-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 29 Aug 2026 20:55:40 +0300 Source: qemu Binary: qemu-system-data Architecture: all Version: 1:10.0.13+ds-0+deb13u1 Distribution: trixie Urgency: medium Maintainer: all Build Daemon (x86-csail-02) Changed-By: Michael Tokarev Description: qemu-system-data - QEMU full system emulation (data files) Changes: qemu (1:10.0.13+ds-0+deb13u1) trixie; urgency=medium . * new upstream stable/bugfix release, including multiple security fixes: - Update version for 10.0.13 release - target/riscv/tcg: sret in virtual user mode raises virtual instruction exception https://gitlab.com/qemu-project/qemu/-/work_items/3622 - target/riscv: enforce even register constraints for Zdinx fcvt pairs https://gitlab.com/qemu-project/qemu/-/work_items/4109 - target/riscv: reject FMV.X.W/FMV.W.X under Zfinx https://gitlab.com/qemu-project/qemu/-/work_items/4108 - target/riscv: honor zicbo* envcfg gating in linux-user mode https://gitlab.com/qemu-project/qemu/-/work_items/4107 - disas/riscv: Fix typo in th.lbib format - disas/riscv: Fix isa decoding of rev8 - disas/riscv: Fix rv32 encoding of zext.h - target/riscv: allow menvcfg/henvcfg LPE and SSE bits on RV32 https://gitlab.com/qemu-project/qemu/-/work_items/4045 - hw/riscv/riscv-iommu: preserve requested perm in spa_fetch() - hw/riscv/riscv-iommu: fix U-bit check to apply only to leaf S/VS-stage PTEs - disas/riscv: Decode unsigned vector immediates as unsigned - disas/riscv: Use signed type for vector immediates - disas/riscv: Fix 6-bit immediate extraction - disas/riscv: Fix th.srri decoding - target/riscv: use SXL instead of MXL for read_sstatus - target/riscv: Fix PC sync in trans_sspopchk for CFI exception handling https://gitlab.com/qemu-project/qemu/-/work_items/4118 - hw/watchdog: Add lower bound check for watchdogNumber https://gitlab.com/qemu-project/qemu/-/work_items/3600 - tcg: Export tcg_gen_ussub_i{32,64,tl} - tcg: Defer tb_flush when initial thread region alloc fails https://gitlab.com/qemu-project/qemu/-/work_items/2984 - tcg: Return success from tcg_region_alloc - tcg: Return success from tcg_region_alloc__locked - target/loongarch: check FPE before reading fcc in bceqz/bcnez https://gitlab.com/qemu-project/qemu/-/work_items/4209 - meson: make linker warnings non-fatal on Linux - serial: clear transmit retry callback on unrealize https://gitlab.com/qemu-project/qemu/-/work_items/4125 - target/i386: decode opcode extensions group 3 /1 as TEST https://gitlab.com/qemu-project/qemu/-/work_items/3580 - target/i386: allow transition to virtual-8086 mode only if CPL == 0 and CPU is not in long mode https://gitlab.com/qemu-project/qemu/-/work_items/3583 - target/i386: fix long mode segment override prefix decoding https://gitlab.com/qemu-project/qemu/-/work_items/3391 - target/i386: fix incorrect decoding of EXTRQ_i https://gitlab.com/qemu-project/qemu/-/work_items/3611 - target/i386: Clear OF, SF, and AF for fcomi/fucomi https://gitlab.com/qemu-project/qemu/-/work_items/4133 - target/i386: Use correct type for get_float_exception_flags() values - tcg/optimize: Fix s_mask computation for shifts - tcg/optimize: INDEX_op_mul is commutative - hw/elf_ops: defend against weird elf headers - hw/nvme: add SPDM_SOCKET Kconfig dependency - hw/block/pflash_cfi01: Restore ROMD mode after migration