A flaw was found in the virtio-crypto device of QEMU. The symmetric path enforces a length limit using conf.max_size, but the AKCIPHER path does not impose any bound. This could allow a malicious guest to trigger a memory exhaustion condition, potentially resulting in a denial of service (DoS) by aborting the QEMU process on the host. Upstream patch: https://lore.kernel.org/qemu-devel/20251221024321.143196-1-zhenwei.pi@linux.dev/
Upstream patch & fix commit: - https://lore.kernel.org/qemu-devel/20251221024321.143196-3-zhenwei.pi@linux.dev/T/ - https://gitlab.com/qemu-project/qemu/-/commit/91c6438caffc880e999a7312825479685d659b44