The following patches are queued for QEMU stable v10.2.4: https://gitlab.com/qemu-project/qemu/-/commits/staging-10.2
Patch freeze is 2026-06-23 (frozen), and the release is planned for 2026-06-25: https://wiki.qemu.org/Planning/10.2 This is expected to be the last stable release in 10.2.x series, 11.0 takes the lead now. Please respond here or CC [email protected] on any additional patches you think should (or shouldn't) be included in the release. The changes which are staging for inclusion, with the original commit hash from master branch, are given below the bottom line. Thanks! /mjt -------------------------------------- 01* f0433a8bc4ac Frank Chang: target/riscv: Update MISA.C for Zc* extensions 02* 613bb1949fff Frank Chang: target/riscv: Update MISA.X for non-standard extensions 03* fcbd93e96be2 Andrew Jones: hw/riscv/riscv-iommu: Fix Svnapot 64KB pages 04* 249483623242 Zishun Yi: target/riscv: Allow mseccfg access based on ext_zicfilp 05* caf3bef5f01e Anton Blanchard: target/riscv: rvv: Handle source overlap of vector widening reduction instructions 06* e6051fa61b9f Frank Chang: hw/char: sifive_uart: Implement txctrl.txen and rxctrl.rxen 07* e07077a76607 Frank Chang: hw/char: Check interrupt after txctrl register is written 08* a0946caf1d9e Abhigyan Kumar: target/riscv: Fix medeleg[11] read-only zero bit for M-mode ECALL 09* 612f22c19db8 Zishun Yi: target/riscv/pmp: Fix integer overflow in TOR and NA4 address computation 10* eccb1d694025 Zishun Yi: target/riscv: Add mseccfg to VMStateDescription 11* 27f9566dcd98 Alistair Francis: target/riscv: Update the local interrupt mask 12* 8158a74f0a0d Zishun Yi: target/riscv: clear mseccfg on reset for all dependent extensions 13* 53cc9747ed7c Daniel Henrique Barboza: target/riscv/csr.c: fix read of pmpaddr(0-63) CSRs 14* dd3a906d3505 Matt Turner: linux-user/mips64: fix elf_core_copy_regs register layout in core files 15* 6033df08e93d Matt Turner: linux-user/mips64: fix mipsn32 elf_core_copy_regs entry width 16* ae18df638fb4 Daniel P. Berrangé: ui/vnc: fix OOB read access in VNC SASL mechname array 17* c3c6226fa481 Daniel P. Berrangé: ui/vnc: fix OOB write in VNC stats array 18* 46ee49034d26 Daniel P. Berrangé: ui/vnc: fix OOB write in lossy rect worker code 19* d0c7b82d3a89 Daniel P. Berrangé: ui/vnc: fix OOB read updating VNC update frequency stats 20* e56b4bbff1df Heechan Kang: ui: fix validation of VNC extended clipboard data length 21* 5297a0fc6531 Paolo Bonzini: lsi53c895a: fix use-after-free of cancelled request 22* 4494dec8c2bf Paolo Bonzini: lsi53c895a: clear tag byte when processing messages 23* 153dc2fa7bbe Paolo Bonzini: apic: fix delivery bitmask with modified xAPIC ids 24* 4b6c088c88cc Jinjie Ruan: mc146818rtc: Fix get_guest_rtc_ns() overflow bug 25* 6864bec553b2 Denis V. Lunev: block/linux-aio: bound ioq_submit() recursion depth 26* 446050c4dfe4 Peter Maydell: target/arm: SVE2 FMAXP, FMINP must honour AH=1 27* aa42300f86d1 Peter Maydell: target/arm: Use FPST_A64_F16 for SVE FCVTLT_hs 28* 23ece2805f9a Peter Maydell: target/arm: Set correct fp flags for FLOGB when FPCR.AH = 1 29* e6c47bebdf86 Chenyi Qiang: