Public bug reported:
A new release of qemu is available for merging from Debian.
Ubuntu: 1:11.0.3+ds-2ubuntu2
Debian Unstable: 1:11.1.2+ds-3
### New Debian Changes ###
qemu (1:11.1.2+ds-3) unstable; urgency=medium
* two patches from Aurelien Jarno fixing 2 issues in riscv vector extensions
(and CI failure in debian) (Closes: #1150345)
-- Michael Tokarev <[email protected]> Fri, 09 Oct 2026 04:21:14 +0300
qemu (1:11.1.2+ds-2) unstable; urgency=medium
* virtio-gpu-disable-blob-scanouts-on-mapping-cleanup.patch (CVE-2026-66020)
* virtio-gpu-disable-blob-scanouts-on-mapping-cleanup.patch (CVE-2026-6426)
-- Michael Tokarev <[email protected]> Mon, 05 Oct 2026 20:57:16 +0300
qemu (1:11.1.2+ds-1) unstable; urgency=medium
* new upstream stable/bugfix release:
- Update version for 11.1.2 release
- target/sh4: Replace TB_FLAG_GUSA_EXCLUSIVE with CF_STEP_ATOMIC
- accel/tcg: Set CF_NOIRQ during cpu_exec_step_atomic
- linux-user/sh4: align the vdso sigreturn trampolines
- linux-user/sh4: fix vdso CFA for rt_sigreturn frames
- linux-user/sh4: use the kernel's sigreturn trampoline sequence
in the vdso
- target/i386: Mark MOVNTI as not valid with prefixes 0x66, 0xF2, 0xF3
- target/i386: Update FPU tag word for FXCH
- target/i386: Update FPU tag word for FSTP
- target/i386: Update FPU tag word for FXTRACT's old ST(0)
- target/i386: Fix FXCH to unconditionally clear C1
- target/ppc: Stop vCPU thread before calling parent_unrealize
- tests/qtest/usb-hcd-xhci: test isoch endpoint type mismatch
- tests/qtest/usb-hcd-xhci: test isoch pacing with MFINDEX above 2^32
- hw/usb/hcd-xhci: don't assert on NAK when retrying an isoch transfer
- hw/usb/hcd-xhci: fix interval alignment after MFINDEX passes 2^32
- hw/usb/hcd-xhci: Set reentrancy guard in timer functions
(Closes: CVE-2026-17588)
- tcg/riscv64: Set vtype before whole-register vector loads
- tests/tcg/s390x: Add regression test for #4449
- tcg/optimize: Fix expansion/simplification of deposit
- tests/tcg/arm: Add regression test for #4448
- tcg/optimize: Fix fold_multiply2 vs 1
- accel/tcg: Fix TLB_MMIO check in tlb_plugin_lookup()
- accel/tcg: Use TLB_FORCE_SLOW not TLB_MMIO for system plugins
- hw/9pfs: mutate FID path from main thread only
(Closes: #1149064, CVE-2026-93834)
- s390x/pci: fix DMA slot leak on I/O TLB entry replacement
- hw/s390x/ipl: Fix incorrect PCI IPL block lengths
- linux-user/loongarch64: Detect vector stores in host_signal_write()
- linux-user: implement mlock2(2) syscall
- linux-user/riscv: honor zicntr=false for base counterCSRs
- system/ram-discard-manager: fix offset_within_address_space
in replay_by_populated_state()
- igvm: mark qigvm_find_param_entry as static
- igvm: validate and honor byte_offset in parameter directives
- hw/uefi: add missing uefi_str_is_valid check
to uefi_vars_mm_lock_variable
- target/loongarch: Fix data race in CSR_ESTAT
- hw/riscv/virt.c: fix aclint soc/mtimer nodename
- target/arm/hvf: implement MDCCSR_EL0 as RAZ
- target/arm/whpx: fix whpx-arm post-reset CPU state
- target/arm/whpx: incorrect ENCODE_AA64_CP_REG parameter order
- target/arm/whpx: Don't try to sync ARM_CP_CONST registers
- hw/intc/bcm2835_ic: reject out-of-range FIQ source values
- qga: Change effective user/group ID in guest-ssh-* commands
(Closes: CVE-2026-12080)
- vhost-user-gpu: validate command buffer size in submit_3d
- ui/cursor: make the cursor refcount atomic
- hw/display/qxl: hold ssd.lock while replacing ssd.cursor
- hw/cxl: fix the CDAT DOE overlapping the Flex Bus DVSEC when sn= is set
- virtio-scsi: set dataplane_started to false upon failure
- virtio-balloon: fix free-page BH teardown on unrealize
(Closes: CVE-2026-66899)
- hw/virtio: reject inverted virtio-iommu IOVA ranges
- hw/net/virtio-net: strip trailing padding when caching RSC segment
(Closes: CVE-2026-66900)
- hw/net/virtio-net: check packet size before VLAN tag access
