-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 16 Oct 2026 16:28:47 +0200
Source: xen
Architecture: source
Version: 4.20.4+39-gf1e1321c87-0+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: Debian Xen Team <pkg-xen-devel@lists.alioth.debian.org>
Changed-By: Hans van Kranenburg <hans@knorrie.org>
Changes:
xen (4.20.4+39-gf1e1321c87-0+deb13u1) trixie-security; urgency=medium
.
* Update to new upstream version 4.20.4+39-gf1e1321c87, which also contains
security fixes for the following issues:
- x86: DMs may cause mem leak by IRQ binding
XSA-509 CVE-2026-62437
- x86: improper handling of HVM emulation return codes
XSA-510 CVE-2026-79602
- Unconditionally do TLB flushing ahead of page scrubbing
XSA-511 CVE-2026-79603
- oxenstored: Unbounded accumulation of watches
XSA-512 CVE-2026-79604
- x86/AMD: ineffectual Zenbleed workaround
XSA-515 CVE-2026-79608
- x86: XPTI may break on huge-memory systems
XSA-516 CVE-2026-79609
- grant-table: double version change race
XSA-517 CVE-2026-79610
- VMX: VMentry failure with branch tracing and blocked states
XSA-518 CVE-2026-79611
- Arm: multiple issues with GNTTABOP_cache_flush
XSA-519 CVE-2026-102699 CVE-2026-102702
- gnttab: cache-flush handling may cause page reference leak
XSA-520 CVE-2026-102700
* Note that the following XSA are not listed, because...
- XSA-513 applies to blktap which is not included in Debian
- XSA-514 only applies to Xen 4.22
- XSA-521 applies to blktap which is not included in Debian
- XSA-522 has patches for the Linux kernel
Checksums-Sha1:
ff5195eb8d03d23a3f92f8dd094c7cd929d41c7e 4054 xen_4.20.4+39-gf1e1321c87-0+deb13u1.dsc
0f2c5f7af9266bb793e58d382b9dc5a3d827b002 4963496 xen_4.20.4+39-gf1e1321c87.orig.tar.xz
dbd92dd2d1f1b56212368847a4bc278f22058fde 139784 xen_4.20.4+39-gf1e1321c87-0+deb13u1.debian.tar.xz
Checksums-Sha256:
cfd2746eed8e8594d23c3817bf80be050f725dae74cba4d5be4856a9adf7b8f5 4054 xen_4.20.4+39-gf1e1321c87-0+deb13u1.dsc
1f5ff12b9dc664ac519ca52e0b5f746cfb1149f74e932e23ed584b092a46bc46 4963496 xen_4.20.4+39-gf1e1321c87.orig.tar.xz
678d4f6dcf5fd791d5811ebf10d031d4e11fa37e493a7250cb116f11c9c064d9 139784 xen_4.20.4+39-gf1e1321c87-0+deb13u1.debian.tar.xz
Files:
a32ca30630df358972c4a231c88abcb0 4054 admin optional xen_4.20.4+39-gf1e1321c87-0+deb13u1.dsc
1a7697e2104c9150968cd903a112ce18 4963496 admin optional xen_4.20.4+39-gf1e1321c87.orig.tar.xz
5952755b096fd57fd53a0257c1d96b54 139784 admin optional xen_4.20.4+39-gf1e1321c87-0+deb13u1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmrSWdsACgkQEMKTtsN8
TjbAExAAwBmHLWtXNOZbAmaBEwYksVU0pWX/h3KxASrQeGsL5APwMVv8uRJntT94
Vr0vf+wG08LopmSG6GJvBSGJHWe5vuM1y6kNpfd8e3OEs/IjJboBeCAsR7yQzWbB
oqIGdrQPfoqvw51S4ZpVRvgsu5S9yUGste1IztoC6d0PU4L7Jh7kTOtHk8R4SZI+
ghynkuPoSnOGdNmC5Q+nahj+PPoo1SV38u8XBqcnG5q5D/Q3V9f6/5TKxnjb6v2f
/6yJ+9PE0tJ3rBy8dO1LK3svDH9p7lWAf7wG+fZCE3FAirKRCGa3AGnFlTSnKJN/
rOUBl9fGrMZ9HfoIIK83Vt0mkPxdo0O+tgzF1Pr9PQLzmMR0/LBrFWdoUViD35UP
ZVWGU6H0klCJ0EBTdSwvMiQUZ5MmD9NzRTcqoXSaZoGWdU2hGZBY1yPNpLQ/mIa1
3ezCPVWozVkPPzHGi3zx6s11G1ZFFIFHmS+U0+eWwkMwDSKhxcTmzmwiItFV8QZ3
+HkR29HnT5kgQmXC0jFJ429T9WUuM67MWaMFKkfC7U6db6UbfNd4/j25Eog1bti7
DW7yJir4cBq5FaVf0vFtQkGzK46mnX4qdCb0AIBqluCizwixqhi9EA4GQBihCCQH
f0xeIdT8y0PcyUS8oGsxfOsAs/wIn3xW/Jp2Gocxeiu4+Qfr6rw=
=i8vo
-----END PGP SIGNATURE-----
