QEMU virtio-net DMA re-entrancy guard bypass fixed
An incomplete follow-up to CVE-2024-3446 left the network device open to the same class of attack under a new CVE.
QEMU has closed a hole in virtio-net’s DMA re-entrancy protection that let the earlier CVE-2024-3446 fix be bypassed. The flaw is tracked as CVE-2026-66022.
The original change guarded bottom-half handlers against re-entrant DMA, but virtio-net still attached its transmit handler with a device-only guard instead of the shared virtio bus guard. That mismatch meant the protection could be skipped, reopening the path the prior CVE was meant to shut.
Laurent Vivier supplied the one-line correction so the network device and its bus use the same guard. The fix is marked for stable backports. Guests using virtio-net on affected QEMU builds were exposed until the update is applied.