-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 29 Sep 2026 17:59:06 +0300 Source: qemu Architecture: source Version: 1:11.1.2+ds-1 Distribution: unstable Urgency: medium Maintainer: Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org> Changed-By: Michael Tokarev <mjt@tls.msk.ru> Closes: 1146606 1148473 1149064 Changes: qemu (1:11.1.2+ds-1) unstable; urgency=medium . * new upstream stable/bugfix release: - Update version for 11.1.2 release - target/sh4: Replace TB_FLAG_GUSA_EXCLUSIVE with CF_STEP_ATOMIC - accel/tcg: Set CF_NOIRQ during cpu_exec_step_atomic - linux-user/sh4: align the vdso sigreturn trampolines - linux-user/sh4: fix vdso CFA for rt_sigreturn frames - linux-user/sh4: use the kernel's sigreturn trampoline sequence in the vdso - target/i386: Mark MOVNTI as not valid with prefixes 0x66, 0xF2, 0xF3 - target/i386: Update FPU tag word for FXCH - target/i386: Update FPU tag word for FSTP - target/i386: Update FPU tag word for FXTRACT's old ST(0) - target/i386: Fix FXCH to unconditionally clear C1 - target/ppc: Stop vCPU thread before calling parent_unrealize - tests/qtest/usb-hcd-xhci: test isoch endpoint type mismatch - tests/qtest/usb-hcd-xhci: test isoch pacing with MFINDEX above 2^32 - hw/usb/hcd-xhci: don't assert on NAK when retrying an isoch transfer - hw/usb/hcd-xhci: fix interval alignment after MFINDEX passes 2^32 - hw/usb/hcd-xhci: Set reentrancy guard in timer functions (Closes: CVE-2026-17588) - tcg/riscv64: Set vtype before whole-register vector loads - tests/tcg/s390x: Add regression test for #4449 - tcg/optimize: Fix expansion/simplification of deposit - tests/tcg/arm: Add regression test for #4448 - tcg/optimize: Fix fold_multiply2 vs 1 - accel/tcg: Fix TLB_MMIO check in tlb_plugin_lookup() - accel/tcg: Use TLB_FORCE_SLOW not TLB_MMIO for system plugins - hw/9pfs: mutate FID path from main thread only (Closes: #1149064, CVE-2026-93834) - s390x/pci: fix DMA slot leak on I/O TLB entry replacement - hw/s390x/ipl: Fix incorrect PCI IPL block lengths - linux-user/loongarch64: Detect vector stores in host_signal_write() - linux-user: implement mlock2(2) syscall - linux-user/riscv: honor zicntr=false for base counterCSRs - system/ram-discard-manager: fix offset_within_address_space in replay_by_populated_state() - igvm: mark qigvm_find_param_entry as static - igvm: validate and honor byte_offset in parameter directives - hw/uefi: add missing uefi_str_is_valid check to uefi_vars_mm_lock_variable - target/loongarch: Fix data race in CSR_ESTAT - hw/riscv/virt.c: fix aclint soc/mtimer nodename - target/arm/hvf: implement MDCCSR_EL0 as RAZ - target/arm/whpx: fix whpx-arm post-reset CPU state - target/arm/whpx: incorrect ENCODE_AA64_CP_REG parameter order - target/arm/whpx: Don't try to sync ARM_CP_CONST registers - hw/intc/bcm2835_ic: reject out-of-range FIQ source values - qga: Change effective user/group ID in guest-ssh-* commands (Closes: CVE-2026-12080) - vhost-user-gpu: validate command buffer size in submit_3d - ui/cursor: make the cursor refcount atomic - hw/display/qxl: hold ssd.lock while replacing ssd.cursor - hw/cxl: fix the CDAT DOE overlapping the Flex Bus DVSEC when sn= is set - virtio-scsi: set dataplane_started to false upon failure - virtio-balloon: fix free-page BH teardown on unrealize (Closes: CVE-2026-66899) - hw/virtio: reject inverted virtio-iommu IOVA ranges - hw/net/virtio-net: strip trailing padding when caching RSC segment (Closes: CVE-2026-66900) - hw/net/virtio-net: check packet size before VLAN tag access in receive_filter() - qapi/misc: Fix missed query-iothreads items - hw/cxl: Fix guest-triggerable QEMU exit on reserved interleave ways - virtio-gpu: clear res->blob on mapping cleanup - tests/unit: cover blocked IO during the websock handshake - io/channel-websock: do not lose QIO_CHANNEL_ERR_BLOCK while reading - tests/unit: add websock handshake test - io/channel-websock: handle a blocked write during the handshake - io/channel-websock: send an HTTP 400 when the greeting has no space - io/channel-socket: do