QEMU virtio-gpu fix stops stale fence data leak to guests

QEMU has a fix for CVE-2026-18054 in its virtio-gpu device: a guest could send a control request shorter than the common header and still trigger a response that carried stale fence metadata back into the guest.

The bug was that a truncated header left the in-memory command structure only partly filled. If the bytes that did arrive set the fence flag, later response handling could treat leftover fence fields as live and return them to the guest. That is a host-to-guest information leak in the virtual GPU path used by many virtualized desktops and passthrough setups.

Ankur Saini reported the issue and posted the patch. The change checks that the control header is fully present before dispatch, zeroes the header on failure, and completes the request with an invalid-parameter error so partial state never reaches a response. Marc-André Lureau reviewed the fix.