A guest can abort QEMU through USB storage or a VMware NIC
Brief
This is a crash, not a guest-to-host escape.
Notes
cd435997057ee33fe0dff986faccd3a0abd6b8de Merge tag pull-request-2026-08-14 (Richard Henderson, 2026-08-14). Cover: guest-triggerable abort in usb uas and vmxnet3; undefined behavior in amd_iommu. Tests in the same pull are not a story.
15700a66ecb53c52717c913c2c4501372c0115ab (Thomas Huth). Clamp and log when the guest’s status buffer is too small. Resolves #3900. Reported-by Feifan Qian.
46099d99005588b25eb07957cd9cdd688c4fc476 (Thomas Huth). Refuse to activate the device on a bad interrupt index instead of aborting. Resolves #539. Device is opt-in, not default on pc/q35.
4adfb431c0c3abd84909d1228b4954bfd68a1dbc (Thomas Huth). Host undefined behavior when encoding an event. Resolves #3633. Not a guest-to-host isolation break on the public message.
No CVE in the commit messages. Not in 11.1.0. Unknown: stable uptake; whether a CVE will be assigned.
Commit cd435997057ee33fe0dff986faccd3a0abd6b8de