in receive_filter()
- qapi/misc: Fix missed query-iothreads items
- hw/cxl: Fix guest-triggerable QEMU exit on reserved interleave ways
- virtio-gpu: clear res->blob on mapping cleanup
- tests/unit: cover blocked IO during the websock handshake
- io/channel-websock: do not lose QIO_CHANNEL_ERR_BLOCK while reading
- tests/unit: add websock handshake test
- io/channel-websock: handle a blocked write during the handshake
- io/channel-websock: send an HTTP 400 when the greeting has no space
- io/channel-socket: do not treat a zero length write as an error
(the 5 changes above: Closes: CVE-2026-84788)
- target/loongarch: Fix SWI interrupt delivery via CSR_ESTAT
- hw/cxl: fix timer leak in cxl_destroy_cci()
- hw/sd/sdcard: Register device ops in drives without media
- hw/sd: sdhci: Accept version 4 enable without UHS-I
- target/arm: Make Thumb T1 hint space UNDEF before v6T2
- target/arm: Make IT insn undef when not present
- target/arm: Make CBZ/CBNZ UNDEF before v6T2
- target/arm: Correct reset value of SCTLR for arm926, arm1026
- target/arm: fix TTA instruction S bit for IDAU-exempt addresses
- ppc/xive: Trigger the pending interrupt for a guest after migration
- i386/vapic: unref MemoryRegion if vapic_map_rom_writable fails
- vapic: confine the VAPIC region to 0xc0000..0xe0000
(Closes: #1148473, CVE-2026-81627)
- scsi: hide MODE SELECT block size change behind a quirk
- scsi-disk: fix out-of-bound read in WRITE SAME
- target/riscv/kvm: Preserve MP state across migration
- target/riscv/kvm: Synchronize privilege mode
- hw/ide: report the default CHS translation in IDENTIFY DEVICE
- tests/qtest/ide-test: cover a CHS translation with zero sectors
- hw/ide: reject an unsupported CHS translation
- s390x/sclp: pv: only copy the original SCCB buffer
- dirty-bitmap: fix integer overflow in serialization coverage
- block/monitor: allow dropping a bitmap never stored on disk
- migration/block-dirty-bitmap: reject bitmap load onto ro node
- block/monitor: reject persistent bitmap add on a read-only node
- tests/unit/test-blockjob: cover keeping a job paused
while a pause is pending
- job: keep job paused across overlapping pause requests
- hw/input/ps2: answer unknown mouse commands with a resend
- hw/display/vga: fix text-mode OOB write after a graphics surface switch
(Closes: CVE-2026-77913)
- chardev: Don't unregister yank upon async path connection failure
- crypto: fix build against nettle >= 4
- virtio-gpu: use g_try_malloc to avoid guest-triggered abort
- hw/display/qxl: validate primary surface stride against width
(Closes: CVE-2026-16271)
* d/control: libjack-dev => libjack-jackd2-dev (Closes: #1146606)
-- Michael Tokarev <[email protected]> Tue, 29 Sep 2026 17:59:06 +0300
qemu (1:11.1.1+ds-1) unstable; urgency=medium
* new upstream stable/bugfix release:
- Update version for 11.1.1 release
- target/riscv/tcg: sret in virtual user mode raises virtual
instruction exception
- target/riscv: Allow UXL to be 3 in mstatus on rv128
- target/riscv: Restore register dump zero padding
- tests/qtest: remove trace output from k230 watchdog test
- target/riscv: enforce even register constraints for Zdinx fcvt pairs
- target/riscv: reject FMV.X.W/FMV.W.X under Zfinx
- target/riscv: honor zicbo* envcfg gating in linux-user mode
- disas/riscv: Fix typo in th.lbib format
- disas/riscv: Fix isa decoding of rev8
- disas/riscv: Fix rv32 encoding of zext.h
- target/riscv: allow menvcfg/henvcfg LPE and SSE bits on RV32
- hw/riscv/riscv-iommu: preserve requested perm in spa_fetch()
- hw/riscv/riscv-iommu: fix U-bit check to apply only to leaf
S/VS-stage PTEs
- disas/riscv: Decode unsigned vector immediates as unsigned
- disas/riscv: Use signed type for vector immediates
- disas/riscv: Fix 6-bit immediate extraction
- disas/riscv: Fix th.srri decoding
- tests/qtest: Add seed CSR zero extension test
