-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 29 Aug 2026 20:55:40 +0300
Source: qemu
Architecture: source
Version: 1:10.0.13+ds-0+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Changes:
qemu (1:10.0.13+ds-0+deb13u1) trixie; urgency=medium
.
* new upstream stable/bugfix release, including multiple security fixes:
- Update version for 10.0.13 release
- target/riscv/tcg: sret in virtual user mode
raises virtual instruction exception
https://gitlab.com/qemu-project/qemu/-/work_items/3622
- target/riscv: enforce even register constraints for Zdinx fcvt pairs
https://gitlab.com/qemu-project/qemu/-/work_items/4109
- target/riscv: reject FMV.X.W/FMV.W.X under Zfinx
https://gitlab.com/qemu-project/qemu/-/work_items/4108
- target/riscv: honor zicbo* envcfg gating in linux-user mode
https://gitlab.com/qemu-project/qemu/-/work_items/4107
- disas/riscv: Fix typo in th.lbib format
- disas/riscv: Fix isa decoding of rev8
- disas/riscv: Fix rv32 encoding of zext.h
- target/riscv: allow menvcfg/henvcfg LPE and SSE bits on RV32
https://gitlab.com/qemu-project/qemu/-/work_items/4045
- hw/riscv/riscv-iommu: preserve requested perm in spa_fetch()
- hw/riscv/riscv-iommu: fix U-bit check to apply only to
leaf S/VS-stage PTEs
- disas/riscv: Decode unsigned vector immediates as unsigned
- disas/riscv: Use signed type for vector immediates
- disas/riscv: Fix 6-bit immediate extraction
- disas/riscv: Fix th.srri decoding
- target/riscv: use SXL instead of MXL for read_sstatus
- target/riscv: Fix PC sync in trans_sspopchk for CFI exception handling
https://gitlab.com/qemu-project/qemu/-/work_items/4118
- hw/watchdog: Add lower bound check for watchdogNumber
https://gitlab.com/qemu-project/qemu/-/work_items/3600
- tcg: Export tcg_gen_ussub_i{32,64,tl}
- tcg: Defer tb_flush when initial thread region alloc fails
https://gitlab.com/qemu-project/qemu/-/work_items/2984
- tcg: Return success from tcg_region_alloc
- tcg: Return success from tcg_region_alloc__locked
- target/loongarch: check FPE before reading fcc in bceqz/bcnez
https://gitlab.com/qemu-project/qemu/-/work_items/4209
- meson: make linker warnings non-fatal on Linux
- serial: clear transmit retry callback on unrealize
https://gitlab.com/qemu-project/qemu/-/work_items/4125
- target/i386: decode opcode extensions group 3 /1 as TEST
https://gitlab.com/qemu-project/qemu/-/work_items/3580
- target/i386: allow transition to virtual-8086 mode
only if CPL == 0 and CPU is not in long mode
https://gitlab.com/qemu-project/qemu/-/work_items/3583
- target/i386: fix long mode segment override prefix decoding
https://gitlab.com/qemu-project/qemu/-/work_items/3391
- target/i386: fix incorrect decoding of EXTRQ_i
https://gitlab.com/qemu-project/qemu/-/work_items/3611
- target/i386: Clear OF, SF, and AF for fcomi/fucomi
https://gitlab.com/qemu-project/qemu/-/work_items/4133
- target/i386: Use correct type for get_float_exception_flags() values
- tcg/optimize: Fix s_mask computation for shifts
- tcg/optimize: INDEX_op_mul is commutative
- hw/elf_ops: defend against weird elf headers
- hw/nvme: add SPDM_SOCKET Kconfig dependency
- hw/block/pflash_cfi01: Restore ROMD mode after migration
https://gitlab.com/qemu-project/qemu/-/work_items/4042
- hw/net/rtl8139: Send whole of vlan-tagged packet when doing loopback
- hw/net/rtl8139: Fix handling of VLAN tags on incoming short packets
https://gitlab.com/qemu-project/qemu/-/work_items/3518
