-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 11 Jun 2026 09:28:48 +0300 Source: qemu Architecture: source Version: 1:10.0.10+ds-0+deb13u1 Distribution: trixie Urgency: medium Maintainer: Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org> Changed-By: Michael Tokarev <mjt@tls.msk.ru> Closes: 1085299 1128478 1129349 1129604 1129605 Changes: qemu (1:10.0.10+ds-0+deb13u1) trixie; urgency=medium . * 10.0.10 upstream stable/bugfix release: - Update version for 10.0.10 release - block/graph-lock: fix missed wakeup in bdrv_graph_co_rdunlock() - block: Add more defaults to DEFAULT_BLOCK_CONF - block: Create DEFAULT_BLOCK_CONF macro - ide-test: Test reset during TRIM - ide-test: Factor out wait_dma_completion() - ide: Clean up ide_trim_co_entry() to be idiomatic coroutine code - ide: Minimal fix for deadlock between TRIM and drain - block: Add flags parameter to blk_*_pdiscard() - block: Add blk_co_start/end_request() and BDRV_REQ_NO_QUEUE - blkdebug: Add 'delay-ns' option - linux-user/sh4: Fix setup_sigtramp to match Linux kernel trampoline pattern - linux-user/sh4: Fix target_ucontext tuc_link field type - linux-user: Fix AT_EXECFN in AUXV for symlinked programs - hw/nvme: fix admin cq msix setup - tests/functional/qemu_test/asset.py: Don't use setxattr when it doesn't exist - meson.build: Add -fzero-init-padding-bits=all - hw/i2c/microbit_i2c: Don't index off end of twi_read_sequence[] - aspeed/hace: Prevent total_req_len overflow - aspeed/hace: Fix out-of-bounds read in has_padding() - hw/display/cirrus_vga: Fix packed-24 color-expansion transparent copies - hw/display/cirrus_vga: Fix packed-24 color-expansion transparent pattern fills - hw/ufs: Keep MCQ SQs alive while requests are outstanding - hw/ufs: Reject zero-depth MCQ queues - hw/ufs: Guard MCQ CQ accesses against missing queues - hw/ufs: Validate MCQ SQ references before use - hw/uefi: check auth.hdr_length minimum size (Closes: CVE-2026-8341) - hw/uefi: avoid possibly unaligned variable_auth_2 struct field access (Closes: CVE-2026-41440) - hw/uefi: verify data size before accessing it in wrap_pkcs7 (Closes: CVE-2026-41439) - hw/uefi: add name_size check to uefi_vars_mm_lock_variable() (Closes: CVE-2026-41438) - hw/uefi: fix ucs2 string helper functions (Closes: CVE-2026-41437) - hw/uefi: verify pio_xfer_offset before calculating buffer checksum (Closes: CVE-2026-41436) - hw/uefi: fix buffer overruns (Closes: CVE-2026-41435) - hw/misc/bcm2835_rng: Specify valid memory access sizes - target/arm: Report IL=0 for Thumb 16-bit BKPT insn - target/microblaze: Fix endianness used to disassemble - hw/intc/arm_gicv3: Fix NS write to ICC_AP1Rn_EL1 when prebits < 7 - hw/net/allwinner-sun8i-emac: Flush queued packets when rx is enabled - hw/ppc/e500: fix bus-frequency property hardcoded to zero in CPU FDT node - hw/ppc/e500: Move clock and TB frequency to machine class - tests/rcutorture: Fix build error - hw/intc/xics: Add a check for an invalid server id - linux-user: Translate errno in IP_RECVERR and IPV6_RECVERR - linux-user: Allow getsockopt() with NULL optval address - linux-user: Flush errors by using exit() instead of _exit() in error path - linux-user: Add missing CDROM ioctls - target/riscv: Use ELEN for Fractional LMUL check - target/riscv: Don't OR mip.SEIP when mvien is one - target/riscv: Generate access fault if sc comparison fails - riscv_htif: reject invalid signature ranges (end <= begin) - hw/intc: fix