Hello,
On 19/09/2026 09:51, Hans van Kranenburg wrote:
On 9/19/26 12:09 AM, Sylvain Beucler wrote:
I assume this targets
CVE-2026-62437,CVE-2026-79602,CVE-2026-79603,CVE-2026-79604
https://security-tracker.debian.org/tracker/source-package/xen
In which case we'd request that they be fixed first in unstable, then
proposed to trixie, and last pushed to bookworm-lts.
Ah, yes, ok, Fair enough. I was not planning to go full circle with new
updates right now.
By the way, for Xen we work from upstream stable branch lines, not from
random patches. And, this one is now on 4.17, and trixie + unstable are
both on 4.20. So, purely technically version wise it would not matter to
do them out of order.
Or, if the above means too much delay, you could publish the current
bookworm version as-is and propose another update when everything else
is ready, as you wish :)
Let's then first of all just work with what we already prepared earlier
yes. I mean, I know this effect where I think... "oh but now it's a bit
later and can't we also..." but that can pretty quickly end up in only
more delays. :D
Do you have a draft for the DLA e-mail?
I do not. I think team security mostly just uses the short thing that is
not very specific, like in:
https://lists.debian.org/debian-security-announce/2026/msg00335.html
I downloaded your .dsc from
https://oz.knorrie.org/tmp/xen/xen_4.17.7-0%2Bdeb12u1_source/, checked
that it matched
https://salsa.debian.org/xen-team/debian-xen/-/tree/bookworm-security ,
checked debian/changelog and uploaded it to debusine for staging:
https://debusine.debian.net/debian/developers/work-request/1410281/
I didn't perform additional tests.
If you give me the OK I can upload and send the DLA.
Cheers!
Sylvain Beucler
Debian LTS Team