not treat a zero length write as an error (the 5 changes above: Closes: CVE-2026-84788) - target/loongarch: Fix SWI interrupt delivery via CSR_ESTAT - hw/cxl: fix timer leak in cxl_destroy_cci() - hw/sd/sdcard: Register device ops in drives without media - hw/sd: sdhci: Accept version 4 enable without UHS-I - target/arm: Make Thumb T1 hint space UNDEF before v6T2 - target/arm: Make IT insn undef when not present - target/arm: Make CBZ/CBNZ UNDEF before v6T2 - target/arm: Correct reset value of SCTLR for arm926, arm1026 - target/arm: fix TTA instruction S bit for IDAU-exempt addresses - ppc/xive: Trigger the pending interrupt for a guest after migration - i386/vapic: unref MemoryRegion if vapic_map_rom_writable fails - vapic: confine the VAPIC region to 0xc0000..0xe0000 (Closes: #1148473, CVE-2026-81627) - scsi: hide MODE SELECT block size change behind a quirk - scsi-disk: fix out-of-bound read in WRITE SAME - target/riscv/kvm: Preserve MP state across migration - target/riscv/kvm: Synchronize privilege mode - hw/ide: report the default CHS translation in IDENTIFY DEVICE - tests/qtest/ide-test: cover a CHS translation with zero sectors - hw/ide: reject an unsupported CHS translation - s390x/sclp: pv: only copy the original SCCB buffer - dirty-bitmap: fix integer overflow in serialization coverage - block/monitor: allow dropping a bitmap never stored on disk - migration/block-dirty-bitmap: reject bitmap load onto ro node - block/monitor: reject persistent bitmap add on a read-only node - tests/unit/test-blockjob: cover keeping a job paused while a pause is pending - job: keep job paused across overlapping pause requests - hw/input/ps2: answer unknown mouse commands with a resend - hw/display/vga: fix text-mode OOB write after a graphics surface switch (Closes: CVE-2026-77913) - chardev: Don't unregister yank upon async path connection failure - crypto: fix build against nettle >= 4 - virtio-gpu: use g_try_malloc to avoid guest-triggered abort - hw/display/qxl: validate primary surface stride against width (Closes: CVE-2026-16271) * d/control: libjack-dev => libjack-jackd2-dev (Closes: #1146606) Checksums-Sha1: 0749709e1b40dec613bb598fc233bd6c3c8194d2 9929 qemu_11.1.2+ds-1.dsc d58acaf257de04d16418e5d61b0e1befe2ef2b45 39228664 qemu_11.1.2+ds.orig.tar.xz 0157831965b9ef40c44daf973def3adf6582b548 134776 qemu_11.1.2+ds-1.debian.tar.xz e93a9afd9df1df6fc6feebefb5609b1cb4ebfaa8 8025 qemu_11.1.2+ds-1_source.buildinfo Checksums-Sha256: 0a793f94777a1d150fa12bd7d02702c252ad4b4675c887cb13324f9327f7bb9a 9929 qemu_11.1.2+ds-1.dsc 4f41c3df35a86d2497f842a585b014fe5aef45ceec6450e61615f0164ca39761 39228664 qemu_11.1.2+ds.orig.tar.xz 6a25aefcd0203b14209fd54aab4ec904e69b45d62bf5924e99a71c60b62773c1 134776 qemu_11.1.2+ds-1.debian.tar.xz 6b0e04a466011abb09387b54c0f6fb9f1e4632596f8deff748c008140059033f 8025 qemu_11.1.2+ds-1_source.buildinfo Files: d6448f1ab815c4a1d5a6258fb5361af5 9929 otherosfs optional qemu_11.1.2+ds-1.dsc 26e6bc30fdfe4b08a614772a69347614 39228664 otherosfs optional qemu_11.1.2+ds.orig.tar.xz c20d346b331d36f73e47671fb6d7f9f2 134776 otherosfs optional qemu_11.1.2+ds-1.debian.tar.xz 077a0ab7f5b5ee68f3edf332ba86dc6f 8025 otherosfs optional qemu_11.1.2+ds-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEZKoqtTHVaQM2a/75gqpKJDselHgFAmq71LMACgkQgqpKJDse lHjQMg/+IcKcj0lN4hKs49EEtVNeL0Kud6xITZJ1vdEy7HqF7yTAuFR6uasjKGzX ScLDC/nadCvZ/DjUUCVrajlbK4uDEuyQ0O6UrTvBtOSzMmnIVvTa8nNL7waaD1Lu E9mZGWCPgNcv/HrifPk57or1RRDEw2vcGRFFm4B9EVAFfQkaALWQxk5pZFc+0Rmv KgCfujoFsTcSI+XVjIRfADoKr7GXtK6OVG3MFBvcmcxfXm2qmiI6Pc1qIygZ8z/F S6i+c5iF+BdbmcGEtY93gRVW+rWqY3tJKTvEhMHk8lfuJUoAdSG8TA3solHVAi3+ SxhuXKj4tkjfxhvdrLPCXgAX/0sqf1JT+LVnDt9Qb3g1WGwPP0+lRUB6/uXMveA2 x9TdzosEA1bha4NWFDNgeGiMGxJH9mE+3zNaIA5yv3iHQMtbuTWj2TQ0z/LTMiu/ euJsVKUoDo7DAIAiMyVsYyOC8n3mgCvgCAi5TUO+7B9ze2kRWehTwVAWhh2BuonM w1dgiz6DZy9DaGWTlD+tck2gLpRvOuARBufaI1hbslv8CgTCljsgyQ78vAKh/7lS 1CB0SPkYRfbEzLv7M/9meKqHFDKu9LifQVMriiWdDOz6s5KGCJRqN3BTeeYhaC83 CobieGf7ki/wlsLiCSBNQurPMt4USsh2dx/KSU3fVknGbUQA56A= =QQSd -----END PGP SIGNATURE-----
