The following patches are queued for QEMU stable v10.0.15: https://gitlab.com/qemu-project/qemu/-/commits/staging-10.0
Patch freeze is 2026-10-26, and the release is planned for 2026-10-28: https://wiki.qemu.org/Planning/10.0 Please respond here or CC [email protected] on any additional patches you think should (or shouldn't) be included in the release. The changes which are staging for inclusion, with the original commit hash from master branch, are given below the bottom line. Thanks! /mjt -------------------------------------- 01* 653b0c06c83d Jean-Francois Bortolotti: target/arm: Fix PMSAv8 shareability decode for R-profile MPU regions 02* 66d4ea65a064 Fuad Tabba: target/arm: Fix next timer tick when the offset puts the count ahead 03* 998b6db69e3e Fuad Tabba: target/arm: Fix WFxT timeouts when the offset puts the count ahead 04* 89e653b77369 Thomas Huth: hw/usb/hcd-xhci: Limit DMA transfers to plain memory 05* 92b935de2709 Eric Farman: virtio-ccw: Limit ISC to MAX_ISC 06* 13c7ba5e0f14 Eric Farman: virtio-ccw: Do not overwrite existing indicators 07* bd5bc2861fb6 Eric Farman: virtio-ccw: Fix rc check in read configuration path 08* 057ca01937b7 Eric Farman: vfio/ap: Clear error object pointer after non-fatal errors 09* 77cc481c2311 Eric Farman: hw/intc/s390x: Fix check after g_try_realloc 10* 930a188edbbc Eric Farman: s390x/css: Use datastream pointer for checking no-data CCWs 11* 119860f15cd2 Eric Farman: s390x/sclp: Reject short headers in PV case 12* e57ad3670188 Matthew Rosato: s390x/pci: Fix frame stepping in rpcit_service_call() 13* 10a81449a279 Matthew Rosato: s390x/pci: Use qemu_log_mask() for guest-triggered errors in reg_ioat() 14* d818e2b0e631 Matthew Rosato: s390x/pci: Reject apertures beyond IOAT capacity in translation mode 15* 1847dcd96d7d Marc-André Lureau: hw/usb/dev-smartcard-reader: validate interrupt transfer length 16* 49851e859506 Marc-André Lureau: hw/usb/dev-smartcard-reader: fix OOB read from pending bulk-in ring 17* d7f20657e756 Marc-André Lureau: hw/usb/dev-smartcard-reader: fix assert on pending answers overflow 18* 069dcc103be7 Marc-André Lureau: hw/usb/dev-smartcard-reader: decode bulk-out length as little-endian 19* 665494c3ac07 Marc-André Lureau: hw/usb/dev-smartcard-reader: validate migrated fields in post_load 20* 050f5408bfcf Andrey Drobyshev: hw/display/qxl: factor out qxl_guest_phys2virt() 21* 95bc45193bbe Andrey Drobyshev: hw/display/qxl: validate replayed commands in qxl_post_load 22* 7e429d3624c4 Andrey Drobyshev: hw/display/qxl: trace skipped stale loadvm commands 23* 9998d225bb95 Denis V. Lunev: block/nbd: clear reply.cookie when the reply is rejected 24* 75b0a993dacb Denis V. Lunev: block/nbd: never index requests[] with an unchecked cookie 25* cd3be3bd96c0 Denis V. Lunev: block/nbd: clear reply.cookie under receive_mutex 26* 90fcba23c526 Daniel Paziyski: hw/nvme: fix assertion failure on sr-iov capable nvme controller removal 27* 6ee626e34979 Daniel Paziyski: hw/nvme: fix memory leak on sr-iov capable nvme controller removal 28* 8d496d8f9fce Jakub Lipový: target/i386/tcg: raise #GP(0) on null SS load with RPL != CPL 29* 6802a4b23919 Simon Scherer: target/i386: clear C1 for all x87 compare instructions 30* 6d5fb14d36a6 Simon Scherer: target/i386: Don't clear C1 for FCOMI/FCOMIP/FUCOMI/FUCOMIP 31* 0f98b46846eb Maxim Levitsky: accel/kvm: protect kvm_resample_fd_list with a mutex 32* a5b4837a253e Paolo Bonzini: target/i386/tcg: ignore VEX.L for unary scalar instructions 33* d198957674b3 Tommaso Califano: hw/usb: Fix USB MTP Use-After-Free in usb_mtp_deletefn List Iteration 34* 4668899d6615 Daniel P. Berrangé: io: prevent unbounded read of websocket data from client 35* 429bf66a1f23 Denis V. Lunev: block/throttle-groups: fix crash when enabling I/O limits on a busy disk 36* 2910b995f6c8 Denis V. Lunev: iotests: cover inactivating a read-only node 37* 8daaf8d3b1c5 Denis V. Lunev: block: fix bdrv_next() skipping monitor-owned nodes 38* 196a50b0902b Stefan Hajnoczi: file-posix: add statx(STATX_DIOALIGN) support 39* af28b65fae6f Denis V. Lunev: qcow2: do not clear the dirty bit when reopening a read-only node 40* efe98c2a0932 Denis V. Lunev: block: reject a reopen of an unusable node instead of crashing 41* 0bd5a1b3d60c Kevin Wolf: block: Fix corruption from broken RMW atomicity 42* cf4f672c11d6 Kevin Wolf: block: Remove now redundant bdrv_wait_serialising_requests() calls 43* c08b84cd6e55 Philippe Mathieu-Daudé: accel/kvm: Replace legacy cpu_physical_memory_write() call 44* 12916d64b78e Maxim Levitsky: accel/kvm: coalesced mmio: check lenght of the MMIO write entry 45* 99a8b5a0dda9 Daniel P. Berrangé: io: cork TLS writes to avoid small TLS records 46* 6728170d2d08 Stefan Berger: tpm_emulator: Reject sending commands smaller than the request header 47* 35164929cfa3 Marc-André Lureau: hw/display/vga: fix OOB writes after external surface resize 48* d228536a5142 Dominic P: tcg/optimize: Do not derive s_mask from rotated s_mask 49* f9ca6b19acb1 Dominic P: tests/tcg: Add tests for sign extension after rotate 50* 0dd9fb43ea22 Artemii Mashanov: target/i386/tcg: zero FXSAVE FOP and reserved slot bytes 51* 21b6c3e5bccf Artemii Mashanov: target/i386: fix immediate stack adjustment for RET and RETF 52* 306d9ab85fdb Aurelien Jarno: tcg/riscv64: Remove vector min/max ops with immediates 53* 0dedeff9328d Fuad Tabba: target/arm: Clear TTBR[5:0] from a 52-bit table base address 54* bb79850255c8 Fuad Tabba: tests/tcg/aarch64: Add a test for a two-entry 52-bit TTBR table 55* 2c372119465e Fuad Tabba: target/arm: Use the 52-bit TTBR base address layout when TCR.DS is set 56* 2579771a28a2 Fuad Tabba: tests/tcg/aarch64: Test the TTBR layout with TCR.DS and a 48-bit OA 57* 366b4fba0fae imaginos: target/riscv: check G-stage write permission for VS-stage A/D updates 58* 410166b550cc Zephyr Li: target/riscv: stop translating after WFI 59* e52de6b65f5f Xie Bo: target/riscv/kvm: Preserve FCSR across migration 60* ba280c351011 Rick Richard: tests/qtest/bios-tables-test: Allow changes to riscv64 virt SPCR 61* ee23f530e99d Rick Richard: hw/riscv/virt-acpi-build: Fix the UART register width in SPCR 62* 71041ce05c95 Rick Richard: tests/qtest/bios-tables-test: Update riscv64 virt SPCR golden reference 63* cb82463fa9bf dodochicha: target/riscv: Check Svnapot PTE before updating A/D bits 64 f33fb19cab41 Daniel P. Berrangé: seccomp: fix blocking of setns/execveat/unshare 65 a567ef86557b Daniel P. Berrangé: seccomp: really fix blocking of setns/execveat/unshare 66 90b5f6ca171d Fiona Ebner: iotests: add test cases for failing flush after qemu-img convert 67 9d2cdc4d3b71 Fiona Ebner: iotests.py: add filter_qemu() 68 c6c8bdc21af3 Fiona Ebner: block: report flush error during bdrv_close() 69 901ac73874c2 Fiona Ebner: qemu-img: convert: flush target image after copying 70 aea4af8c515f Marc-André Lureau: migration: fix qemu_get_counted_string annotation 71 319cd41f110a Denis V. Lunev: migration: add QEMU_COUNTED_STRING_SIZE for counted string buffers 72 4d11088a088d Denis V. Lunev: migration/block-dirty-bitmap: fix postcopy abort with bitmaps on several nodes 73 faa80b9847b9 Denis V. Lunev: iotests/migrate-bitmaps-postcopy-test: add a bitmap on a second node 74 12df3256042c Christian Schoenebeck: hw/9pfs: fix dirent stream protection for legacy (9p2000.u) Tread 75 e90644eea1ce Martin Pitt: hw/uefi: fix ContentInfo detection in wrap_pkcs7() 76 b17205f23a9a Tommaso Califano: hw/usb/dev-mtp: Fix assert crash on undersized BULK IN 77 7b1eba96aeca Munkhbaatar Enkhbaatar: hw/usb/hcd-ohci: Assert isochronous TDs are never deferred 78 9ad9a5a92398 Peter Maydell: hw/usb/hcd-ohci: Fail iso packets sent to non-iso endpoints and vice-versa 79 46dcc681eac0 Junjie Cao: tests/qtest: Cover OHCI endpoint type mismatches 80 e1b7f5e2a671 Junjie Cao: usb-host: validate interface number before indexing altsetting 81 322894eed304 Junjie Cao: usb-host: free configuration descriptors on error paths 82 432f505fa65e Junjie Cao: tests/qtest/usb-hcd-xhci: test interrupt pacing above 2^32 83 59cb51091013 Haotian Jiang: usb-host: free request on libusb submit failure 84 a86338565cea Haotian Jiang: usb-host: delete bottom halves during unrealize 85 1ccf17e9dc6b Tommaso Califano: hw/usb/dev-mtp: Fix assert crash on short CMD_SEND_OBJECT 86 6ab4cd2f13de Tommaso Califano: hw/usb/dev-mtp: Fix heap OOB read in usb_mtp_write_metadata() 87 cfa70f3a82f5 Thomas Huth: hw/usb/hcd-xhci: More reentrancy guard fixes for the XHCI code 88 be67e61e29a8 Peter Maydell: hw/misc/bcm2835_cprman: Treat invalid clock mux source select as GND 89 b6d36a1af790 Peter Maydell: hw/intc/exynos4210_combiner: Avoid hw_error for guest errors 90 ab6579bf73b5 Peter Maydell: hw/intc/exynos4210_combiner: Fix group register range check 91 fe0f4a5a5727 Philippe Mathieu-Daudé: target/ppc: Name the EBB exceptions (commit(s) marked with * were in previous series and are not resent)