- tests/qtest/ahci: regression test for ATAPI read vs. drain
- hw/ide/atapi: read the whole elementary transfer asynchronously
- tests/qtest/ahci: cover raw (2352-byte) ATAPI CD reads
- tests/qtest/libqos/ahci: support raw (2352-byte) READ CD
- tests/qtest/ide-test: cover raw (2352-byte) ATAPI CD reads
- tests/qtest/ide-test: add a multi-sector ATAPI DMA read test
- tests/qtest/ide-test: parametrize the ATAPI CD-ROM read test
- hw/net/vmxnet3: Do not abort if guest provides bad interrupt numbers
https://gitlab.com/qemu-project/qemu/-/work_items/539
- hw/usb/dev-uas: Don't abort if guest provided an undersized buffer
for status
https://gitlab.com/qemu-project/qemu/-/work_items/3900
- hw/intc/loongarch_pch_pic: Validate htmsi_vector before indexing
parent_irq
https://gitlab.com/qemu-project/qemu/-/work_items/4114
- migration/multifd: Replace assert() with error_setg() in recv paths
- migration/multifd: Validate next_packet_size in zlib/zstd recv
https://gitlab.com/qemu-project/qemu/-/work_items/3737
- tests/tcg/s390x: Test STCKF condition code on a faulting store
- target/s390x/tcg: Set STCK/STCKF condition code after the store
- pc-bios/s390-ccw.img: update s390x bios
- pc-bios/s390-ccw: bound zipl menu strlen and replace VLA
in zipl_print_entry
- pc-bios/s390-ccw: bounds-check zipl menu entry index before array write
- pc-bios/s390-ccw: fix out-of-bounds read in iso_get_file_size()
- s390x/ipl: validate num_comp against iplb length before iterating
- hw/char/sclpconsole-lm: avoid guest triggerable assert
- tests/tcg/s390x: Test DR overflow (INT64_MIN / -1)
- target/s390x: Fix DR/D INT64_MIN / -1 host crash
- tests/tcg/s390x: Test PRNO TRNG interruptibility
- target/s390x: Make PRNO TRNG interruptible
- target/s390x: Have MSA helper pass a mmu_idx argument
- hw/arm/aspeed: Add missing Kconfig dependencies on required components
- linux-user: implement mount_setattr(2)
- linux-user/sh4: Fix crashes on signal delivery in conditional delay slot
- linux-user/sh4: Initialize the FPSCR register on signal
- linux-user/sh4: Deliver SIGILL on invalid instruction
- gitlab: disable provenance attestations to work around CI bug
- hw/nvme: fix leak on copy ranges
- hw/nvme: cancel inflight requests on controller reset
https://gitlab.com/qemu-project/qemu/-/work_items/3398
https://gitlab.com/qemu-project/qemu/-/work_items/3883
https://gitlab.com/qemu-project/qemu/-/work_items/4068
https://gitlab.com/qemu-project/qemu/-/work_items/4072
- hw/nvme: factor out nvme_sq_cancel_inflight()
- hw/nvme: drop AER requests without aiocb in nvme_del_sq()
- hw/display/virtio-gpu: Unmap DMA regions on reset
https://gitlab.com/qemu-project/qemu/-/work_items/3467
- hw/display/virtio-gpu: Always reject invalid scanout bounds
- virtio-gpu: reject requests with short/truncated control headers
Closes: CVE-2026-18054
- hw/display/virtio-gpu: fix offset wraparound in scanout_blob_to_fb
- vhost-user-gpu: fix integer overflow in buffer allocation
Closes: CVE-2026-15264
- hw/display/vga: fix panning_buf OOB after text/graphics switch
https://gitlab.com/qemu-project/qemu/-/work_items/4085
Closes: CVE-2026-17516
- hw/display/virtio-gpu: validate blob iov size
https://gitlab.com/qemu-project/qemu/-/work_items/3945
Closes: CVE-2026-66021
- coroutine: fix lost wakeup in qemu_co_sleep_wake()
- iotests: run the test pool with the 'fork' start method
- qcow2: do not try to clear the dirty bit on a read-only node
