The following patches are queued for QEMU stable v10.0.13: https://gitlab.com/qemu-project/qemu/-/commits/staging-10.0
Patch freeze is 2026-08-24 (frozen), and the release is planned for 2026-08-26: https://wiki.qemu.org/Planning/10.0 Please respond here or CC [email protected] on any additional patches you think should (or shouldn't) be included in the release. The changes which are staging for inclusion, with the original commit hash from master branch, are given below the bottom line. Thanks! /mjt -------------------------------------- 01* 702216619e2a Gerd Hoffmann: hw/uefi: add sanity check 02* ff5a9eb13c86 Gerd Hoffmann: hw/uefi: remove debug function 03* 647ba95eda5a Gerd Hoffmann: hw/uefi: check lower limit for signature list size 04* 8e0ddb4a6ebd Gerd Hoffmann: hw/uefi: account variable policy entries against storage size 05* acba2d78176d Gerd Hoffmann: hw/uefi: add post_load checks 06* bd9b3c50f458 Gerd Hoffmann: hw/uefi: make SetupMode read-only 07* c822ecd80661 Mario Casquero: vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom() 08* 256229e8f9b9 Tomita Moeko: vfio/igd: Clear saved BDSM in legacy VBIOS ROM at load time 09* dff528657fc1 Denis V. Lunev: vfio/pci: don't narrow a failed config read to a plausible value 10* 86abb10256a5 Denis V. Lunev: vfio/pci: reject invalid PCI_INTERRUPT_PIN values 11* 51aa3f3e0577 Andrey Polivoda: target/i386: helper_sysret(): Check that RCX contains a canonical address when emulating an Intel CPU 12* d149a11c6c82 Paolo Bonzini: scsi-disk: protect against guest sending truncated data for MODE SELECT commands 13* e2da3d92744d Paolo Bonzini: scsi-disk: fix off by one in assertion 14* 443e02410695 Artem Nasonov: hw/ide: replace assert with proper error handling 15* f604b807a55a Thomas Huth: hw/display/vmware_vga: Don't allow guest to trigger long running loop in host 16* a0414545a212 Christian Schoenebeck: hw/9pfs: fix O_TRUNC bypass on read-only export 17* 210701c82e30 Jia Jia: hw/9pfs/virtio: drain in-flight PDUs before virtio-9p unrealize 18* 1de8aea061b9 Christian Schoenebeck: hw/9pfs/xen: drain in-flight PDUs before xen-9p disconnect 19* b7520c9a5912 Thomas Huth: hw/usb/dev-uas: Fix guest-triggerable heap OOB access 20* 9b899ddb2706 Thomas Huth: hw/ide/core: Fix possible crash via NULL pointer in ide_cancel_dma_sync() 21* 68809288c7e5 Thomas Huth: hw/usb/core: Avoid possible assert() in do_parameter() --> usb_packet_copy() 22* 92abc3c51ebb Thomas Huth: hw/usb/hcd-xhci: Check return value of xhci_xfer_create_sgl() for errors 23* 861372428b05 Marc-André Lureau: hw/display/virtio-gpu: validate stride against width on scanout 24* 9c724426f519 Akihiko Odaki: hw/display/virtio-gpu: reject strides exceeding INT_MAX 25* 76dcc0832c5c Akihiko Odaki: hw/display/virtio-gpu: Remove the bytes_pp field 26* 1c1232c2ee07 Marc-André Lureau: hw/display/vhost-user-gpu: validate message payload sizes 27* efa7244b2a0b Marc-André Lureau: ui/vnc: remove redundant rows computation 28* 4727cc883b7e Haotian Jiang: hw/display/qxl: unregister vm_change_state handler and BHs 29* b28778131fad Marc-André Lureau: net/colo: fix g_hash_table_destroy