Your message dated Tue, 28 Jul 2026 22:49:15 +0000
with message-id <[email protected]>
and subject line Bug#1129037: fixed in xen 4.20.3+127-gc42374a105-1
has caused the Debian Bug report #1129037,
regarding Xen 4.20 uses an outdated spec of QMP, so passthrough USB is broken.
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1129037: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129037
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: libxenmisc
Version: 4.20.0+68-g35cb38b222-1
Severity: important
I'm tagging this important because I imagine that not everyone uses USB
on DomU instances. Since the upgrade to trixie, passthrough USB has
stopped working with Xen instances. This is critical for us, as one of the
DomU instances needs access to a USB HSM that previously worked in USB
passthrough mode in `bookworm` (Xen 4.17.5).
When tried to add a hub and a device to a DomU machine, whether it's
manually or in a config file battle-tested with 4.17.5, an error pops:
pa-xen:~# /usr/lib/xen-4.20/bin/xl usbdev-attach test_usb hostbus=2
hostaddr=2
libxl: error: libxl_qmp.c:1837:qmp_ev_parse_error_messages: Domain
7:Parameter 'hostaddr' expects uint64
libxl: error: libxl_device.c:1500:device_addrm_aocomplete: unable to add
device
libxl_device_usbdev_add failed.
I'm attaching a patch in a subsequent mail to fix this bug, valid
against 4.20-4.20.2. I haven't sent it upstream yet, but I'll defer to
you. A Xen instance with a patched libxenmisc1 has been running in
production since November 6th, 2025 without causing any problems. I'd like
to request an upload to stable-proposed-updates so I don't have to hold the
4.20.2 Xen packages carrying security updates.
I'll leave some details on how I found out and solved it in case
somebody hits this same problem:
After much debugging, what happens is that Xen appears to be using a
really old version of QMP (https://wiki.qemu.org/Documentation/QMP), the
JSON protocol that Xen uses to talk to the QEMU instance over a named
pipe. You can talk to the instance (in this case #10) with a command like
this:
socat - UNIX-CONNECT:/var/run/xen/qmp-libxl-10
The instance greets you with:
{"QMP": {"version": {"qemu": {"micro": 3, "minor": 0, "major": 10},
"package": "Debian 1:10.0.3+ds-0+deb13u1"}, "capabilities": ["oob"]}}
If you then try to execute a similar command to the one Xen sends with
libxl:
{"execute": "qmp_capabilities"
}{"execute":"device_add","id":2025,"arguments":{"id":"xenusb-5-2","driver":"usb-host","bus":"xenusb-0.0","port":"1","hostbus":"5","hostaddr":"2"}}
{"return": {}}
Then you get the error:
{"id": 2025, "error": {"class": "GenericError", "desc": "Parameter
'hostaddr' expects uint64"}}
Now that you can play back and forth with the message, you can actually
send the value of keys "hostaddr" and "hostbus" as a number, instead of a
string, and it starts working.
I narrowed it down for now to the creation of the USB controller and
USB individual devices. I imagine that QEMU was upgraded between bookworm
and trixie, and they deprecated receiving the affected values as
strings. ¯\_(ツ)_/¯
I still cannot understand how this was still not fixed on upstream's
git HEAD branch as of mid November, when I checked last! One would think
that USB passthrough was more popular... :-D
Thanks,
Ender.
--
Consultor de seguridad - Security consultant
Desarrollador de Debian - Debian developer
--- End Message ---
--- Begin Message ---
Source: xen
Source-Version: 4.20.3+127-gc42374a105-1
Done: Hans van Kranenburg <[email protected]>
We believe that the bug you reported is fixed in the latest version of
xen, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Hans van Kranenburg <[email protected]> (supplier of updated xen package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 28 Jul 2026 20:42:50 +0200
Source: xen
Architecture: source
Version: 4.20.3+127-gc42374a105-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Xen Team <[email protected]>
Changed-By: Hans van Kranenburg <[email protected]>
Closes: 1129037
Changes:
xen (4.20.3+127-gc42374a105-1) unstable; urgency=medium
.
