QEMU virtio-gpu fix stops short headers leaking fence data

QEMU will reject virtio-gpu control requests whose headers are shorter than the expected common header, closing CVE-2026-18054.

A truncated control header could leave the command structure only partly filled. If the bytes that did arrive set the fence flag, leftover fence metadata from earlier state could later be sent back to the guest. The same pattern affected the vhost-user-gpu backend, which warned about a short header but still processed the partially initialized command.

Ankur Saini reported the flaw and submitted a fix that checks the common header length before dispatch on both paths, clears the header on failure, and completes the request with an invalid-parameter error so stale fields never reach a response. Marc-André Lureau reviewed the change. Akihiko Odaki suggested the approach.

The issue matters for any guest using virtio-gpu display, including setups that outsource GPU handling through vhost-user. Without the length check, a crafted short request could expose host-side fence state that should never cross back into the guest.