assertion on uninitialized filter 30* 415f2759d7b3 Marc-André Lureau: target/i386/sev: fix MemoryRegion reference leaks in gpa2hva callers 31* 8ac0a1c7b98e Haotian Jiang: virtio-gpu: fix NULL deref in rutabaga set_scanout 32* 0fa3e1823b9b Akihiko Odaki: hw/display/virtio-gpu: Fix empty blob discrimination 33* 4ae1c5c7d6f3 Akihiko Odaki: hw/display/virtio-gpu: Initialize blob mapping for ATTACH_BACKING 34* 5322889f07b5 Marc-André Lureau: rutabaga: improve error handling, fix potential crash during init 35* 5c9ef661a60a Akihiko Odaki: hw/display/virtio-gpu: Block Rutabaga migration 36* 52c7bb369b23 Michael S. Tsirkin: virtio-net: fix OOB read in RSC receive path 37* 772488562053 Michael S. Tsirkin: virtio-net: fix short frame OOB read in receive_filter() 38* fbdfdbb9920c Michael S. Tsirkin: libvhost-user: protect against OOB writes in vu_set_inflight_fd 39* 758ef96a2dba Michael S. Tsirkin: libvhost-user: protect against OOB vring queue access 40* 6dbdc271f56b Laurent Vivier: hw/virtio: reject zero-length packed indirect descriptor table 41* 27806d2ddba2 Michael S. Tsirkin: vhost: do not crash on ring map failure 42* f404bf0e6504 Michael S. Tsirkin: virtio-scsi: fix SCSIRequest leak on a bad request 43* 665c854390e0 Michael S. Tsirkin: virtio: fail early on bad config_len in migration 44* cf89b769cdd1 Michael S. Tsirkin: vhost-user: assert nregions within limit 45* 5cc182ba39a3 Michael S. Tsirkin: virtio-pmem: wait for flush requests on unrealize 46* bf21298c082c Michael S. Tsirkin: libvhost-user: validate last_batch_head in vu_check_queue_inflights 47* b9d248dfaca5 Michael S. Tsirkin: libvhost-user: fix heap overflow in vu_check_queue_inflights 48* 733a98a552e4 Michael S. Tsirkin: libvduse: validate vq size 49* 67550d65b4bf Michael S. Tsirkin: virtio-iommu: fix OOM due to unbounded call_rcu 50* 7ea56dcc9406 Peter Maydell: hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled 51* a90fcf0080da Peter Maydell: hw/pci-host/q35.c: Factor out creation of SMRAM MRs 52* e07c67584c69 Peter Maydell: hw/pci-host/q35.c: Avoid early return in mch_write_config() 53* 421f45d03f32 GuoHan Zhao: hw/virtio/vdpa-dev: pass set_config buffer to vhost backend 54* 292902ae4e93 Haotian Jiang: hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle 55* 0691bb257a7c Clément MATHIEU--DRIF: intel_iommu: Check address mask before using it in pasid-based iotlb invalidation 56* df12999cc813 Laurent Vivier: hw/net/virtio-net: Protect from DMA re-entrancy bugs 57* 0be94d8d9c28 Laurent Vivier: hw/virtio-rng: Fix host use-after-free (CVE-2026-50624) 58* 70074cc48f45 Laurent Vivier: backends/rng: cap request size to avoid oversized allocation 59* 6682ea339127 Stefan Hajnoczi: virtio: avoid packed vring virtio_queue_empty() infinite loops (CVE-2026-16457) 60* 8268d216a004 Cédric Le Goater: linux-user: Guard local FUTEX_CMD_MASK definition 61* 8cbcf7579355 Peter Maydell: hw/net/xilinx_axienet: Don't write checksums off end of packet 62* aba80ad9d853 Matt Turner: linux-user: fix guards for the fsmount(2) syscall series 63* b395a655ae0e Laurent Vivier: hw/net/e1000e: recalculate rx_desc_len on migration load 