QEMU queues 9pfs and virtio-gpu security fixes

QEMU developers have moved a batch of security fixes that close a guest bypass of read-only 9p exports, harden 9p backend teardown against use-after-free, and block an out-of-bounds read in virtio-gpu blob handling.

Leading the 9pfs queue is CVE-2026-63318. A guest using the 9p2000.u protocol could open a file with truncate intent on a host read-only export and still empty the file on the host. The server was testing the protocol mode field, which does not use Linux open-flag encoding, so the read-only check missed O_TRUNC and related write flags. Christian Schoenebeck’s fix checks the already-converted Linux flags instead. Only 9p2000.u was affected; 9p2000.L was not.

The same pull also stops guest-triggered use-after-free on Treaddir and ACPI eject paths by draining in-flight PDUs before virtio-9p and xen-9p disconnect. Jia Jia supplied the virtio-side change; Schoenebeck handled the xen backend. Small test fixes for host-specific slow cases and a Coverity finding ride along.

Separately, Marc-André Lureau posted a virtio-gpu fix for CVE-2026-66021. A malicious guest could set blob_size larger than the iov backing, then create a scanout surface over the undersized buffer so display refresh read past the real allocation. That could crash QEMU or leak host memory depending on backing. The patch validates that iov backing is at least as large as the declared blob size on create (when backing is present), attach, and blob migration load. The issue was reported by sundayjiang of Tencent.

Taken together, the changes tighten isolation for shared filesystem exports and GPU resources without changing ordinary guest behavior.