-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 29 Aug 2026 20:55:40 +0300 Source: qemu Architecture: source Version: 1:10.0.13+ds-0+deb13u1 Distribution: trixie Urgency: medium Maintainer: Debian QEMU Team <[email protected]> Changed-By: Michael Tokarev <[email protected]> Changes: qemu (1:10.0.13+ds-0+deb13u1) trixie; urgency=medium . * new upstream stable/bugfix release, including multiple security fixes: - Update version for 10.0.13 release - target/riscv/tcg: sret in virtual user mode raises virtual instruction exception https://gitlab.com/qemu-project/qemu/-/work_items/3622 - target/riscv: enforce even register constraints for Zdinx fcvt pairs https://gitlab.com/qemu-project/qemu/-/work_items/4109 - target/riscv: reject FMV.X.W/FMV.W.X under Zfinx https://gitlab.com/qemu-project/qemu/-/work_items/4108 - target/riscv: honor zicbo* envcfg gating in linux-user mode https://gitlab.com/qemu-project/qemu/-/work_items/4107 - disas/riscv: Fix typo in th.lbib format - disas/riscv: Fix isa decoding of rev8 - disas/riscv: Fix rv32 encoding of zext.h - target/riscv: allow menvcfg/henvcfg LPE and SSE bits on RV32 https://gitlab.com/qemu-project/qemu/-/work_items/4045 - hw/riscv/riscv-iommu: preserve requested perm in spa_fetch() - hw/riscv/riscv-iommu: fix U-bit check to apply only to leaf S/VS-stage PTEs - disas/riscv: Decode unsigned vector immediates as unsigned - disas/riscv: Use signed type for vector immediates - disas/riscv: Fix 6-bit immediate extraction - disas/riscv: Fix th.srri decoding - target/riscv: use SXL instead of MXL for read_sstatus - target/riscv: Fix PC sync in trans_sspopchk for CFI exception handling https://gitlab.com/qemu-project/qemu/-/work_items/4118 - hw/watchdog: Add lower bound check for watchdogNumber https://gitlab.com/qemu-project/qemu/-/work_items/3600 - tcg: Export tcg_gen_ussub_i{32,64,tl} - tcg: Defer tb_flush when initial thread region alloc fails https://gitlab.com/qemu-project/qemu/-/work_items/2984 - tcg: Return success from tcg_region_alloc - tcg: Return success from tcg_region_alloc__locked - target/loongarch: check FPE before reading fcc in bceqz/bcnez https://gitlab.com/qemu-project/qemu/-/work_items/4209 - meson: make linker warnings non-fatal on Linux - serial: clear transmit retry callback on unrealize https://gitlab.com/qemu-project/qemu/-/work_items/4125 - target/i386: decode opcode extensions group 3 /1 as TEST https://gitlab.com/qemu-project/qemu/-/work_items/3580 - target/i386: allow transition to virtual-8086 mode only if CPL == 0 and CPU is not in long mode https://gitlab.com/qemu-project/qemu/-/work_items/3583 - target/i386: fix long mode segment override prefix decoding https://gitlab.com/qemu-project/qemu/-/work_items/3391 - target/i386: fix incorrect decoding of EXTRQ_i https://gitlab.com/qemu-project/qemu/-/work_items/3611 - target/i386: Clear OF, SF, and AF for fcomi/fucomi https://gitlab.com/qemu-project/qemu/-/work_items/4133 - target/i386: Use correct type for get_float_exception_flags() values - tcg/optimize: Fix s_mask computation for shifts - tcg/optimize: INDEX_op_mul is commutative - hw/elf_ops: defend against weird elf headers - hw/nvme: add SPDM_SOCKET Kconfig dependency - hw/block/pflash_cfi01: Restore ROMD mode after migration https://gitlab.com/qemu-project/qemu/-/work_items/4042 - hw/net/rtl8139: Send whole of vlan-tagged packet when doing loopback - hw/net/rtl8139: Fix handling of VLAN tags on incoming