64* 1e5efe6d9370 Laurent Vivier: hw/net/igb: recalculate rx_desc_len on migration load 65* d8813fdc4bdf Mark Cave-Ayland: target/sparc: set reg window data structures currently after vmstate load 66* db3abd36e4c7 Laurent Vivier: linux-user/sh4: allow full 32-bit address space 67* c4580a3a6d1c botszhuang: hw/i2c/bcm2835_i2c: Correct CLKT register offset 68* 4f635bddf50c Peter Maydell: hw/display/exynos4210_fimd: Factor out finding screen width/height 69* 7dd1e2218835 Peter Maydell: hw/display/exynos4210_fimd: Pass width to draw_line functions 70* a5f8d33682be Peter Maydell: hw/display/exynos4210_fimd: Clamp windows to screen size 71* a5cff318f06c Michael S. Tsirkin: virtio-mmio: fix QUEUE_NUM_MAX 72* df67805ee9b1 Klaus Jensen: hw/nvme: fix cross-namespace copy dif buffer overflow 73* c39e05af439a Klaus Jensen: hw/nvme: fix unintentional integer overflow in shift 74* 6e5ca34f3870 Daniel Paziyski: hw/nvme: fix assertion failure on subregion removal 75* 9e3df3019d21 Helge Deller: linux-user: Fix msqid_ds struct wrt 32-bit big endian architectures 76* 518a4aa01b88 no92: linux-user: fix incorrect msg_l[sr]pid members of target_msqid_ds 77* 0d3db94a8866 malike: block/cloop: fix integer overflow in total_sectors calculation 78* a55402d5c3a8 Kevin Wolf: block: Fix crash after setting latency historygram with single bin 79* 5b0ba385a024 Denis V. Lunev: block/accounting: take stats->lock in latency histogram setters 80* 16f94ef4c6ce Denis V. Lunev: block/qapi: take stats->lock when reading BlockAcctStats for query-blockstats 81* 842c89281a20 Denis V. Lunev: tests/unit: add reproducer for BlockAcctStats histogram locking race 82* 0c43f801c0d7 Stefan Hajnoczi: dmg: fix out-of-bounds load in search_chunk() (CVE-2026-65929) 83* ab7b872f0c38 Stefan Hajnoczi: dmg: refuse to open files with no chunks 84* 370882d08695 Stefan Hajnoczi: dmg: reject inconsistent UDRW chunk sector count and length (CVE-2026-65928) 85* fe0f9e3ab2a8 Denis V. Lunev: qcow2: do not try to clear the dirty bit on a read-only node 86* 43e4791d99ab Denis V. Lunev: iotests: run the test pool with the 'fork' start method 87* e554413bd2b4 Denis V. Lunev: coroutine: fix lost wakeup in qemu_co_sleep_wake() 88* 241095547a5d Marc-André Lureau: hw/display/virtio-gpu: validate blob iov size 89* 95687639e647 Marc-André Lureau: hw/display/vga: fix panning_buf OOB after text/graphics switch 90* a113e0c53fb5 Marc-André Lureau: vhost-user-gpu: fix integer overflow in buffer allocation 91* b8ef970532c3 Marc-André Lureau: hw/display/virtio-gpu: fix offset wraparound in scanout_blob_to_fb 92* 1f24066fc88d Ankur Saini: virtio-gpu: reject requests with short/truncated control headers 93* d513c644b893 Akihiko Odaki: hw/display/virtio-gpu: Always reject invalid scanout bounds 94* 5ce01c92389a Bin Guo: hw/display/virtio-gpu: Unmap DMA regions on reset 95* 1d5e53df1674 Minwoo Im: hw/nvme: drop AER requests without aiocb in nvme_del_sq() 96* 849ea354ddc1 Minwoo Im: hw/nvme: factor out nvme_sq_cancel_inflight() 97* 86f938333e2f Minwoo Im: hw/nvme: cancel inflight requests on controller reset 98* 7a34f7b8794b Klaus Jensen: hw/nvme: fix leak on