* Update to new upstream version 4.20.3+127-gc42374a105, which also contains
security fixes for the following issues:
(Closes: #1129037)
- Use after free of paging structures in EPT
XSA-480 CVE-2026-23554
- Xenstored DoS by unprivileged domain
XSA-481 CVE-2026-23555
- oxenstored keeps quota related use counts across domain destruction
XSA-483 CVE-2026-23556
- Xenstored DoS via XS_RESET_WATCHES command
XSA-484 CVE-2026-23557
- grant table v2 race in status page mapping
XSA-486 CVE-2026-23558
- x86: Floating Point Divider State Sampling
XSA-488 CVE-2025-54505
- x86: CPU Opcode Cache corruption
XSA-490 CVE-2025-54518
- x86 HVM I/O port list traversal
XSA-491 CVE-2026-42487
- domctl lock open to abuse
XSA-492 CVE-2026-42489 CVE-2026-42490
- Arm: Completion of memory accesses not guaranteed by completion of a TLBI
XSA-493 CVE-2025-10263
- x86: mismatched mapcache metadata
XSA-494 CVE-2026-42488
- x86 shadow paging is deprecated
XSA-495 CVE-2026-42493
- buffer overruns in libfsimage iso9660 handling
XSA-497 CVE-2026-42494 CVE-2026-42495 CVE-2026-62423 CVE-2026-62424
CVE-2026-62425
- sysctl and platform-op locks open to abuse
XSA-499 CVE-2026-62426 CVE-2026-62427
- grant-table: type confusion in grant-copy
XSA-500 CVE-2026-62428
- grant-table: version change racing with other operations
XSA-501 CVE-2026-62435 CVE-2026-62436
- vNUMA domain cleanup may race other operations
XSA-502 CVE-2026-62429
- x86: Out-of-bounds read in vRTC emulation
XSA-503 CVE-2026-62430
- Viridian STIMER division by zero
XSA-504 CVE-2026-62431
- evtchn: Race between FIFO expand and reset
XSA-505 CVE-2026-62432
- correct buffer checks for DM_OP hypercalls
XSA-506 CVE-2026-62433
- PoD: Don't try to reclaim special pages
XSA-507 CVE-2026-62434
- pygrub: security-supported only when run de-privileged
XSA-508
* Drop the following patches which are now included upstream:
- ARM: Drop ThumbEE support
- xen/arm: Set ThumbEE as not present in PFR0
* Note that the following XSA are not listed, because...
- XSA-482 has patches for the Linux kernel
- XSA-485 has patches for the Linux kernel
- XSA-487 has patches for the Linux kernel
- XSA-489 applies to XAPI which is not included in Debian
- XSA-496 only applies to Xen 4.21 and later
- XSA-498 applies to XAPI which is not included in Debian
Checksums-Sha1:
7eb0d2019ed088ce46154441d0396c8c2037c977 4154 xen_4.20.3+127-gc42374a105-1.dsc
db72543f43aa34ac8976c1de1a5ac1746006dc43 4961352
xen_4.20.3+127-gc42374a105.orig.tar.xz
a5c96e34735baae759dbe47eb26f2c420986441e 139540
xen_4.20.3+127-gc42374a105-1.debian.tar.xz
Checksums-Sha256:
74299b01a9855f780d8e0b31d56a1bc27f776d73a1926456cac860f3adde48a2 4154
xen_4.20.3+127-gc42374a105-1.dsc
df0831854a55a8f31cb3cb85036f2edc928e2ef098d77f815f5714bfafac68f3 4961352
xen_4.20.3+127-gc42374a105.orig.tar.xz
96d44c57b99010618402d0762e3579a58e32c544e3afbe4edb254edb5b96f653 139540
xen_4.20.3+127-gc42374a105-1.debian.tar.xz
Files:
4b160e197677b6f97da856ca2758f017 4154 admin optional
xen_4.20.3+127-gc42374a105-1.dsc
9b708a84bd7cbcb4483cf794a3672991 4961352 admin optional
xen_4.20.3+127-gc42374a105.orig.tar.xz
b36c7b8aff830ffd648ffb3ee21172d7 139540 admin optional
xen_4.20.3+127-gc42374a105-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEESWyddwNaG9637koYssHfcmNhX2wFAmppK18ACgkQssHfcmNh
X2z+eA//Zx48n3To5xItLaNhrzG3V9wJ+s//wPCOFUHCUhdLVsFwQ8OQzszpTlUx
POmqQ33c+5gYSc0tOxCQNG1bGEROCnbdVLC2/HV0s3oAr/lR+MBv+kmqFir1jqo3
pqoGGBV11rZvAp8sXXjPlQMg0B1nSIDEBGKhXVqrgDIzQMeWcpvv5WZVhaqkRZxW
LsRVBj3MQe+Qfeo3hIjRoKXtE0LjPmLYDmhqDDVpn6LnYzxZ9jgeTmohk2eX2+Yy
uheY0S6CbliGIFdjVJJsR+Hx5hx9MNWXf7r7yrIQOrJ7k9mlACzC8+Ib6q02heyJ
9kunQ5hkUqEJz0FP2XmAxE9nxP8ygM0BYbZENlFHI3BzXRtQpqnMwH9mYYXKO4rW
l9iP96bU7TjyJiW4uW5dAZJRSF6h0lQLegH8G98HW9cJFlPcQ8Tru/XxsSwMs/Bh
hRCdRj5XL7Ol3olK07fuAaln/vtkgqhGtr+yw0hZzuFPa4u6K6etKS3dzDA9zk0U
u0ySShk0TOIsNbhmd1x/jH2UfSY3bhV5r1Q7ahoRPhQqcu5JYmK7BJgn6IjNZ7w9
38L+O2zRynSo5TevQzjR+Viskd5BlgtUguXU5aK+eFZ0u3XI6tJHed3Ka4od3pDQ
GX2AzFEOUz+Idc2mU2H0YxgLjT75xtWbM1FYL3Mny0NmMl6Y1f0=
=4J0B
-----END PGP SIGNATURE-----
pgpJJ13AcMaJA.pgp
Description: PGP signature
--- End Message ---