short packets https://gitlab.com/qemu-project/qemu/-/work_items/3518 - tests/qtest/ahci: regression test for ATAPI read vs. drain - hw/ide/atapi: read the whole elementary transfer asynchronously - tests/qtest/ahci: cover raw (2352-byte) ATAPI CD reads - tests/qtest/libqos/ahci: support raw (2352-byte) READ CD - tests/qtest/ide-test: cover raw (2352-byte) ATAPI CD reads - tests/qtest/ide-test: add a multi-sector ATAPI DMA read test - tests/qtest/ide-test: parametrize the ATAPI CD-ROM read test - hw/net/vmxnet3: Do not abort if guest provides bad interrupt numbers https://gitlab.com/qemu-project/qemu/-/work_items/539 - hw/usb/dev-uas: Don't abort if guest provided an undersized buffer for status https://gitlab.com/qemu-project/qemu/-/work_items/3900 - hw/intc/loongarch_pch_pic: Validate htmsi_vector before indexing parent_irq https://gitlab.com/qemu-project/qemu/-/work_items/4114 - migration/multifd: Replace assert() with error_setg() in recv paths - migration/multifd: Validate next_packet_size in zlib/zstd recv https://gitlab.com/qemu-project/qemu/-/work_items/3737 - tests/tcg/s390x: Test STCKF condition code on a faulting store - target/s390x/tcg: Set STCK/STCKF condition code after the store - pc-bios/s390-ccw.img: update s390x bios - pc-bios/s390-ccw: bound zipl menu strlen and replace VLA in zipl_print_entry - pc-bios/s390-ccw: bounds-check zipl menu entry index before array write - pc-bios/s390-ccw: fix out-of-bounds read in iso_get_file_size() - s390x/ipl: validate num_comp against iplb length before iterating - hw/char/sclpconsole-lm: avoid guest triggerable assert - tests/tcg/s390x: Test DR overflow (INT64_MIN / -1) - target/s390x: Fix DR/D INT64_MIN / -1 host crash - tests/tcg/s390x: Test PRNO TRNG interruptibility - target/s390x: Make PRNO TRNG interruptible - target/s390x: Have MSA helper pass a mmu_idx argument - hw/arm/aspeed: Add missing Kconfig dependencies on required components - linux-user: implement mount_setattr(2) - linux-user/sh4: Fix crashes on signal delivery in conditional delay slot - linux-user/sh4: Initialize the FPSCR register on signal - linux-user/sh4: Deliver SIGILL on invalid instruction - gitlab: disable provenance attestations to work around CI bug - hw/nvme: fix leak on copy ranges - hw/nvme: cancel inflight requests on controller reset https://gitlab.com/qemu-project/qemu/-/work_items/3398 https://gitlab.com/qemu-project/qemu/-/work_items/3883 https://gitlab.com/qemu-project/qemu/-/work_items/4068 https://gitlab.com/qemu-project/qemu/-/work_items/4072 - hw/nvme: factor out nvme_sq_cancel_inflight() - hw/nvme: drop AER requests without aiocb in nvme_del_sq() - hw/display/virtio-gpu: Unmap DMA regions on reset https://gitlab.com/qemu-project/qemu/-/work_items/3467 - hw/display/virtio-gpu: Always reject invalid scanout bounds - virtio-gpu: reject requests with short/truncated control headers Closes: CVE-2026-18054 - hw/display/virtio-gpu: fix offset wraparound in scanout_blob_to_fb - vhost-user-gpu: fix integer overflow in buffer allocation Closes: CVE-2026-15264 - hw/display/vga: fix panning_buf OOB after text/graphics switch https://gitlab.com/qemu-project/qemu/-/work_items/4085 Closes: CVE-2026-17516 - hw/display/virtio-gpu: validate blob iov size https://gitlab.com/qemu-project/qemu/-/work_items/3945 Closes: CVE-2026-66021 - coroutine: fix lost wakeup in qemu_co_sleep_wake() - iotests: run the test pool with the 'fork' start method - qcow2: