QEMU patches heap overflow in vhost-user-gpu backend

QEMU has fixed a heap buffer overflow in its vhost-user-gpu backend that a malicious guest could trigger by creating a 2D GPU resource with extreme width and height values.

CVE-2026-15264 stems from unchecked 32-bit arithmetic when sizing the host buffer: width times height times four could wrap, so the backend allocated far less memory than the guest expected. A later transfer command then wrote past the undersized heap buffer.

The built-in virtio-gpu device already guarded against this class of overflow. Marc-André Lureau of Red Hat applied the same approach to the out-of-process vhost-user-gpu contrib backend: reject dimensions whose byte size exceeds 32-bit limits, compute allocation sizes in 64-bit arithmetic, and honor failed buffer creation instead of ignoring it.

The flaw was reported by darknavy.com. Hosts that expose vhost-user-gpu to untrusted guests should take the fix.