https://gitlab.com/qemu-project/qemu/-/work_items/4042 - hw/net/rtl8139: Send whole of vlan-tagged packet when doing loopback - hw/net/rtl8139: Fix handling of VLAN tags on incoming short packets https://gitlab.com/qemu-project/qemu/-/work_items/3518 - tests/qtest/ahci: regression test for ATAPI read vs. drain - hw/ide/atapi: read the whole elementary transfer asynchronously - tests/qtest/ahci: cover raw (2352-byte) ATAPI CD reads - tests/qtest/libqos/ahci: support raw (2352-byte) READ CD - tests/qtest/ide-test: cover raw (2352-byte) ATAPI CD reads - tests/qtest/ide-test: add a multi-sector ATAPI DMA read test - tests/qtest/ide-test: parametrize the ATAPI CD-ROM read test - hw/net/vmxnet3: Do not abort if guest provides bad interrupt numbers https://gitlab.com/qemu-project/qemu/-/work_items/539 - hw/usb/dev-uas: Don't abort if guest provided an undersized buffer for status https://gitlab.com/qemu-project/qemu/-/work_items/3900 - hw/intc/loongarch_pch_pic: Validate htmsi_vector before indexing parent_irq https://gitlab.com/qemu-project/qemu/-/work_items/4114 - migration/multifd: Replace assert() with error_setg() in recv paths - migration/multifd: Validate next_packet_size in zlib/zstd recv https://gitlab.com/qemu-project/qemu/-/work_items/3737 - tests/tcg/s390x: Test STCKF condition code on a faulting store - target/s390x/tcg: Set STCK/STCKF condition code after the store - pc-bios/s390-ccw.img: update s390x bios - pc-bios/s390-ccw: bound zipl menu strlen and replace VLA in zipl_print_entry - pc-bios/s390-ccw: bounds-check zipl menu entry index before array write - pc-bios/s390-ccw: fix out-of-bounds read in iso_get_file_size() - s390x/ipl: validate num_comp against iplb length before iterating - hw/char/sclpconsole-lm: avoid guest triggerable assert - tests/tcg/s390x: Test DR overflow (INT64_MIN / -1) - target/s390x: Fix DR/D INT64_MIN / -1 host crash - tests/tcg/s390x: Test PRNO TRNG interruptibility - target/s390x: Make PRNO TRNG interruptible - target/s390x: Have MSA helper pass a mmu_idx argument - hw/arm/aspeed: Add missing Kconfig dependencies on required components - linux-user: implement mount_setattr(2) - linux-user/sh4: Fix crashes on signal delivery in conditional delay slot - linux-user/sh4: Initialize the FPSCR register on signal - linux-user/sh4: Deliver SIGILL on invalid instruction - gitlab: disable provenance attestations to work around CI bug - hw/nvme: fix leak on copy ranges - hw/nvme: cancel inflight requests on controller reset https://gitlab.com/qemu-project/qemu/-/work_items/3398 https://gitlab.com/qemu-project/qemu/-/work_items/3883 https://gitlab.com/qemu-project/qemu/-/work_items/4068 https://gitlab.com/qemu-project/qemu/-/work_items/4072 - hw/nvme: factor out nvme_sq_cancel_inflight() - hw/nvme: drop AER requests without aiocb in nvme_del_sq() - hw/display/virtio-gpu: Unmap DMA regions on reset https://gitlab.com/qemu-project/qemu/-/work_items/3467 - hw/display/virtio-gpu: Always reject invalid scanout bounds - virtio-gpu: reject requests with short/truncated control headers Closes: CVE-2026-18054 - hw/display/virtio-gpu: fix offset wraparound in scanout_blob_to_fb - vhost-user-gpu: fix integer overflow in buffer allocation Closes: CVE-2026-15264 - hw/display/vga: fix panning_buf OOB after text/graphics switch https://gitlab.com/qemu-project/qemu/-/work_items/4085 