do not try to clear the dirty bit on a read-only node - dmg: reject inconsistent UDRW chunk sector count and length https://gitlab.com/qemu-project/qemu/-/work_items/3846 Closes: CVE-2026-65928 - dmg: refuse to open files with no chunks https://gitlab.com/qemu-project/qemu/-/work_items/4021 - dmg: fix out-of-bounds load in search_chunk() https://gitlab.com/qemu-project/qemu/-/work_items/3844 Closes: CVE-2026-65929 - tests/unit: add reproducer for BlockAcctStats histogram locking race - block/qapi: take stats->lock when reading BlockAcctStats for query-blockstats - block/accounting: take stats->lock in latency histogram setters - block: Fix crash after setting latency historygram with single bin - block/cloop: fix integer overflow in total_sectors calculation - linux-user: fix incorrect msg_l[sr]pid members of target_msqid_ds - linux-user: Fix msqid_ds struct wrt 32-bit big endian architectures - hw/nvme: fix assertion failure on subregion removal - hw/nvme: fix unintentional integer overflow in shift - hw/nvme: fix cross-namespace copy dif buffer overflow - virtio-mmio: fix QUEUE_NUM_MAX https://gitlab.com/qemu-project/qemu/-/work_items/3882 Closes: CVE-2026-50626 - hw/display/exynos4210_fimd: Clamp windows to screen size https://gitlab.com/qemu-project/qemu/-/work_items/3795 - hw/display/exynos4210_fimd: Pass width to draw_line functions - hw/display/exynos4210_fimd: Factor out finding screen width/height - hw/i2c/bcm2835_i2c: Correct CLKT register offset - linux-user/sh4: allow full 32-bit address space - target/sparc: set reg window data structures currently after vmstate load - hw/net/igb: recalculate rx_desc_len on migration load - hw/net/e1000e: recalculate rx_desc_len on migration load - linux-user: fix guards for the fsmount(2) syscall series - hw/net/xilinx_axienet: Don't write checksums off end of packet - linux-user: Guard local FUTEX_CMD_MASK definition - virtio: avoid packed vring virtio_queue_empty() infinite loops https://gitlab.com/qemu-project/qemu/-/work_items/3968 Closes: CVE-2026-16457 - backends/rng: cap request size to avoid oversized allocation https://gitlab.com/qemu-project/qemu/-/work_items/3983 - hw/virtio-rng: Fix host use-after-free https://gitlab.com/qemu-project/qemu/-/work_items/3917 Closes: CVE-2026-50624 - hw/net/virtio-net: Protect from DMA re-entrancy bugs https://gitlab.com/qemu-project/qemu/-/work_items/4073 Closes: CVE-2026-66022 (again) - intel_iommu: Check address mask before using it in pasid-based iotlb invalidation https://gitlab.com/qemu-project/qemu/-/work_items/3619 - hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle - hw/virtio/vdpa-dev: pass set_config buffer to vhost backend - hw/pci-host/q35.c: Avoid early return in mch_write_config() - hw/pci-host/q35.c: Factor out creation of SMRAM MRs - hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled - virtio-iommu: fix OOM due to unbounded call_rcu - libvduse: validate vq size https://gitlab.com/qemu-project/qemu/-/work_items/3652 Closes: CVE-2026-61402 - libvhost-user: fix heap overflow in vu_check_queue_inflights https://gitlab.com/qemu-project/qemu/-/work_items/3974 Closes: CVE-2026-63110 - libvhost-user: validate last_batch_head in vu_check_queue_inflights https://gitlab.com/qemu-project/qemu/-/work_items/3974 - virtio-pmem: wait for flush requests on unrealize https://gitlab.com/qemu-project/qemu/-/work_items/3938 Closes: CVE-2026-63323 - vhost-user: assert nregions within