- dmg: reject inconsistent UDRW chunk sector count and length
https://gitlab.com/qemu-project/qemu/-/work_items/3846
Closes: CVE-2026-65928
- dmg: refuse to open files with no chunks
https://gitlab.com/qemu-project/qemu/-/work_items/4021
- dmg: fix out-of-bounds load in search_chunk()
https://gitlab.com/qemu-project/qemu/-/work_items/3844
Closes: CVE-2026-65929
- tests/unit: add reproducer for BlockAcctStats histogram locking race
- block/qapi: take stats->lock when reading BlockAcctStats
for query-blockstats
- block/accounting: take stats->lock in latency histogram setters
- block: Fix crash after setting latency historygram with single bin
- block/cloop: fix integer overflow in total_sectors calculation
- linux-user: fix incorrect msg_l[sr]pid members of target_msqid_ds
- linux-user: Fix msqid_ds struct wrt 32-bit big endian architectures
- hw/nvme: fix assertion failure on subregion removal
- hw/nvme: fix unintentional integer overflow in shift
- hw/nvme: fix cross-namespace copy dif buffer overflow
- virtio-mmio: fix QUEUE_NUM_MAX
https://gitlab.com/qemu-project/qemu/-/work_items/3882
Closes: CVE-2026-50626
- hw/display/exynos4210_fimd: Clamp windows to screen size
https://gitlab.com/qemu-project/qemu/-/work_items/3795
- hw/display/exynos4210_fimd: Pass width to draw_line functions
- hw/display/exynos4210_fimd: Factor out finding screen width/height
- hw/i2c/bcm2835_i2c: Correct CLKT register offset
- linux-user/sh4: allow full 32-bit address space
- target/sparc: set reg window data structures currently
after vmstate load
- hw/net/igb: recalculate rx_desc_len on migration load
- hw/net/e1000e: recalculate rx_desc_len on migration load
- linux-user: fix guards for the fsmount(2) syscall series
- hw/net/xilinx_axienet: Don't write checksums off end of packet
- linux-user: Guard local FUTEX_CMD_MASK definition
- virtio: avoid packed vring virtio_queue_empty() infinite loops
https://gitlab.com/qemu-project/qemu/-/work_items/3968
Closes: CVE-2026-16457
- backends/rng: cap request size to avoid oversized allocation
https://gitlab.com/qemu-project/qemu/-/work_items/3983
- hw/virtio-rng: Fix host use-after-free
https://gitlab.com/qemu-project/qemu/-/work_items/3917
Closes: CVE-2026-50624
- hw/net/virtio-net: Protect from DMA re-entrancy bugs
https://gitlab.com/qemu-project/qemu/-/work_items/4073
Closes: CVE-2026-66022 (again)
- intel_iommu: Check address mask before using it in
pasid-based iotlb invalidation
https://gitlab.com/qemu-project/qemu/-/work_items/3619
- hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle
- hw/virtio/vdpa-dev: pass set_config buffer to vhost backend
- hw/pci-host/q35.c: Avoid early return in mch_write_config()
- hw/pci-host/q35.c: Factor out creation of SMRAM MRs
- hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled
- virtio-iommu: fix OOM due to unbounded call_rcu
- libvduse: validate vq size
https://gitlab.com/qemu-project/qemu/-/work_items/3652
Closes: CVE-2026-61402
- libvhost-user: fix heap overflow in vu_check_queue_inflights
https://gitlab.com/qemu-project/qemu/-/work_items/3974
Closes: CVE-2026-63110
- libvhost-user: validate last_batch_head in vu_check_queue_inflights
https://gitlab.com/qemu-project/qemu/-/work_items/3974
- virtio-pmem: wait for flush requests on unrealize
https://gitlab.com/qemu-project/qemu/-/work_items/3938
Closes: CVE-2026-63323
- vhost-user: assert nregions within limit