Closes: CVE-2026-17516 - hw/display/virtio-gpu: validate blob iov size https://gitlab.com/qemu-project/qemu/-/work_items/3945 Closes: CVE-2026-66021 - coroutine: fix lost wakeup in qemu_co_sleep_wake() - iotests: run the test pool with the 'fork' start method - qcow2: do not try to clear the dirty bit on a read-only node - dmg: reject inconsistent UDRW chunk sector count and length https://gitlab.com/qemu-project/qemu/-/work_items/3846 Closes: CVE-2026-65928 - dmg: refuse to open files with no chunks https://gitlab.com/qemu-project/qemu/-/work_items/4021 - dmg: fix out-of-bounds load in search_chunk() https://gitlab.com/qemu-project/qemu/-/work_items/3844 Closes: CVE-2026-65929 - tests/unit: add reproducer for BlockAcctStats histogram locking race - block/qapi: take stats->lock when reading BlockAcctStats for query-blockstats - block/accounting: take stats->lock in latency histogram setters - block: Fix crash after setting latency historygram with single bin - block/cloop: fix integer overflow in total_sectors calculation - linux-user: fix incorrect msg_l[sr]pid members of target_msqid_ds - linux-user: Fix msqid_ds struct wrt 32-bit big endian architectures - hw/nvme: fix assertion failure on subregion removal - hw/nvme: fix unintentional integer overflow in shift - hw/nvme: fix cross-namespace copy dif buffer overflow - virtio-mmio: fix QUEUE_NUM_MAX https://gitlab.com/qemu-project/qemu/-/work_items/3882 Closes: CVE-2026-50626 - hw/display/exynos4210_fimd: Clamp windows to screen size https://gitlab.com/qemu-project/qemu/-/work_items/3795 - hw/display/exynos4210_fimd: Pass width to draw_line functions - hw/display/exynos4210_fimd: Factor out finding screen width/height - hw/i2c/bcm2835_i2c: Correct CLKT register offset - linux-user/sh4: allow full 32-bit address space - target/sparc: set reg window data structures currently after vmstate load - hw/net/igb: recalculate rx_desc_len on migration load - hw/net/e1000e: recalculate rx_desc_len on migration load - linux-user: fix guards for the fsmount(2) syscall series - hw/net/xilinx_axienet: Don't write checksums off end of packet - linux-user: Guard local FUTEX_CMD_MASK definition - virtio: avoid packed vring virtio_queue_empty() infinite loops https://gitlab.com/qemu-project/qemu/-/work_items/3968 Closes: CVE-2026-16457 - backends/rng: cap request size to avoid oversized allocation https://gitlab.com/qemu-project/qemu/-/work_items/3983 - hw/virtio-rng: Fix host use-after-free https://gitlab.com/qemu-project/qemu/-/work_items/3917 Closes: CVE-2026-50624 - hw/net/virtio-net: Protect from DMA re-entrancy bugs https://gitlab.com/qemu-project/qemu/-/work_items/4073 Closes: CVE-2026-66022 (again) - intel_iommu: Check address mask before using it in pasid-based iotlb invalidation https://gitlab.com/qemu-project/qemu/-/work_items/3619 - hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle - hw/virtio/vdpa-dev: pass set_config buffer to vhost backend - hw/pci-host/q35.c: Avoid early return in mch_write_config() - hw/pci-host/q35.c: Factor out creation of SMRAM MRs - hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled - virtio-iommu: fix OOM due to unbounded call_rcu - libvduse: validate vq size https://gitlab.com/qemu-project/qemu/-/work_items/3652 Closes: CVE-2026-61402 - libvhost-user: fix heap overflow in vu_check_queue_inflights