limit https://gitlab.com/qemu-project/qemu/-/work_items/3910 - virtio: fail early on bad config_len in migration https://gitlab.com/qemu-project/qemu/-/work_items/3891 - virtio-scsi: fix SCSIRequest leak on a bad request https://gitlab.com/qemu-project/qemu/-/work_items/3875 Closes: CVE-2026-61476 - vhost: do not crash on ring map failure https://gitlab.com/qemu-project/qemu/-/work_items/3783 - hw/virtio: reject zero-length packed indirect descriptor table https://gitlab.com/qemu-project/qemu/-/work_items/3984 - libvhost-user: protect against OOB vring queue access https://gitlab.com/qemu-project/qemu/-/work_items/3741 - libvhost-user: protect against OOB writes in vu_set_inflight_fd https://gitlab.com/qemu-project/qemu/-/work_items/3740 - virtio-net: fix short frame OOB read in receive_filter() https://gitlab.com/qemu-project/qemu/-/work_items/3626 Closes: CVE-2026-63320 - virtio-net: fix OOB read in RSC receive path https://gitlab.com/qemu-project/qemu/-/work_items/3623 Closes: CVE-2026-63321 - hw/display/virtio-gpu: Block Rutabaga migration - rutabaga: improve error handling, fix potential crash during init - hw/display/virtio-gpu: Initialize blob mapping for ATTACH_BACKING - hw/display/virtio-gpu: Fix empty blob discrimination - virtio-gpu: fix NULL deref in rutabaga set_scanout https://gitlab.com/qemu-project/qemu/-/work_items/3897 - target/i386/sev: fix MemoryRegion reference leaks in gpa2hva callers - net/colo: fix g_hash_table_destroy assertion on uninitialized filter - hw/display/qxl: unregister vm_change_state handler and BHs https://gitlab.com/qemu-project/qemu/-/work_items/3607 Closes: CVE-2026-63322 - ui/vnc: remove redundant rows computation - hw/display/vhost-user-gpu: validate message payload sizes https://gitlab.com/qemu-project/qemu/-/work_items/3866 - hw/display/virtio-gpu: Remove the bytes_pp field - hw/display/virtio-gpu: reject strides exceeding INT_MAX - hw/display/virtio-gpu: validate stride against width on scanout https://gitlab.com/qemu-project/qemu/-/work_items/3989 Closes: CVE-2026-63109 - hw/usb/hcd-xhci: Check return value of xhci_xfer_create_sgl() for errors https://gitlab.com/qemu-project/qemu/-/work_items/3786 - hw/usb/core: Avoid possible assert() in do_parameter() --> usb_packet_copy() https://gitlab.com/qemu-project/qemu/-/work_items/3746 - hw/ide/core: Fix possible crash via NULL pointer in ide_cancel_dma_sync() https://gitlab.com/qemu-project/qemu/-/work_items/905 https://gitlab.com/qemu-project/qemu/-/work_items/4052 - hw/usb/dev-uas: Fix guest-triggerable heap OOB access https://gitlab.com/qemu-project/qemu/-/work_items/3612 https://gitlab.com/qemu-project/qemu/-/work_items/3986 - hw/9pfs/xen: drain in-flight PDUs before xen-9p disconnect - hw/9pfs/virtio: drain in-flight PDUs before virtio-9p unrealize https://gitlab.com/qemu-project/qemu/-/work_items/3937 - hw/9pfs: fix O_TRUNC bypass on read-only export https://gitlab.com/qemu-project/qemu/-/work_items/4000 Closes: CVE-2026-63318 - hw/display/vmware_vga: Don't allow guest to trigger long running loop in host https://gitlab.com/qemu-project/qemu/-/work_items/3782 https://gitlab.com/qemu-project/qemu/-/work_items/4026 https://gitlab.com/qemu-project/qemu/-/work_items/4076 - hw/ide: replace assert with proper error handling https://gitlab.com/qemu-project/qemu/-/work_items/2777 - scsi-disk: fix off by one in assertion - scsi-disk: protect against guest sending truncated data for MODE