *g,
>       }
>   
>       if (res->blob_size) {
> +        if (!res->blob) {
> +            qemu_log_mask(LOG_GUEST_ERROR, "%s: resource %d has no blob\n",
> +                          __func__, resource_id);
> +            return;
> +        }
>           if (res->blob_size < (s->current_cursor->width *
>                                 s->current_cursor->height * 4)) {
> +            qemu_log_mask(LOG_GUEST_ERROR,
> +                          "%s: blob size too small for resource %d\n",
> +                          __func__, resource_id);
>               return;
>           }
>           data = res->blob;
> @@ -968,6 +976,7 @@ void virtio_gpu_cleanup_mapping(VirtIOGPU *g,
>   
>       if (res->blob) {
>           virtio_gpu_fini_udmabuf(g, res);
> +        res->blob = NULL;
>       }
>   }
>