- target/riscv: Fix seed CSR sign extension
- target/riscv: do not count ECALL in minstret
- target/riscv: Fix memory leak in riscv_trigger_unrealize()
- target/riscv: use SXL instead of MXL for read_sstatus
- target/riscv: Fix PC sync in trans_sspopchk for CFI exception handling
- whpx: i386: inject back db
- whpx: i386: work around Hyper-V FP state oddities
- whpx: i386: synchronise PAT too
- whpx: i386: enable fast hypercall output
- hw/i386: fw_cfg: do not set VMX feature control on WHPX
- whpx: i386: fix xsaves enablement in legacy probing path
- hw/watchdog: Add lower bound check for watchdogNumber
- tests/tcg/aarch64: Add regression test for whilewr/whilerw
- target/arm: Fix SVE2 WHILEWR/WHILERW zero diff boundary case
- tcg: Export tcg_gen_ussub_i{32,64,tl}
- hw/intc/arm_gicv3: Have GIC kconfig select GICv3 for HVF and WHPX
- hw/intc: Fix arm kvm gicv3 selection
- tcg: Defer tb_flush when initial thread region alloc fails
- tcg: Return success from tcg_region_alloc
- tcg: Return success from tcg_region_alloc__locked
- target/loongarch: check FPE before reading fcc in bceqz/bcnez
- meson: make linker warnings non-fatal on Linux
- serial: clear transmit retry callback on unrealize
- target/i386: decode opcode extensions group 3 /1 as TEST
- target/i386: allow transition to virtual-8086 mode
only if CPL == 0 and CPU is not in long mode
- target/i386: fix long mode segment override prefix decoding
- target/i386: fix incorrect decoding of EXTRQ_i
- target/i386: Clear OF, SF, and AF for fcomi/fucomi
- accel/tcg: Allow overlapping reads in record_save
- tcg/optimize: Fix s_mask computation for shifts
- tcg/optimize: INDEX_op_mul is commutative
- hw/elf_ops: defend against weird elf headers
- hw/nvme: add SPDM_SOCKET Kconfig dependency
- hw/block/pflash_cfi01: Restore ROMD mode after migration
- hw/net/rtl8139: Send whole of vlan-tagged packet when doing loopback
- hw/net/rtl8139: Fix handling of VLAN tags on incoming short packets
- hw/i386/pc: xen: reinstate the "xenfv" machine alias
- tests/qtest/ahci: regression test for ATAPI read vs. drain
- hw/ide/atapi: read the whole elementary transfer asynchronously
- tests/qtest/ahci: cover raw (2352-byte) ATAPI CD reads
- tests/qtest/libqos/ahci: support raw (2352-byte) READ CD
- tests/qtest/ide-test: cover raw (2352-byte) ATAPI CD reads
- tests/qtest/ide-test: add a multi-sector ATAPI DMA read test
- tests/qtest/ide-test: parametrize the ATAPI CD-ROM read test
- hw/net/vmxnet3: Do not abort if guest provides bad interrupt numbers
- hw/usb/dev-uas: Don't abort if guest provided an undersized
buffer for status
- hw/intc/loongarch_pch_pic: Validate htmsi_vector before
indexing parent_irq
- migration/multifd: Replace assert() with error_setg() in recv paths
- migration/multifd: Validate next_packet_size in zlib/zstd recv
- tests/tcg/s390x: Test STCKF condition code on a faulting store
- target/s390x/tcg: Set STCK/STCKF condition code after the store
- pc-bios/s390-ccw.img: update s390x bios
- pc-bios/s390-ccw: Fix off-by-one errors with loadparm and boot entries
- pc-bios/s390-ccw: bound zipl menu strlen and replace VLA
in zipl_print_entry
- pc-bios/s390-ccw: bounds-check zipl menu entry index before array write
- pc-bios/s390-ccw: fix out-of-bounds read in iso_get_file_size()
- s390x/ipl: validate num_comp against iplb length before iterating
- hw/char/sclpconsole-lm: avoid guest triggerable assert
- tests/tcg/s390x: Test DR overflow (INT64_MIN / -1)
- target/s390x: Fix DR/D INT64_MIN / -1 host crash
- tests/tcg/s390x: Test PRNO TRNG interruptibility
- target/s390x: Make PRNO TRNG interruptible
- host-utils: fix ssub32/64_saturate return type and clamp direction
- hw/arm/aspeed: Add missing Kconfig dependencies on required components
- hw/arm/aspeed: Add missing PCI_EXPRESS -> PCIE_PORT Kconfig dependency
- linux-user: implement mount_setattr(2)