SELECT commands https://gitlab.com/qemu-project/qemu/-/work_items/4051 - target/i386: helper_sysret(): Check that RCX contains a canonical address when emulating an Intel CPU https://gitlab.com/qemu-project/qemu/-/work_items/3223 - vfio/pci: reject invalid PCI_INTERRUPT_PIN values - vfio/pci: don't narrow a failed config read to a plausible value - vfio/igd: Clear saved BDSM in legacy VBIOS ROM at load time https://gitlab.com/qemu-project/qemu/-/work_items/3093 - vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom() - hw/uefi: make SetupMode read-only https://gitlab.com/qemu-project/qemu/-/work_items/4039 Closes: CVE-2026-16288 - hw/uefi: add post_load checks https://gitlab.com/qemu-project/qemu/-/work_items/3837 https://gitlab.com/qemu-project/qemu/-/work_items/3838 https://gitlab.com/qemu-project/qemu/-/work_items/3839 https://gitlab.com/qemu-project/qemu/-/work_items/3885 Closes: CVE-2026-61404 - hw/uefi: account variable policy entries against storage size https://gitlab.com/qemu-project/qemu/-/work_items/3890 Closes: CVE-2026-61405 - hw/uefi: check lower limit for signature list size https://gitlab.com/qemu-project/qemu/-/work_items/3899 Closes: CVE-2026-61406 - hw/uefi: remove debug function https://gitlab.com/qemu-project/qemu/-/work_items/3615 Closes: CVE-2026-58582 - hw/uefi: add sanity check https://gitlab.com/qemu-project/qemu/-/work_items/3614 Closes: CVE-2026-58581 Checksums-Sha1: ee492e23d8ae66376de7a301c7cb535df8228811 12462 qemu_10.0.13+ds-0+deb13u1.dsc 7617726069d7b00c2b7bd10aea8077b005913e5f 40010016 qemu_10.0.13+ds.orig.tar.xz 8fd7672ce97e1b93405e6cb71e183158f87b6ff3 156096 qemu_10.0.13+ds-0+deb13u1.debian.tar.xz 0e7633b9655508c772d0c896e010bfafbf24b189 7838 qemu_10.0.13+ds-0+deb13u1_source.buildinfo Checksums-Sha256: a426c892e5369058c3423816c8625bc8010bb5a58ece57261f62b64ee4d765ad 12462 qemu_10.0.13+ds-0+deb13u1.dsc 6a0888e806c2ffc0c5f0733e974f9aea55491950d3c47c98669c8b236dde59ae 40010016 qemu_10.0.13+ds.orig.tar.xz da73c092f5684c551b0334d675eb16a3dec91e1edea94759cfb1102fa4a0364e 156096 qemu_10.0.13+ds-0+deb13u1.debian.tar.xz 16b8e3add06ee8a50e51146f2d85acdab170a5e47dd3d1edd26da9b8461cc1e6 7838 qemu_10.0.13+ds-0+deb13u1_source.buildinfo Files: ef31bdc115b30b4c6bfe8b794341ffb5 12462 otherosfs optional qemu_10.0.13+ds-0+deb13u1.dsc e9f804eae55071cd8ea1ae009f0fa1fd 40010016 otherosfs optional qemu_10.0.13+ds.orig.tar.xz 70708450eb8ee4642f13edfd4738c517 156096 otherosfs optional qemu_10.0.13+ds-0+deb13u1.debian.tar.xz 93aa0b029ef9e648ab8f9abc077182ed 7838 otherosfs optional qemu_10.0.13+ds-0+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEZKoqtTHVaQM2a/75gqpKJDselHgFAmqbEZwACgkQgqpKJDse lHipSw//bad4I+55ne+60AdmzpNoVcIzTgLhZhBDKo+H98+WCwl5hEsbdS9S0DNe hRnH0Xz6kP6PkIoXupYQVtV9vj+0Z6e9uyBvBpI9x0vjxNxxbVcccwGhjivelwZC HTIUFrDZrvYaTrLbFZf6L+r8ZNGk5YogReZT+S8pDArkjjo4cM+4CpPTzvCErLVw JOSCtIs0lzEF7FOF3awJWD7OmaI3LjjHzBQW0+UM0cmUkQ9l2EPxtZguMc8Ke5mt hhnouz9T2e+uK3OCCNsiDbNepbmK0Fc+KNGewtH8tc0JFgaFa/+ZeoOCsanAqqPI W7We7VUWqZZ2FcytDoL4QK7wVHVf5Q9O+OJBTngDejbRPLtl40zJl9KYmCV06e7V omgdQuJ5qArKrHGforuNwdaguPonemtmqTyOwVIoPAHdXJGS61H8snEr31CXBIPI br7nbSyLhxIMfmOUw7xrhNsYRlwyAz3IDm76AOsvvyVQr52BRqDnKgKQ9uGh1ASf NIgGmPo3J3N+/OysEaMsN5rBmAJTHx23lSpc4c9iYd85z/xyPoRybjLQnjLq8TQ8 57E1B8UYoOZufnsi0d48ahL2RDaqw1RGyk3c816WdiK45YcS0kGv24CIoIvQNGLg ASljdxAgQpYriQQpXAqWnihLLiXzc4lQP6BIJQG8EdClL7qj7hU= =ogdH -----END PGP SIGNATURE-----
pgpBxVXSy8s7x.pgp
Description: PGP signature
