A guest can crash QEMU by sending a bad console message
Brief
TCG-only host crashes rode along. This one is the emulator itself.
Notes
8402bdd56e37d0d2da1a2013b7ad74832256be50 is the 2026-08-12 s390x merge (Eric Farman). Cover note: first s390x updates for 11.2, including “hardening fixes in boot/sclp code.” Public patch text: a bad guest message length makes an assert in the console message handler “kills the guest instead of reporting an error.” qemu-s390x patch.
Same series has TCG-only host crashes and guest-firmware bounds checks. Those are not the QEMU host boundary. No CVE on the merge. Not in 11.1.0. Unknown whether the assert hits default s390-ccw-virtio without line-mode console.
Commit 8402bdd56e37d0d2da1a2013b7ad74832256be50 (merge tag s390x-20260812)