Accepted xen 4.20.3+127-gc42374a105-1 (source) into unstable

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 28 Jul 2026 20:42:50 +0200
Source: xen
Architecture: source
Version: 4.20.3+127-gc42374a105-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Xen Team <pkg-xen-devel@lists.alioth.debian.org>
Changed-By: Hans van Kranenburg <hans@knorrie.org>
Closes: 1129037
Changes:
 xen (4.20.3+127-gc42374a105-1) unstable; urgency=medium
 .
   * Update to new upstream version 4.20.3+127-gc42374a105, which also contains
     security fixes for the following issues:
     (Closes: #1129037)
     - Use after free of paging structures in EPT
       XSA-480 CVE-2026-23554
     - Xenstored DoS by unprivileged domain
       XSA-481 CVE-2026-23555
     - oxenstored keeps quota related use counts across domain destruction
       XSA-483 CVE-2026-23556
     - Xenstored DoS via XS_RESET_WATCHES command
       XSA-484 CVE-2026-23557
     - grant table v2 race in status page mapping
       XSA-486 CVE-2026-23558
     - x86: Floating Point Divider State Sampling
       XSA-488 CVE-2025-54505
     - x86: CPU Opcode Cache corruption
       XSA-490 CVE-2025-54518
     - x86 HVM I/O port list traversal
       XSA-491 CVE-2026-42487
     - domctl lock open to abuse
       XSA-492 CVE-2026-42489 CVE-2026-42490
     - Arm: Completion of memory accesses not guaranteed by completion of a TLBI
       XSA-493 CVE-2025-10263
     - x86: mismatched mapcache metadata
       XSA-494 CVE-2026-42488
     - x86 shadow paging is deprecated
       XSA-495 CVE-2026-42493
     - buffer overruns in libfsimage iso9660 handling
       XSA-497 CVE-2026-42494 CVE-2026-42495 CVE-2026-62423 CVE-2026-62424 CVE-2026-62425
     - sysctl and platform-op locks open to abuse
       XSA-499 CVE-2026-62426 CVE-2026-62427
     - grant-table: type confusion in grant-copy
       XSA-500 CVE-2026-62428
     - grant-table: version change racing with other operations
       XSA-501 CVE-2026-62435 CVE-2026-62436
     - vNUMA domain cleanup may race other operations
       XSA-502 CVE-2026-62429
     - x86: Out-of-bounds read in vRTC emulation
       XSA-503 CVE-2026-62430
     - Viridian STIMER division by zero
       XSA-504 CVE-2026-62431
     - evtchn: Race between FIFO expand and reset
       XSA-505 CVE-2026-62432
     - correct buffer checks for DM_OP hypercalls
       XSA-506 CVE-2026-62433
     - PoD: Don't try to reclaim special pages
       XSA-507 CVE-2026-62434
     - pygrub: security-supported only when run de-privileged
       XSA-508
   * Drop the following patches which are now included upstream:
     - ARM: Drop ThumbEE support
     - xen/arm: Set ThumbEE as not present in PFR0
   * Note that the following XSA are not listed, because...
     - XSA-482 has patches for the Linux kernel
     - XSA-485 has patches for the Linux kernel
     - XSA-487 has patches for the Linux kernel
     - XSA-489 applies to XAPI which is not included in Debian
     - XSA-496 only applies to Xen 4.21 and later
     - XSA-498 applies to XAPI which is not included in Debian
Checksums-Sha1:
 7eb0d2019ed088ce46154441d0396c8c2037c977 4154 xen_4.20.3+127-gc42374a105-1.dsc
 db72543f43aa34ac8976c1de1a5ac1746006dc43 4961352 xen_4.20.3+127-gc42374a105.orig.tar.xz
 a5c96e34735baae759dbe47eb26f2c420986441e 139540 xen_4.20.3+127-gc42374a105-1.debian.tar.xz
Checksums-Sha256:
 74299b01a9855f780d8e0b31d56a1bc27f776d73a1926456cac860f3adde48a2 4154 xen_4.20.3+127-gc42374a105-1.dsc
 df0831854a55a8f31cb3cb85036f2edc928e2ef098d77f815f5714bfafac68f3 4961352 xen_4.20.3+127-gc42374a105.orig.tar.xz
 96d44c57b99010618402d0762e3579a58e32c544e3afbe4edb254edb5b96f653 139540 xen_4.20.3+127-gc42374a105-1.debian.tar.xz
Files:
 4b160e197677b6f97da856ca2758f017 4154 admin optional xen_4.20.3+127-gc42374a105-1.dsc
 9b708a84bd7cbcb4483cf794a3672991 4961352 admin optional xen_4.20.3+127-gc42374a105.orig.tar.xz
 b36c7b8aff830ffd648ffb3ee21172d7 139540 admin optional xen_4.20.3+127-gc42374a105-1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEESWyddwNaG9637koYssHfcmNhX2wFAmppK18ACgkQssHfcmNh
X2z+eA//Zx48n3To5xItLaNhrzG3V9wJ+s//wPCOFUHCUhdLVsFwQ8OQzszpTlUx
POmqQ33c+5gYSc0tOxCQNG1bGEROCnbdVLC2/HV0s3oAr/lR+MBv+kmqFir1jqo3
pqoGGBV11rZvAp8sXXjPlQMg0B1nSIDEBGKhXVqrgDIzQMeWcpvv5WZVhaqkRZxW
LsRVBj3MQe+Qfeo3hIjRoKXtE0LjPmLYDmhqDDVpn6LnYzxZ9jgeTmohk2eX2+Yy
uheY0S6CbliGIFdjVJJsR+Hx5hx9MNWXf7r7yrIQOrJ7k9mlACzC8+Ib6q02heyJ
9kunQ5hkUqEJz0FP2XmAxE9nxP8ygM0BYbZENlFHI3BzXRtQpqnMwH9mYYXKO4rW
l9iP96bU7TjyJiW4uW5dAZJRSF6h0lQLegH8G98HW9cJFlPcQ8Tru/XxsSwMs/Bh
hRCdRj5XL7Ol3olK07fuAaln/vtkgqhGtr+yw0hZzuFPa4u6K6etKS3dzDA9zk0U
u0ySShk0TOIsNbhmd1x/jH2UfSY3bhV5r1Q7ahoRPhQqcu5JYmK7BJgn6IjNZ7w9
38L+O2zRynSo5TevQzjR+Viskd5BlgtUguXU5aK+eFZ0u3XI6tJHed3Ka4od3pDQ
GX2AzFEOUz+Idc2mU2H0YxgLjT75xtWbM1FYL3Mny0NmMl6Y1f0=
=4J0B
-----END PGP SIGNATURE-----