copy ranges 99* 923222000443 Stefan Hajnoczi: gitlab: disable provenance attestations to work around CI bug 100* bc4681990bb6 Mikulas Patocka: linux-user/sh4: Deliver SIGILL on invalid instruction 101* 668d571bf0c2 Mikulas Patocka: linux-user/sh4: Initialize the FPSCR register on signal 102* f7ad7b1f8c81 Mikulas Patocka: linux-user/sh4: Fix crashes on signal delivery in conditional delay slot 103* 4713988da1c3 Matt Turner: linux-user: implement mount_setattr(2) 104* 6440880ed371 Philippe Mathieu-Daudé: hw/arm/aspeed: Add missing Kconfig dependencies on required components 105* fcc2699d41ed Philippe Mathieu-Daudé: target/s390x: Have MSA helper pass a mmu_idx argument 106* aae77f5dddef Ilya Leoshkevich: target/s390x: Make PRNO TRNG interruptible 107* abe1d893f41d Ilya Leoshkevich: tests/tcg/s390x: Test PRNO TRNG interruptibility 108* 0103cb1cd175 Ilya Leoshkevich: target/s390x: Fix DR/D INT64_MIN / -1 host crash 109* aa5d03bc9351 Ilya Leoshkevich: tests/tcg/s390x: Test DR overflow (INT64_MIN / -1) 110* 4e994ebb0144 Christian Borntraeger: hw/char/sclpconsole-lm: avoid guest triggerable assert 111* df607fd05604 Joshua Daley: s390x/ipl: validate num_comp against iplb length before iterating 112* a9f1e84c6b82 Joshua Daley: pc-bios/s390-ccw: fix out-of-bounds read in iso_get_file_size() 113* 33909d4ebd5c Joshua Daley: pc-bios/s390-ccw: bounds-check zipl menu entry index before array write 114* a3856a7ba44b Joshua Daley: pc-bios/s390-ccw: bound zipl menu strlen and replace VLA in zipl_print_entry 115* 27ad1a030fa Michael Tokarev: pc-bios/s390-ccw.img: update s390x bios 116* 2c32c273da6d Ilya Leoshkevich: target/s390x/tcg: Set STCK/STCKF condition code after the store 117* e79ea4472691 Ilya Leoshkevich: tests/tcg/s390x: Test STCKF condition code on a faulting store 118* ac7fa2e9d457 Peter Xu: migration/multifd: Validate next_packet_size in zlib/zstd recv 119* cf45083edc2b Peter Xu: migration/multifd: Replace assert() with error_setg() in recv paths 120* 80776c4df92c Bin Guo: hw/intc/loongarch_pch_pic: Validate htmsi_vector before indexing parent_irq 121* 15700a66ecb5 Thomas Huth: hw/usb/dev-uas: Don't abort if guest provided an undersized buffer for status 122* 46099d990055 Thomas Huth: hw/net/vmxnet3: Do not abort if guest provides bad interrupt numbers 123* ebec7c732298 Denis V. Lunev: tests/qtest/ide-test: parametrize the ATAPI CD-ROM read test 124* fe543c2d787a Denis V. Lunev: tests/qtest/ide-test: add a multi-sector ATAPI DMA read test 125* 502dbdfd9687 Denis V. Lunev: tests/qtest/ide-test: cover raw (2352-byte) ATAPI CD reads 126* de86ef3dfd33 Denis V. Lunev: tests/qtest/libqos/ahci: support raw (2352-byte) READ CD 127* 31f13e71afd1 Denis V. Lunev: tests/qtest/ahci: cover raw (2352-byte) ATAPI CD reads 128* 12289dc700d9 Denis V. Lunev: hw/ide/atapi: read the whole elementary transfer asynchronously 129* be1ee6a8f6e3 Denis V. Lunev: tests/qtest/ahci: regression test for ATAPI read vs. drain 130* 59fc7b747d56 Peter Maydell: hw/net/rtl8139: Fix handling of VLAN tags on incoming short packets 131* f3a10c1c4547 Peter Maydell: hw/net/rtl8139: Send whole of vlan-tagged packet when