https://gitlab.com/qemu-project/qemu/-/work_items/3974 Closes: CVE-2026-63110 - libvhost-user: validate last_batch_head in vu_check_queue_inflights https://gitlab.com/qemu-project/qemu/-/work_items/3974 - virtio-pmem: wait for flush requests on unrealize https://gitlab.com/qemu-project/qemu/-/work_items/3938 Closes: CVE-2026-63323 - vhost-user: assert nregions within limit https://gitlab.com/qemu-project/qemu/-/work_items/3910 - virtio: fail early on bad config_len in migration https://gitlab.com/qemu-project/qemu/-/work_items/3891 - virtio-scsi: fix SCSIRequest leak on a bad request https://gitlab.com/qemu-project/qemu/-/work_items/3875 Closes: CVE-2026-61476 - vhost: do not crash on ring map failure https://gitlab.com/qemu-project/qemu/-/work_items/3783 - hw/virtio: reject zero-length packed indirect descriptor table https://gitlab.com/qemu-project/qemu/-/work_items/3984 - libvhost-user: protect against OOB vring queue access https://gitlab.com/qemu-project/qemu/-/work_items/3741 - libvhost-user: protect against OOB writes in vu_set_inflight_fd https://gitlab.com/qemu-project/qemu/-/work_items/3740 - virtio-net: fix short frame OOB read in receive_filter() https://gitlab.com/qemu-project/qemu/-/work_items/3626 Closes: CVE-2026-63320 - virtio-net: fix OOB read in RSC receive path https://gitlab.com/qemu-project/qemu/-/work_items/3623 Closes: CVE-2026-63321 - hw/display/virtio-gpu: Block Rutabaga migration - rutabaga: improve error handling, fix potential crash during init - hw/display/virtio-gpu: Initialize blob mapping for ATTACH_BACKING - hw/display/virtio-gpu: Fix empty blob discrimination - virtio-gpu: fix NULL deref in rutabaga set_scanout https://gitlab.com/qemu-project/qemu/-/work_items/3897 - target/i386/sev: fix MemoryRegion reference leaks in gpa2hva callers - net/colo: fix g_hash_table_destroy assertion on uninitialized filter - hw/display/qxl: unregister vm_change_state handler and BHs https://gitlab.com/qemu-project/qemu/-/work_items/3607 Closes: CVE-2026-63322 - ui/vnc: remove redundant rows computation - hw/display/vhost-user-gpu: validate message payload sizes https://gitlab.com/qemu-project/qemu/-/work_items/3866 - hw/display/virtio-gpu: Remove the bytes_pp field - hw/display/virtio-gpu: reject strides exceeding INT_MAX - hw/display/virtio-gpu: validate stride against width on scanout https://gitlab.com/qemu-project/qemu/-/work_items/3989 Closes: CVE-2026-63109 - hw/usb/hcd-xhci: Check return value of xhci_xfer_create_sgl() for errors https://gitlab.com/qemu-project/qemu/-/work_items/3786 - hw/usb/core: Avoid possible assert() in do_parameter() --> usb_packet_copy() https://gitlab.com/qemu-project/qemu/-/work_items/3746 - hw/ide/core: Fix possible crash via NULL pointer in ide_cancel_dma_sync() https://gitlab.com/qemu-project/qemu/-/work_items/905 https://gitlab.com/qemu-project/qemu/-/work_items/4052 - hw/usb/dev-uas: Fix guest-triggerable heap OOB access https://gitlab.com/qemu-project/qemu/-/work_items/3612 https://gitlab.com/qemu-project/qemu/-/work_items/3986 - hw/9pfs/xen: drain in-flight PDUs before xen-9p disconnect - hw/9pfs/virtio: drain in-flight PDUs before virtio-9p unrealize https://gitlab.com/qemu-project/qemu/-/work_items/3937 - hw/9pfs: fix O_TRUNC bypass on read-only export https://gitlab.com/qemu-project/qemu/-/work_items/4000 Closes: CVE-2026-63318 - hw/display/vmware_vga: Don't allow guest to trigger long running loop in host https://gitlab.com/qemu-project/qemu/-/work_items/3782 https://gitlab.com/qemu-project/qemu/-/work_items/4026 https://gitlab.com/qemu-project/qemu/-/work_items/4076 - hw/ide: replace assert with proper error handling https://gitlab.com/qemu-project/qemu/-/work_items/2777 - scsi-disk: fix off by one in assertion - scsi-disk: protect against guest sending truncated data for MODE SELECT commands https://gitlab.com/qemu-project/qemu/-/work_items/4051 - target/i386: helper_sysret(): Check that RCX contains a canonical address when emulating an Intel CPU https://gitlab.com/qemu-project/qemu/-/work_items/3223 - vfio/pci: reject invalid PCI_INTERRUPT_PIN values - vfio/pci: don't narrow a failed config read to a plausible value - vfio/igd: Clear saved BDSM in legacy VBIOS ROM at load time https://gitlab.com/qemu-project/qemu/-/work_items/3093 - vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom() - hw/uefi: make SetupMode read-only https://gitlab.com/qemu-project/qemu/-/work_items/4039 Closes: CVE-2026-16288 - hw/uefi: add post_load checks https://gitlab.com/qemu-project/qemu/-/work_items/3837 https://gitlab.com/qemu-project/qemu/-/work_items/3838 https://gitlab.com/qemu-project/qemu/-/work_items/3839 https://gitlab.com/qemu-project/qemu/-/work_items/3885 Closes: CVE-2026-61404 - hw/uefi: account variable policy entries against storage size https://gitlab.com/qemu-project/qemu/-/work_items/3890 Closes: CVE-2026-61405 - hw/uefi: check lower limit for signature list size https://gitlab.com/qemu-project/qemu/-/work_items/3899 Closes: CVE-2026-61406 - hw/uefi: remove debug function https://gitlab.com/qemu-project/qemu/-/work_items/3615 Closes: CVE-2026-58582 - hw/uefi: add sanity check https://gitlab.com/qemu-project/qemu/-/work_items/3614 Closes: CVE-2026-58581 Checksums-Sha1: 530050e48fcbbbc9e4c0f62fbfaebbbbde7e3f4f 2144176 qemu-system-data_10.0.13+ds-0+deb13u1_all.deb b5e4f7fe5455f7e94b60a60df91faa954ea14b09 16496 qemu_10.0.13+ds-0+deb13u1_all-buildd.buildinfo Checksums-Sha256: a0e03c526cc09d4c2ab20aa19a8c12e916cdc49a170acb16a6563c28f70eafd3 2144176 qemu-system-data_10.0.13+ds-0+deb13u1_all.deb df7b143c24981f8b2d168108c067313fe957df92953562553d59a2fe1ae66a1a 16496 qemu_10.0.13+ds-0+deb13u1_all-buildd.buildinfo Files: bd32b49c42d0b8cc57376b5fdf0ad864 2144176 otherosfs optional qemu-system-data_10.0.13+ds-0+deb13u1_all.deb dda9d0c0d13a028cf5828af83aaf2511 16496 otherosfs optional qemu_10.0.13+ds-0+deb13u1_all-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmqcWRoACgkQaBVi67oX tfk+6Q//YCZuVPWWISldP9GXz6z04lHCpYyjx1ttgw99Qf4J7eefcyEnnlsR3pGQ XaDdAVSe+UecE8VV1QQiQ/yh8rz32LhaIUki7TmC6Echdr05oKtf5rN6HzOWoKj1 zsUrVJ3n00UOdvAow9Itdv5YvkaWLcJI0mLpuWmHm3feQv5Mn27IySMd4pVpQybt cTVUXKoUs2WG1Qv2RpJ4Jwk2+vjlUVxdTS+FuCD4frRRlO4I+xrZq9Auf2mvTvqG 2wuBrLwfkgjzZUzOVuawQmTGNiaogmdn8NvnWSq3s1ozLDF6JXzd181zaX9QpugE /QsEFE3MYxIdiiS7CbfwGWuuFYk5TYlQqssDvYo++xf2vBfv1vqOxHIRl6dFRiVn 8xdI97tXRchVA2r8Uf7vExgEEz8WS/CfiiX0QWeFPPfvsZvuVjCV5lteqUswzUd8 471y2jtwwbxDZl1vPCh8yjWgl+HY+25AzcR7ud2wydKfd0PFP4NfjY35iSXuYoBB /KLqAXQqjOVCTgKTEd8AMj+/W6J2rT202qqnfLMjCopwsRV41nLd2PPoQuzTfa6U HS5UOn5piD1oPjZsI50UsUta9eIiJkLYp4X7vSE10AEj2kjkLzafdeHI1L8GGRey Wx1huoBA1iRHEBEcSnR9+TpF1E5d2ccmfzBYCEVUR49Q0bV8Afs= =4wGs -----END PGP SIGNATURE-----