The following changes since commit f7ada39edacaa5c26b30e98b94017b0b2ccbcf94:
Merge tag 's390x-20260930' of https://gitlab.com/efarman/qemu into staging (2026-09-30 16:44:59 +0100)
are available in the Git repository at:
https://gitlab.com/marcandre.lureau/qemu.git tags/smartcard-fixes-pr-v1
for you to fetch changes up to 32556054616c89bfdf45573af0be381b271885ff:
hw/usb/ccid-card-emulated: free libcacard context (2026-10-01 17:29:31 +0400)
----------------------------------------------------------------
smartcard fixes
- CVE-2026-18609: guest-triggered assert via short interrupt transfer
- CVE-2026-18204: OOB read from the pending bulk-in ring buffer
- CVE-2026-18410: assert crash when pending answers ring overflows
- various bug fixes, spec compliance and refactoring
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
----------------------------------------------------------------
Marc-André Lureau (27):
hw/usb/dev-smartcard-reader: validate interrupt transfer length
hw/usb/dev-smartcard-reader: fix OOB read from pending bulk-in ring
hw/usb/dev-smartcard-reader: fix assert on pending answers overflow
hw/usb/dev-smartcard-reader: decode bulk-out length as little-endian
hw/usb/dev-smartcard-reader: fix dwMaxCCIDMessageLength descriptor
hw/usb/dev-smartcard-reader: fix OOB read in atr_get_protocol_num()
hw/usb/dev-smartcard-reader: block migration with pending queues
hw/usb/dev-smartcard-reader: drop needless state fields
hw/usb/dev-smartcard-reader: validate migrated fields in post_load
hw/usb/dev-smartcard-reader: reset all I/O state on device reset
hw/usb/dev-smartcard-reader: apply backpressure to bulk-out
hw/usb/dev-smartcard-reader: fix RDR_to_PC_Parameters dwLength
hw/usb/dev-smartcard-reader: reject oversized responses safely
hw/usb/dev-smartcard-reader: release short bulk-in responses with xHCI
hw/usb/dev-smartcard-reader: drop current_bulk_in pointer
hw/usb/dev-smartcard-reader: derive queue counts from start/end indices
hw/usb/dev-smartcard-reader: fix pending queue migration
hw/usb/dev-smartcard-reader: handle Secure, Escape and SetDataRate commands
hw/usb/dev-smartcard-reader: reject commands for invalid slots
hw/usb/dev-smartcard-reader: zero bChainParameter in DataBlock responses
hw/usb/dev-smartcard-reader: report error on XfrBlock with no card
hw/usb/dev-smartcard-reader: stop advertising PIN support
hw/usb/dev-smartcard-reader: validate per-command dwLength
hw/usb/dev-smartcard-reader: use usb_packet_size() accessor
hw/usb/dev-smartcard-reader: advertise T=1 protocol support
hw/usb/dev-smartcard-reader: correct CCID_IccPowerOff
hw/usb/ccid-card-emulated: free libcacard context
hw/core/machine.c | 4 +
hw/usb/ccid-card-emulated.c | 2 +
hw/usb/dev-smartcard-reader.c | 523 ++++++++++++++++++++++++++++++++++--------
3 files changed, 428 insertions(+), 101 deletions(-)