https://gitlab.com/qemu-project/qemu/-/work_items/3910
- virtio: fail early on bad config_len in migration
https://gitlab.com/qemu-project/qemu/-/work_items/3891
- virtio-scsi: fix SCSIRequest leak on a bad request
https://gitlab.com/qemu-project/qemu/-/work_items/3875
Closes: CVE-2026-61476
- vhost: do not crash on ring map failure
https://gitlab.com/qemu-project/qemu/-/work_items/3783
- hw/virtio: reject zero-length packed indirect descriptor table
https://gitlab.com/qemu-project/qemu/-/work_items/3984
- libvhost-user: protect against OOB vring queue access
https://gitlab.com/qemu-project/qemu/-/work_items/3741
- libvhost-user: protect against OOB writes in vu_set_inflight_fd
https://gitlab.com/qemu-project/qemu/-/work_items/3740
- virtio-net: fix short frame OOB read in receive_filter()
https://gitlab.com/qemu-project/qemu/-/work_items/3626
Closes: CVE-2026-63320
- virtio-net: fix OOB read in RSC receive path
https://gitlab.com/qemu-project/qemu/-/work_items/3623
Closes: CVE-2026-63321
- hw/display/virtio-gpu: Block Rutabaga migration
- rutabaga: improve error handling, fix potential crash during init
- hw/display/virtio-gpu: Initialize blob mapping for ATTACH_BACKING
- hw/display/virtio-gpu: Fix empty blob discrimination
- virtio-gpu: fix NULL deref in rutabaga set_scanout
https://gitlab.com/qemu-project/qemu/-/work_items/3897
- target/i386/sev: fix MemoryRegion reference leaks in gpa2hva callers
- net/colo: fix g_hash_table_destroy assertion on uninitialized filter
- hw/display/qxl: unregister vm_change_state handler and BHs
https://gitlab.com/qemu-project/qemu/-/work_items/3607
Closes: CVE-2026-63322
- ui/vnc: remove redundant rows computation
- hw/display/vhost-user-gpu: validate message payload sizes
https://gitlab.com/qemu-project/qemu/-/work_items/3866
- hw/display/virtio-gpu: Remove the bytes_pp field
- hw/display/virtio-gpu: reject strides exceeding INT_MAX
- hw/display/virtio-gpu: validate stride against width on scanout
https://gitlab.com/qemu-project/qemu/-/work_items/3989
Closes: CVE-2026-63109
- hw/usb/hcd-xhci: Check return value of xhci_xfer_create_sgl()
for errors
https://gitlab.com/qemu-project/qemu/-/work_items/3786
- hw/usb/core: Avoid possible assert() in do_parameter() -->
usb_packet_copy()
https://gitlab.com/qemu-project/qemu/-/work_items/3746
- hw/ide/core: Fix possible crash via NULL pointer
in ide_cancel_dma_sync()
https://gitlab.com/qemu-project/qemu/-/work_items/905
https://gitlab.com/qemu-project/qemu/-/work_items/4052
- hw/usb/dev-uas: Fix guest-triggerable heap OOB access
https://gitlab.com/qemu-project/qemu/-/work_items/3612
https://gitlab.com/qemu-project/qemu/-/work_items/3986
- hw/9pfs/xen: drain in-flight PDUs before xen-9p disconnect
- hw/9pfs/virtio: drain in-flight PDUs before virtio-9p unrealize
https://gitlab.com/qemu-project/qemu/-/work_items/3937
- hw/9pfs: fix O_TRUNC bypass on read-only export
https://gitlab.com/qemu-project/qemu/-/work_items/4000
Closes: CVE-2026-63318
- hw/display/vmware_vga: Don't allow guest to trigger
long running loop in host
https://gitlab.com/qemu-project/qemu/-/work_items/3782
https://gitlab.com/qemu-project/qemu/-/work_items/4026
https://gitlab.com/qemu-project/qemu/-/work_items/4076
- hw/ide: replace assert with proper error handling
https://gitlab.com/qemu-project/qemu/-/work_items/2777
- scsi-disk: fix off by one in assertion
- scsi-disk: protect against guest sending truncated data
