QEMU virtio-gpu fix stops cursor update from freed blob memory

QEMU has fixed a use-after-free in its virtio-gpu display backend that could let a guest trigger a copy from already-freed host memory when updating the cursor.

The flaw, tracked as CVE-2026-66020, sat in blob resource handling. After RESOURCE_DETACH_BACKING, the code tore down the udmabuf or guest-memory mapping but left the resource’s blob pointer set while its size field stayed non-zero. Cursor update only checked the size, so UPDATE_CURSOR on a detached blob resource caused QEMU to memcpy from freed memory.

Marc-André Lureau’s patch nulls the blob pointer when backing is cleaned up and refuses the cursor path when the pointer is missing or the blob is too small, logging both as guest errors. The issue was reported by researchers at aipyaipy.com and [email protected].

Hosts that expose virtio-gpu with blob resources to untrusted guests should take the fix.