vfio/container: Restrict dma_map_file() to shared RAM or RAM devices 30* f12e7ba6f438 Richard Henderson: target/arm: Enable REVD for SVE2.1 31* bb957530471c Peter Maydell: target/arm: Don't assert if 64-bit EL2 AT insn sees a Domain fault 32* ca33de98447c Peter Maydell: target/arm: SME BFCVT, BFCVTN have "Alternate BFloat16 behaviors" 33* 8526b7d6b67b Peter Maydell: hw/net/rocker_of_dpa: Check group ID pointers are not NULL 34* 71d027cfee85 Peter Maydell: hw/net/rocker_of_dpa: Avoid unaligned accesses in _of_dpa_flow_match() 35* 3f50dd46664b Matt Turner: linux-user/ppc: restore fp_status from FPSCR on sigreturn 36* 84b920ccb5ee Matt Turner: linux-user/mips: save/restore FCSR across signal delivery 37* 6bf4c0295ccc Matt Turner: linux-user/sh4: preserve T/M/Q bits across signal delivery 38* a740f17ed0fb Matt Turner: linux-user/sh4: restore FP rounding mode on sigreturn 39* 2762cd51ee03 Matt Turner: linux-user/s390x: restore fpu_status rounding mode from FPC on sigreturn 40* abb0cc02fb56 Christian Schoenebeck: hw/9pfs: add NULL check in v9fs_path_is_ancestor() 41* dbaf84e148b0 Christian Schoenebeck: hw/9pfs: change V9fsPath.size to size_t and v9fs_path_sprintf() return type 42* 54dd352c5926 Christian Schoenebeck: hw/9pfs: add error handling to v9fs_fix_path() 43* 3802c0e755a5 Christian Schoenebeck: hw/9pfs: let callers of v9fs_path_sprintf() and v9fs_fix_path() handle errors 44* be33c56898f8 Christian Schoenebeck: tests/qtest/libqos: add qvirtqueue_reset_pool() for descriptor pool reset 45* 198627807a6b Christian Schoenebeck: tests/9pfs: add deep absolute path test 46* 5a8da7e979f1 sin99xx: 9pfs: fix missing rename lock in v9fs_co_readdir_many (CVE-2026-48004) 47* c131ae56c13f Denis V. Lunev: util/envlist: fix prefix-match in envlist_unsetenv() name lookup 48* 05221c600a5f Denis V. Lunev: tests/unit: add test-envlist covering setenv/unsetenv name matching 49* 1f1ccb6f3c48 Alexandra Winter: target/s390x: Make container ids in SysIB_15x 1-based 50* 442f727b8beb Farhan Ali: s390x/pci: Fix interrupt forwarding disable for interpreted devices 51* b4e28c304bc5 Fiona Ebner: block/io: fallback to bounce buffer if BLKZEROOUT is not supported because of alignment 52* aeea0c2804c4 Stefan Hajnoczi: virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (CVE-2026-48914) 53* 7f8466e2ce62 Kevin Wolf: qemu-io: Add 'aio_discard' command 54* b8bfb1478d61 Kevin Wolf: qcow2: Fix corruption on discard during write with COW 55* 389f5bcc744d Kevin Wolf: iotests/046: Test that discard/write_zeroes wait for dependencies 56* 1d47eb689835 Thomas Lamprecht: qcow2: Fix data loss on zero write with detect-zeroes=unmap 57* 7e573b660fef Fabiano Rosas: qed: Don't try to flush during incoming migration 58* 163f9a4e0651 Munkhbaatar Enkhbaatar: hw/usb/hcd-ohci: Clean up USBPacket before freeing ISO TD packet 59* a6a1f92d5a23 Richard Henderson: fpu: Handle all rounding modes in partsN_uncanon_normal 60* 767c32fe6983 Xinhui Yang: linux-user: implement fsmount(2) series of syscalls 61* 6e0aa9f6c731 Xinhui Yang: linux-user/strace: add fsmount series of syscalls 62 ae84c738e403 Thomas Huth: system/rtc: Fix a