heap OOB in ACLINT MTIMER multi-socket - target/riscv: fix stale ptshift and base on page walk restart - hw/riscv/virt-acpi-build.c: Use kvm timer frequency when kvm enabled - linux-user: Flush errors by using exit() instead of _exit() in error path - linux-user: Use abi_int for imr_ifindex in ip_mreqn struct - linux-user: Fix CLONE_PARENT_SETTID when using fork-like clone - linux-user: Add getsockopt() for SO_RCVTIMEO_NEW and SO_SNDTIMEO_NEW - linux-user: Add setsockopt() for SO_RCVTIMEO_NEW and SO_SNDTIMEO_NEW - linux-user: Define SO_TIMESTAMP*_NEW and SO_RCVTIMEIO_NEW - linux-user/mips: sync k0 TLS for EF_MIPS_MACH_OCTEON userlands - linux-user/strace: Use pointer type for read and write values - linux-user/arm/nwfpe: Use thread-local storage for qemufpa - linux-user/arm/nwfpe: Replace user_registers with current_cpu - linux-user: Don't define target_stat64 struct for loongarch64 - linux-user: fix off-by-one in host_to_target_for_each_rtattr() - linux-user/ppc: Fix ppc64 rt_sigframe stack offset - hw/sh4/sh7750: Remove forgotten abort() in the MM_ITLB_DATA handler - hw/misc: Fix the valid access size to the avr-power device - migration: vmstate_save_state_v: fix double error_setg - hw/display: don't accidentally autofree existing virgl resources (Closes: CVE-2026-6502) - meson: add missing semicolon in pthread_condattr_setclock test - target/i386/tcg: fix decoding of MOVBE and CRC32 in 16-bit mode - target/i386: fix missing PF_INSTR in SIGSEGV context - target/i386: fix strList leak in x86_cpu_get_unavailable_features - target/arm/tcg/translate.c: remove MO_TE usage - ui/console-vc: fix off-by-one in CSI J 2 (clear entire screen) - ui/spice-app: detect runtime directory creation failures - serial COM: windows serial COM PollingFunc don't sleep - util/cutils: Fix heap corruption under Windows - virtio-blk: fix zone report buffer out-of-memory (Closes: CVE-2026-5761) - qemu-keymap: fix altgr modifier lookup for newer xkeyboard-config - hw/uefi: fix heap overflow (Closes: CVE-2026-5744) - virtio-scsi: pass the same cdb_size to virtio_scsi_pop_req and virtio_scsi_handle_cmd_req_prepare (Closes: CVE-2026-5763) - util/readline: Fix out-of-bounds access in readline_insert_char() - target/arm: fix fault_s1ns for stage 2 faults - target/arm: do_ats_write(): avoid assertion when ptw failed - bsd-user, linux-user: signal: recursive signal delivery fix - linux-user: Make openat2() use -L for absolute paths - linux-user: update select timeout writeback - linux-user: fix name_to_handle_at when AT_HANDLE_MNT_ID_UNIQUE flag is set - util: fix missing aio_wait sym in qemu guest agent only build - monitor: Fix deadlock in monitor_cleanup - scsi: Don't consider LOGICAL UNIT NOT SUPPORTED guest recoverable - ide: Fix potential assertion failure on VM stop for PIO read error - ui/vnc-jobs: fix VncRectEntry leak on job cleanup - hw/net/rocker: Avoid double-free of l2_flood.group_ids - lsi53c895a: keep SCSIRequest alive during DMA - lsi53c895a: keep lsi_request alive as long as the SCSIRequest - lsi53c895a: keep lsi_request and SCSIRequest in local variables - lsi53c895a: do not do anything else if a reset is requested by writing ISTAT0 - lsi53c895a: keep a reference to the device while SCRIPTS execute (Closes: #1085299, CVE-2024-6519) - scripts/qemu-guest-agent/fsfreeze-hook: Fix syslog-fallback logic - scripts/qemu-guest-agent/fsfreeze-hook: Avoid use of PIPESTATUS - scripts/qemu-guest-agent/fsfreeze-hook: Avoid bash-isms - hw/nvme: fix heap-buffer-overflow in nvme_abort - hw/nvme: re-enable wzds bit in namespace dlfeat - tcg: Pass host-endian values to plugin_gen_mem_callbacks_* - hw/audio/sb16: validate VMState fields in post_load - block/curl: free s->password in cleanup paths - linux-aio: Resubmit tails of short reads/writes - linux-aio: Put all parameters into qemu_laiocb - hw/dma/pl080: Fix transfer logic in PL080 - linux-user/i386/signal.c: Correct definition of target_fpstate_32 - hw/ssi/aspeed_smc: Convert mem ops to read/write_with_attrs for error handling - hw/net/ftgmac100: Improve DMA error handling - hw/usb/hcd-ohci: check for MPS=0 to avoid infinite loop (Closes: CVE-2026-3890) - rust: suggest passing --locked to "cargo install" - target/riscv: rvv: Fix page probe issues in vext_ldff - target/riscv: rvv: Fix missing flags merge in probe_pages for cross-page accesses - Expand the probe_pages helper function to handle probe flags - block: Drop detach_subchain for bdrv_replace_node - virtio-gpu: fix overflow check when allocating 2d image (Closes: CVE-2026-3886) - io: Fix TLS bye task leak - ppc/pnv: generate dtb after machine initialization is complete - ppc/pnv: fix dumpdtb option - block/mirror: fix assertion failure upon duplicate complete for job using 'replaces' - throttle-group: Fix race condition in throttle_group_restart_queue() - target/i386: fix NULL pointer dereference in legacy-cache=off handling - hw/dma/pl080: Ignore bottom 2 bits of LLI register - hw/dma/pl080: Update interrupts after pl080_run() - hw/dma/pl080: Handle bogus swidth and dwidth in transfers - linux-user: fix mremap with old_size=0 for shared mappings - linux-user: Fix zero_bss for RX PT_LOAD segments - hw/net/rtl8319: Work around GCC sanitizer / -Wstringop-overflow bug . * 10.0.9 stable/bugfix release: - Update version for 10.0.9 release - hyperv/syndbg: check length returned by cpu_physical_memory_map() (Closes: CVE-2026-3842) - fuse: Copy write buffer content before polling - target/loongarch: Avoid recursive PNX exception on CSR_BADI fetch - target/loongarch: Preserve PTE permission bits in LDPTE - hw/net/npcm_gmac: Catch accesses off the end of the register array - linux-user: fix TIOCGSID ioctl - tests/tcg/multiarch/test-mmap: Check mmaps beyond reserved_va - bsd-user: Deal with mmap where start > reserved_va - linux-user: Deal with mmap where start > reserved_va - hw/net/xilinx_ethlite: Check for oversized TX packets - virtio-gpu: Ensure BHs are invoked only from main-loop thread - block/nfs: Do not enter coroutine from CB - block: Never drop BLOCK_IO_ERROR with action=stop for rate limiting - block/throttle-groups: fix deadlock with iolimits and muliple iothreads - mirror: Fix missed dirty bitmap writes during startup (Closes: #1129349) - block/curl: fix concurrent completion handling - block/vmdk: fix OOB read in vmdk_read_extent() (Closes: #1128478, CVE-2026-2243) - hw/net/smc91c111: Don't allow negative-length packets - io: fix cleanup for websock I/O source data on cancellation - io: fix cleanup for TLS I/O source data on cancellation - io: separate freeing of tasks from marking them as complete - target/i386/hvf/x86_mmu: Fix compiler warning - hw/i386/vmmouse: Fix hypercall clobbers - tests/docker: upgrade most non-lcitool debian tests to debian 13 - hw/9pfs: fix missing EOPNOTSUPP on Twstat and Trenameat for fs synth driver - hw/9pfs: fix data race in