cluster_size - 1 is often used in bitwise mask operations in qed.h, so this bug is probably a copy-paste error. qed_bytes_to_clusters() uses a division and the denominator should be the full cluster_size value. This bug can be used to leak heap memory to the guest with a QED file where cluster_size <= 32 KB (the default is 64 KB) and table_size = 8 or 16 (the default is 4). Fixes: CVE-2026-118594 Fixes: 298800cae72e ("qed: Table, L2 cache, and cluster functions") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4737 Reported-by: oxsignal <awo@kakao.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> --- block/qed.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/qed.h b/block/qed.h index 26d4bf038c7..04bcd7ac4fa 100644 --- a/block/qed.h +++ b/block/qed.h @@ -253,7 +253,7 @@ static inline uint64_t qed_offset_into_cluster(BDRVQEDState *s, uint64_t offset) static inline uint64_t qed_bytes_to_clusters(BDRVQEDState *s, uint64_t bytes) { return qed_start_of_cluster(s, bytes + (s->header.cluster_size - 1)) / - (s->header.cluster_size - 1); + s->header.cluster_size; } static inline unsigned int qed_l1_index(BDRVQEDState *s, uint64_t pos) -- 2.56.0