possible year-2038 integer overflow problem 63 fb4c08147ba7 Dominique Martinet: linux-user: add preadv2/preadv2 64 3097d54016ea Paolo Bonzini: amd_iommu: restrict command buffer head/tail ranges to ring size 65 3c98e446af82 Alejandro Jimenez: amd_iommu: Update command buffer head ptr in MMIO region after wraparound 66 8a1c09cbd3fe Costas Argyris: tests/qtest: Add amd-iommu command buffer head wrap test 67 85805ee887be Stefano Garzarella: libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc() 68 9f1b6d013d42 Stefano Garzarella: libvduse: fix buffer overflow in vduse_queue_read_indirect_desc() 69 786550e2d38a Alejandro Jimenez: amd_iommu: Follow root pointer before page walk and use 1-based levels 70 291aa70ad254 Alejandro Jimenez: amd_iommu: Reject non-decreasing NextLevel in fetch_pte() 71 eceff0982f97 Eugenio Pérez: virtio: Allow to fill a whole virtqueue in order 72 d85a4ec06a65 Daniel Henrique Barboza: target/riscv/cpu_helper.c: allow LOAD_ADDR_MIS promotion to AMO fault 73 109856754cbd Daniel Henrique Barboza: target/riscv/tcg: disable svpbmt if satp_mode < sv39 74 18645f195789 Daniel Henrique Barboza: target/riscv/csr.c: do not allow mstatus MPV/GVA writes 75 ddfd33f19658 Daniel Henrique Barboza: target/riscv/csr.c: fix mstatus.UXL reserved value 76 9273cda72293 Daniel Henrique Barboza: disas/riscv.c: add 'cbo' insns to disassembler 77 d6c5855c76b2 Daniel Henrique Barboza: target/riscv/insn_trans/trans_rvzicbo.c.inc: save opcode before helpers 78 3e33da68f1db Daniel Henrique Barboza: target/riscv/cpu_helper.c: fault with reserved PTE.PBMT val 79 8e090ecfa9e5 Daniel Henrique Barboza: target/riscv/cpu_helper.c: add PMA access fault 80 601c8494c6c7 Daniel Henrique Barboza: target/riscv/tcg: disable svnapot if satp_mode < sv39 81 758dce9c98af Daniel Henrique Barboza: disas/riscv.c: fix inst_length() 82 9f550a0b6306 Abhigyan Kumar: target/riscv: mask vxrm csrw write to the low 2 bits 83 d6601a7e1c24 Gerd Hoffmann: hw/uefi: fix parse_hexstr 84 e38d0afade7c Paolo Bonzini: target/i386: apply mod to immediate count of an RCL/RCR operation 85 88d39a2937eb Mathias Krause: gdbstub: Update x86 control register bits 86 7f5445e7e405 Christian Schoenebeck: hw/9pfs: fix abort due to illegal name with Twstat rename 87 08750e31fcdc Christian Schoenebeck: hw/9pfs: reject . and .. in Twstat rename 88 116db2986b11 Christian Schoenebeck: hw/9pfs: consolidate name validation with check_name() 89 490a3e1867f0 Ryan Zhang: ui/sdl2: Set GL ES profile before creating initial GL context 90 7e859bacea09 Matt Turner: target/xtensa: add cpu_set_fcr/fsr helpers to sync fp_status 91 6858e3a71cc4 Matt Turner: linux-user/xtensa: save/restore FP registers across signal delivery 92 54e08dbe8f2a Matt Turner: linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn 93 218109781209 Aditya Gupta: ppc/pnv_phb3: Error out on invalid config access 94 c7209c567181 Aditya Gupta: hw/pci: Replace assert with bounds check and return 95 156e536a7b97 Akshit Yadav: linux-user: Fix AT_PHDR when program headers are relocated into their own segment (commit(s) marked with * were in previous series and are not resent)