- target/hexagon: don't let an idef-parser dest clobber its own source
- tests/tcg/hexagon: add slot-assignment tests
- target/hexagon: accept valid packets rejected by check
- target/i386/kvm: Fix CET SSP MSR read feature check
- linux-user/sh4: Fix crashes on signal delivery in conditional delay slot
- linux-user/sh4: Initialize the FPSCR register on signal
- linux-user/sh4: Deliver SIGILL on invalid instruction
-- Michael Tokarev <[email protected]> Mon, 31 Aug 2026 12:58:42 +0300
qemu (1:11.1.0+ds-2) unstable; urgency=medium
* fix the bug# closed by the previous upload
* d/rules: install & ship pegasos1.dtb & pegasos2.dtb
* target-loongarch-Fixes-for-endianness-problems-in-ve.patch: add back
This patch is still needed for loong64-on-s390x to work
* target-loongarch-fix-data-race-in-CSR_ESTAT.patch: re-add
with adjustments for 11.1.x
-- Michael Tokarev <[email protected]> Tue, 18 Aug 2026 12:34:54 +0300
qemu (1:11.1.0+ds-1) unstable; urgency=medium
* new major upstream release, with the following security issues fixed:
o CVE-2026-6502: Use-after-free within the virtio-gpu subsystem
o CVE-2026-8348: Host memory exhaustion in 9pfs by limiting xattr fids
o CVE-2026-9238: DoS in 9pfs via uncapped Treaddir allocation
o CVE-2026-16457: Infinite loop in virtio_queue_empty() when evaluating
packed vrings
https://gitlab.com/qemu-project/qemu/-/work_items/3968
o CVE-2026-50626: OOB memory access in virtio-mmio transport mechanism
https://gitlab.com/qemu-project/qemu/-/work_items/3882
https://gitlab.com/qemu-project/qemu/-/work_items/3921
https://gitlab.com/qemu-project/qemu/-/work_items/3923
https://gitlab.com/qemu-project/qemu/-/work_items/3613
o CVE-2026-63318: Read-only export bypass via O_TRUNC in 9pfs
https://gitlab.com/qemu-project/qemu/-/work_items/4000
o CVE-2026-63319: Infinite loop or crash trigger in the usb-redir device
https://gitlab.com/qemu-project/qemu/-/work_items/3995
o CVE-2026-66021: OOB read via DMA buffers in virtio-gpu blob handling
https://gitlab.com/qemu-project/qemu/-/work_items/3945
* rules: do git checkout on vdso files on clean, if .git is present
* gbp.conf, d/watch: switch to 11.1
* patches/: remove 4 now-unused patches
* patches/: refresh gnu-hurd.patch riscv-on-ppc64-gcc15-121689.patch
* control: add gcc-sh4-linux-gnu & libc6-dev-sh4-cross to build-deps
for sh4 vdso
* rules: export cross_prefix_sh4 for sh4 vdso files
* rules: specify compiler to build sh4eb vdso
* control.mk: add 2 vdso files for sh4; set vdso-version to 11.1.0~
* control.mk: checked-version := 11.1.0+ds
* control,rules: remove glusterfs (removed upstream)
* qemu-block-extra.NEWS: add a note about glusterfs remvoval
* control.mk: add qemu-system-hexagon to qemu-system-misc
* rules: remove --as-needed linker flag (it is enabled by default)
* control: remove Priority: optional and Rules-Requires-Root: no
(these are the default now)
* control: Standards-Version: 4.7.4
* control: drop oss4-dev (does not exist anymore)
* lintian-overrdies
* u-boot-cmd_process-fix-return-type.diff
* seabios-hppa-work-around-1143851.diff: work around gcc-hppa bug #1143851
* openbios-no-error-unused-but-set-variable.diff
* work-around -Wa,-many issue by adding local gcc override to b/bin
(Closes: #1143769)
-- Michael Tokarev <[email protected]> Thu, 13 Aug 2026 09:16:49 +0300
### Old Ubuntu Delta ###
qemu (1:11.0.3+ds-2ubuntu2) stonking; urgency=medium
* d/{rules, hwe-helper/postrm-snippet}: add postrm hook to manage purge race
condition between base/hwe stacks (LP: #2164849)
* d/control-in: add versioned dependencies on ubuntu-virt
and ubuntu-helper-virt-hwe
* d/t/machinetypes: add test on ubuntu machine types
* d/qemu-kvm-init: remove kvm node setup (LP: #2157949)
This change is part of d/qemu-kvm-init: preparation script
-- Hector Cao <[email protected]> Tue, 25 Aug 2026 14:57:21
+0200
qemu (1:11.0.3+ds-2ubuntu1) stonking; urgency=medium