for MODE SELECT commands
https://gitlab.com/qemu-project/qemu/-/work_items/4051
- target/i386: helper_sysret(): Check that RCX contains
a canonical address when emulating an Intel CPU
https://gitlab.com/qemu-project/qemu/-/work_items/3223
- vfio/pci: reject invalid PCI_INTERRUPT_PIN values
- vfio/pci: don't narrow a failed config read to a plausible value
- vfio/igd: Clear saved BDSM in legacy VBIOS ROM at load time
https://gitlab.com/qemu-project/qemu/-/work_items/3093
- vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom()
- hw/uefi: make SetupMode read-only
https://gitlab.com/qemu-project/qemu/-/work_items/4039
Closes: CVE-2026-16288
- hw/uefi: add post_load checks
https://gitlab.com/qemu-project/qemu/-/work_items/3837
https://gitlab.com/qemu-project/qemu/-/work_items/3838
https://gitlab.com/qemu-project/qemu/-/work_items/3839
https://gitlab.com/qemu-project/qemu/-/work_items/3885
Closes: CVE-2026-61404
- hw/uefi: account variable policy entries against storage size
https://gitlab.com/qemu-project/qemu/-/work_items/3890
Closes: CVE-2026-61405
- hw/uefi: check lower limit for signature list size
https://gitlab.com/qemu-project/qemu/-/work_items/3899
Closes: CVE-2026-61406
- hw/uefi: remove debug function
https://gitlab.com/qemu-project/qemu/-/work_items/3615
Closes: CVE-2026-58582
- hw/uefi: add sanity check
https://gitlab.com/qemu-project/qemu/-/work_items/3614
Closes: CVE-2026-58581
Checksums-Sha1:
ee492e23d8ae66376de7a301c7cb535df8228811 12462 qemu_10.0.13+ds-0+deb13u1.dsc
7617726069d7b00c2b7bd10aea8077b005913e5f 40010016 qemu_10.0.13+ds.orig.tar.xz
8fd7672ce97e1b93405e6cb71e183158f87b6ff3 156096 qemu_10.0.13+ds-0+deb13u1.debian.tar.xz
0e7633b9655508c772d0c896e010bfafbf24b189 7838 qemu_10.0.13+ds-0+deb13u1_source.buildinfo
Checksums-Sha256:
a426c892e5369058c3423816c8625bc8010bb5a58ece57261f62b64ee4d765ad 12462 qemu_10.0.13+ds-0+deb13u1.dsc
6a0888e806c2ffc0c5f0733e974f9aea55491950d3c47c98669c8b236dde59ae 40010016 qemu_10.0.13+ds.orig.tar.xz
da73c092f5684c551b0334d675eb16a3dec91e1edea94759cfb1102fa4a0364e 156096 qemu_10.0.13+ds-0+deb13u1.debian.tar.xz
16b8e3add06ee8a50e51146f2d85acdab170a5e47dd3d1edd26da9b8461cc1e6 7838 qemu_10.0.13+ds-0+deb13u1_source.buildinfo
Files:
ef31bdc115b30b4c6bfe8b794341ffb5 12462 otherosfs optional qemu_10.0.13+ds-0+deb13u1.dsc
e9f804eae55071cd8ea1ae009f0fa1fd 40010016 otherosfs optional qemu_10.0.13+ds.orig.tar.xz
70708450eb8ee4642f13edfd4738c517 156096 otherosfs optional qemu_10.0.13+ds-0+deb13u1.debian.tar.xz
93aa0b029ef9e648ab8f9abc077182ed 7838 otherosfs optional qemu_10.0.13+ds-0+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEZKoqtTHVaQM2a/75gqpKJDselHgFAmqbEZwACgkQgqpKJDse
lHipSw//bad4I+55ne+60AdmzpNoVcIzTgLhZhBDKo+H98+WCwl5hEsbdS9S0DNe
hRnH0Xz6kP6PkIoXupYQVtV9vj+0Z6e9uyBvBpI9x0vjxNxxbVcccwGhjivelwZC
HTIUFrDZrvYaTrLbFZf6L+r8ZNGk5YogReZT+S8pDArkjjo4cM+4CpPTzvCErLVw
JOSCtIs0lzEF7FOF3awJWD7OmaI3LjjHzBQW0+UM0cmUkQ9l2EPxtZguMc8Ke5mt
hhnouz9T2e+uK3OCCNsiDbNepbmK0Fc+KNGewtH8tc0JFgaFa/+ZeoOCsanAqqPI
W7We7VUWqZZ2FcytDoL4QK7wVHVf5Q9O+OJBTngDejbRPLtl40zJl9KYmCV06e7V
omgdQuJ5qArKrHGforuNwdaguPonemtmqTyOwVIoPAHdXJGS61H8snEr31CXBIPI
br7nbSyLhxIMfmOUw7xrhNsYRlwyAz3IDm76AOsvvyVQr52BRqDnKgKQ9uGh1ASf
NIgGmPo3J3N+/OysEaMsN5rBmAJTHx23lSpc4c9iYd85z/xyPoRybjLQnjLq8TQ8
57E1B8UYoOZufnsi0d48ahL2RDaqw1RGyk3c816WdiK45YcS0kGv24CIoIvQNGLg
ASljdxAgQpYriQQpXAqWnihLLiXzc4lQP6BIJQG8EdClL7qj7hU=
=ogdH
-----END PGP SIGNATURE-----