v9fs_mark_fids_unreclaim() - target/arm: set the correct TI bits for WFIT traps - hw/ssi/xilinx_spips: Reset TX FIFO in reset - hw/misc/virt_ctrl: Fix incorrect trace event in read operation - virtio-snd: tighten read amount in in_cb (Closes: #1129604, CVE-2026-3195) - virtio-snd: fix max_size bounds check in input cb (Closes: #1129604, CVE-2026-3195) - virtio-snd: handle 5.14.6.2 for PCM_INFO properly (Closes: #1129605, CVE-2026-3196) - virtio-snd: remove TODO comments - virtio-gpu-virgl: Add virtio-gpu-virgl-hostmem-region type (was in virtio-gpu-virgl-Add-virtio-gpu-virgl-hostmem-region.patch) - target/arm: Fix feature check in DO_SVE2_RRX, DO_SVE2_RRX_TB - target/arm: Account for SME in aarch64_sve_narrow_vq() assertion - target/arm: Introduce ARMCPU.sme_max_vq - hw/i2c/aspeed_i2c: Fix out-of-bounds read in I2C MMIO handlers - docs/about/emulation: Add documentation for hotblocks plugin arguments - contrib/plugins/hotblocks: Print uint64_t with PRIu64 rather than PRId64 - contrib/plugins/hotblocks: Fix off by one error in iteration of sorted blocks - contrib/plugins/hotblocks: Correctly free sorted counts list - contrib/plugins: Fix type conflict of GLib function pointers - python: drop uses of pkg_resources - plugins: fix cross-build using LLVM for Windows targets - s390x/pci: Fix endianness for zPCI BAR values Checksums-Sha1: 6d489125e6cf4c2fd5ee94506bae5b6b6b77c0d2 12560 qemu_10.0.10+ds-0+deb13u1.dsc fed5a9ddccdf09002a8f26dc442936c6e4b7d09a 39979984 qemu_10.0.10+ds.orig.tar.xz 8ccd8eedcdbed7af6bd49da1f7dec25c05a4826e 148364 qemu_10.0.10+ds-0+deb13u1.debian.tar.xz 41e9f20c4e82591fc5c869c8cdbaffdfa56c5397 8302 qemu_10.0.10+ds-0+deb13u1_source.buildinfo Checksums-Sha256: 0a3a55cf1c9ab05709708abacc79a50309dbe5f9c711e0d40dd4bf5220d3ae7a 12560 qemu_10.0.10+ds-0+deb13u1.dsc fdf3f4dd475cd7771db0407556cd98b3adcdc0a3a0cba1b5b93b320f3d1a135e 39979984 qemu_10.0.10+ds.orig.tar.xz 9f6ab62c7f079e62571ebffada243c95ca042b56a9535e90508bf76fff116c24 148364 qemu_10.0.10+ds-0+deb13u1.debian.tar.xz d083764143a64b95aaa9cf9b78e63d09e4608d182c8dcf4132e0cc025c7f2e20 8302 qemu_10.0.10+ds-0+deb13u1_source.buildinfo Files: 7ac7978c2eb405bbae7ca645bb0c3dd8 12560 otherosfs optional qemu_10.0.10+ds-0+deb13u1.dsc 77d77a340cd841ad86bdbfc481ca5a4e 39979984 otherosfs optional qemu_10.0.10+ds.orig.tar.xz 9f693854cde70a1ca83283207371117b 148364 otherosfs optional qemu_10.0.10+ds-0+deb13u1.debian.tar.xz 29bf446853b3e68c7ccf40025a64eacf 8302 otherosfs optional qemu_10.0.10+ds-0+deb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- wsG7BAEBCgBvBYJqKldWCRCCqkokOx6UeEcUAAAAAAAeACBzYWx0QG5vdGF0aW9u cy5zZXF1b2lhLXBncC5vcmcQ1YAfzOvxi3ZrsY2/KfmwaggbYPLTkKrHt/UDt4BZ SxYhBGSqKrUx1WkDNmv++YKqSiQ7HpR4AAClBhAAxARDk60LxvR5RWSKy5LhNvqY aUOuQ0dfLqjfjZfiZ5Je/geIlPAooI0PvJASmk/F9/o+7Jdwlpkuawo44ue6LtXN iduH/Qx6dC8iFHJKtGgdz2eqelSbh2gNpFXDoryirVvOwOy0NlHULjSgP0jA3ua4 6NI/csXCJIUjQ0dd6i07TsuZV+mfCIkuWcWega7FWr96sbzud/bsUMSf8pmx0b12 FrmX3RVHvJUeD8ID/pd8YSQUMrVW5RrQHRZFivfcCvVthWcL/1rr37N41L+GGW87 z+WEzXvYztN8P4EVsLC53Yo+LEiKV2DNXwTZgKDnB56Si8yFMqpdov+6lT+IG4MP oLB7o2jjBNgg2uX7vUCk3DIu2XgCz+mjTiUXXhcuR4mfTBDuqF1wBsNJwOBfQSfV jE8njKzRU78MFobLpoakVe1JoKVAdnoBTTOngfa0V5LXavTUouyxqYKEJbcIydSV 6xJP3alYNoBV3cOp3pYXrHiOB8NiA2iQTjAGG+BKgm0Bm6wJFtSU7jVojt581VrI +3lXeq5sFZhut06rp3ZXGBcfe0QuSfpqCX0e0pv5OAeYOZr+KeIwIAUN4vTIegFD CaOraGjTHPR7tgHrIPJ2w1+9EhSwZ/rmy9wkSGP/CiATq5R6eWFuzMKsIS4u/LDQ QRF4pU0mu10oTzihdr8= =3cRM -----END PGP SIGNATURE-----