doing loopback 132* 60d010f66f2a Bin Guo: hw/block/pflash_cfi01: Restore ROMD mode after migration 133* 6dab35f5492b Stefan Hajnoczi: hw/nvme: add SPDM_SOCKET Kconfig dependency 134* 260d49d8e283 Alex Bennée: hw/elf_ops: defend against weird elf headers 135 3181e53c13a1 Richard Henderson: tcg/optimize: INDEX_op_mul is commutative 136 5fe51606146c Richard Henderson: tcg/optimize: Fix s_mask computation for shifts 137 397ef415cad1 Peter Maydell: target/i386: Use correct type for get_float_exception_flags() values 138 0924d9d3db36 Simon Scherer: target/i386: Clear OF, SF, and AF for fcomi/fucomi 139 ce0ee66044be Simon Scherer: target/i386: fix incorrect decoding of EXTRQ_i 140 3589cd995b4f Craaijo, Jos: target/i386: fix long mode segment override prefix decoding 141 36f634fe4ab6 Andrey Polivoda: target/i386: allow transition to virtual-8086 mode only if CPL == 0 and CPU is not in long mode 142 380b95961817 Andrey Polivoda: target/i386: decode opcode extensions group 3 /1 as TEST 143 eb3f7fe382ba Paolo Bonzini: serial: clear transmit retry callback on unrealize 144 501187d0bc62 Paolo Bonzini: meson: make linker warnings non-fatal on Linux 145 215a4fc08f2a Jan Mercl: target/loongarch: check FPE before reading fcc in bceqz/bcnez 146 e131c28b6eb2 Richard Henderson: tcg: Return success from tcg_region_alloc__locked 147 fcdbc78ad4de Richard Henderson: tcg: Return success from tcg_region_alloc 148 f5d2d8532f3c Richard Henderson: tcg: Defer tb_flush when initial thread region alloc fails 149 b4f6f672a3e1 Richard Henderson: tcg: Export tcg_gen_ussub_i{32,64,tl} 150 eea4de1bd8e8 Chinmay Rath: hw/watchdog: Add lower bound check for watchdogNumber 151 4a884ba94b43 Max Chou: target/riscv: Fix PC sync in trans_sspopchk for CFI exception handling 152 ebef6685a1a2 Abhigyan Kumar: target/riscv: use SXL instead of MXL for read_sstatus 153 6985cfc87512 TANG Tiancheng: disas/riscv: Fix th.srri decoding 154 7a8454ef2930 TANG Tiancheng: disas/riscv: Fix 6-bit immediate extraction 155 7899d3c6bdb0 TANG Tiancheng: disas/riscv: Use signed type for vector immediates 156 00cec77a7f9f TANG Tiancheng: disas/riscv: Decode unsigned vector immediates as unsigned 157 f16fd27b3fe3 Andrew Jones: hw/riscv/riscv-iommu: fix U-bit check to apply only to leaf S/VS-stage PTEs 158 aa51eec00446 Andrew Jones: hw/riscv/riscv-iommu: preserve requested perm in spa_fetch() 159 bd1ee9ab3c39 A-Shehab: target/riscv: allow menvcfg/henvcfg LPE and SSE bits on RV32 160 d4151cf26751 Richard Henderson: disas/riscv: Fix rv32 encoding of zext.h 161 d610e55c8390 Richard Henderson: disas/riscv: Fix isa decoding of rev8 162 ecbd3a031f12 Richard Henderson: disas/riscv: Fix typo in th.lbib format 163 12289f2f9a0f wangyang: target/riscv: honor zicbo* envcfg gating in linux-user mode 164 af1e669cef16 wangyang: target/riscv: reject FMV.X.W/FMV.W.X under Zfinx 165 e68cc2e5cd28 wangyang: target/riscv: enforce even register constraints for Zdinx fcvt pairs 166 85d38315fd19 Christian S. Lima: target/riscv/tcg: sret in virtual user mode raises virtual instruction exception (commit(s) marked with * were in previous series and are not resent)
