-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 04 Nov 2026 17:52:28 +0100
Source: xen
Architecture: source
Version: 4.17.7+13-g2445b30a44-0+deb12u1
Distribution: bookworm-security
Urgency: medium
Maintainer: Debian Xen Team <pkg-xen-devel@lists.alioth.debian.org>
Changed-By: Hans van Kranenburg <hans@knorrie.org>
Changes:
xen (4.17.7+13-g2445b30a44-0+deb12u1) bookworm-security; urgency=medium
.
* Update to new upstream version 4.17.7+13-g2445b30a44, which also contains
security fixes for the following issues:
- x86: DMs may cause mem leak by IRQ binding
XSA-509 CVE-2026-62437
- x86: improper handling of HVM emulation return codes
XSA-510 CVE-2026-79602
- Unconditionally do TLB flushing ahead of page scrubbing
XSA-511 CVE-2026-79603
- oxenstored: Unbounded accumulation of watches
XSA-512 CVE-2026-79604
- x86: XPTI may break on huge-memory systems
XSA-516 CVE-2026-79609
- grant-table: double version change race
XSA-517 CVE-2026-79610
- VMX: VMentry failure with branch tracing and blocked states
XSA-518 CVE-2026-79611
- Arm: multiple issues with GNTTABOP_cache_flush
XSA-519 CVE-2026-102699 CVE-2026-102702
- gnttab: cache-flush handling may cause page reference leak
XSA-520 CVE-2026-102700
- arbitrary read/write via grant copy
XSA-523 CVE-2026-102703 CVE-2026-102704
* Note that the following XSA are not listed, because...
- XSA-513 applies to blktap which is not included in Debian
- XSA-514 only applies to Xen 4.22
- XSA-515 only applies to Xen 4.19 and later
- XSA-521 applies to blktap which is not included in Debian
- XSA-522 has patches for the Linux kernel
Checksums-Sha1:
b784890e6a72d6b166c1cdabfebdbf9b9c3ff8bc 4389 xen_4.17.7+13-g2445b30a44-0+deb12u1.dsc
e361bf700efdc3bc163223b3b60a40f397c73be0 4740076 xen_4.17.7+13-g2445b30a44.orig.tar.xz
e332b633d4c22c81278b0c76717912769fe46e3a 140728 xen_4.17.7+13-g2445b30a44-0+deb12u1.debian.tar.xz
Checksums-Sha256:
8bf01bcad94067022f27c38529e10593cbd2f145bc0d305a72f7634f2865ffba 4389 xen_4.17.7+13-g2445b30a44-0+deb12u1.dsc
7722ae68830ff50647bbbc6c1ff3bbdea84f4eae9c92c35d43f160d4640f6193 4740076 xen_4.17.7+13-g2445b30a44.orig.tar.xz
658ca4fb50d5b75541497fb101051b339f81ad39e539fc61ddeb458843abf137 140728 xen_4.17.7+13-g2445b30a44-0+deb12u1.debian.tar.xz
Files:
ef6f7afbea4f284cdb663d6e35753f07 4389 admin optional xen_4.17.7+13-g2445b30a44-0+deb12u1.dsc
ff15675382a0d0de0fd8ac223b33a099 4740076 admin optional xen_4.17.7+13-g2445b30a44.orig.tar.xz
34a49f6c252efa88a557e5460bfb7b79 140728 admin optional xen_4.17.7+13-g2445b30a44-0+deb12u1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmrrmAwACgkQDTl9HeUl
XjA7sRAAsuoajBIjIlr/STAfmnXVmzfZ5FR2pMgCL7+lLnc9JiaUxprhkZhez9rX
AL7FNL+zODJybFiZKNCZr5FzmqrUWPCiec+E5b1lvc3zo3jssEhdafFtweXc2IIn
lVVHEph7K4nJPBpqYR1wJNV0ZyCijB1JFP2TH1h6NBJiRsPiQoGoceQIdZ7qxDRG
xYpyIkCa/ebU0c1je5E2RQsdeC0MYkd33czAjlz7bP2PIj+RAIaoHcY3k8h5nG0A
QkQGLi8bf3RcXAYeNfqQTKoIHWIZhkSfid7GER/xK+5jA6kXKdtVQEG9dgIHF3Gl
oaLtpUsQzTGlvZX0Bp7DAuGjVe5ProSh74PBty9hjvh79IEQOhw4iNI9dg636CZZ
vDJqjYh/uHQk1kfJLUQXk5dyQTIyKiVrk2EFu4bD6aAT2AcOU+ibuFsuJ7jWRdWu
2JIOI7T9JEaTNQIFYvPz86tDQJHQ2EtULxoH7Avn6jq9eWQ+bKz2gh8NnrzO0T6s
7/HPYsSiyrDR4kEuqTQ9xPbW8jyXBcgYszZ2D4P9BZ9OAW8PqBXIryzu6DdRsa0t
RdDLBw6zWzwyg9Sq7xDqyarvyc1/cEYEhmryVtw8O6lLCpH2sFCWECKIUG6p3cwi
dsUNiKNCfhIOx4NS5Iree4AuF630O6hqolFN8cSa/VmBhohl4+w=
=zlOs
-----END PGP SIGNATURE-----