* Merge with Debian unstable (LP: #2153234). Remaining changes:
- Add qemu-kvm host preparation systemd unit
(LP 2157739 2033565)
+ d/qemu-kvm-init: preparation script (KVM modules, arch specifics)
+ d/qemu-system-common.qemu-kvm.service: systemd oneshot unit invoking
qemu-kvm-init
+ d/qemu-system-common.install: install helper script
+ d/rules: call dh_installinit and dh_installsystemd for qemu-kvm
- Ubuntu specific machine types
(LP 1304107 1621042 1776189 1761372 1761372 1776189 2131822)
+ d/p/ubuntu/define-ubuntu-machine-types.patch: define distro machine
types with release-versioned machine attributes; add the ubuntu-q35
alias selecting the most recent q35 ubuntu type; add v2 types for
arch_caps handling and to fix the questing type's wrong base version;
emit a hint when instantiating a now-unsupported old guest type
+ d/qemu-system-x86.NEWS: document the -hpb (huge-page-backed) type
- Enable nesting by default
+ d/p/ubuntu/enable-svm-by-default.patch: Enable nested svm by default
in qemu64 on amd
[ No more strictly needed, but required for backward compatibility ]
- d/rules: Use upstream vDSO on non-amd64 architectures and disable
upstream tests depending on qemu-system-data
- d/control-in: B-D on multipath libs for multipath persist in
qemu-pr-helper (LP 2117378)
- d/control-in: add dependencies to -hwe components (LP 2143146)
- d/p/u/lp2133188/*: Add riscv64 vector state to signal context
(LP 2133188)
- d/p/u/* : fix early stop for module loading function
(LP 2146445)
- Make Zicbop extension available in RISC-V KVM VMs (LP 2154708)
+ d/p/u/target-riscv-kvm-add-KVM-support-for-Zicbop-extensio.patch
* Dropped changes:
- d/control: remove dependency on deprecated edk2 arm
(LP 2145209)
[Fixed in Debian 1:11.0.0+ds-1]
- d/qemu-guest-agent.postinst: trigger udev rule to start the service
(LP 2102093)
[Fixed in Debian 1:11.0.0+ds-1]
- d/qemu-block-extra.postinst: Use latest Ubuntu's QEMU
package version when deciding whether to invoke
'deb-systemd-helper purge'.
[This can be dropped since we are after 26.04]
- tolerate ipxe size change on migrations to >=18.04 (LP 1713490)
+ d/p/ubuntu/pre-bionic-256k-ipxe-efi-roms.patch: old machine types
reference 256k path
+ d/control-in: depend on ipxe-qemu-256k-compat-efi-roms to be able to
handle incoming migrations from former releases.
[Machine type 2.10 is removed]
- Fix race condition when using iothreads and throttle groups (LP 2150154)
+ d/p/lp2150154-1-*.patch
[Fixed in upstream v11.0.0]
- Fix crash due to memory region unset for virgl (LP 2156706)
d/u/virtio-gpu-virgl-Add-virtio-gpu-virgl-hostmem-region.patch
[Fixed in upstream v11.0.0]
- d/control-in: breaks/replaces for dtb files moving qemu-system-misc
to qemu-system-data
[Can be dropped after 26.04]
- d/rules: Use upstream vDSO for architecture variant builds (LP 2131236)
[squashed to Use upstream vDSO on non-amd64 architectures]
- d/p/u/hw-acpi-correct-field-sequence-in-SPCR-table (LP 2146419)
[Fixed in upstream 11.0.3]
* The following bugs are fixed in the new merged Debian/Upstream version:
- s390x - interface hardening fixes (LP: #2160034)
[Fixed in upstream 11.0.3]
- Fix silent guest data loss during drive-mirror/blockdev-mirror/active
blockcommit startup race (LP: #2156307).
[Fixed in upstream 11.0.0]
- s390x: Make container ids in SysIB_15x 1-based (LP: #2164517)
[Fixed in upstream 11.0.2]
-- Hector Cao <[email protected]> Wed, 19 Aug 2026 19:21:41
+0200
** Affects: qemu (Ubuntu)
Importance: Wishlist
Status: New
** Tags: needs-merge upgrade-software-version
** Changed in: qemu (Ubuntu)
Importance: Undecided => Wishlist
** Changed in: qemu (Ubuntu)
Milestone: None => ubuntu-27.01
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171152
Title:
Merge qemu 1:11.1.2+ds-3 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2171152/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
