-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 28 Jun 2026 08:33:17 +0300 Source: qemu Binary: qemu-system-data Architecture: all Version: 1:10.0.11+ds-0+deb13u1 Distribution: trixie Urgency: medium Maintainer: all Build Daemon (x86-grnet-02) Changed-By: Michael Tokarev Description: qemu-system-data - QEMU full system emulation (data files) Closes: 1139923 Changes: qemu (1:10.0.11+ds-0+deb13u1) trixie; urgency=medium . * new upstream stable/bugfix release: - Update version for 10.0.11 release - linux-user: Fix AT_PHDR when program headers are relocated into their own segment - hw/pci: Replace assert with bounds check and return - ppc/pnv_phb3: Error out on invalid config access - linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn - linux-user/xtensa: save/restore FP registers across signal delivery - target/xtensa: add cpu_set_fcr/fsr helpers to sync fp_status - ui/sdl2: Set GL ES profile before creating initial GL context - hw/9pfs: reject . and .. in Twstat rename - hw/9pfs: fix abort due to illegal name with Twstat rename - gdbstub: Update x86 control register bits - target/i386: apply mod to immediate count of an RCL/RCR operation - hw/uefi: fix parse_hexstr (Closes: CVE-2026-48915) - target/riscv: mask vxrm csrw write to the low 2 bits - disas/riscv.c: fix inst_length() - target/riscv/cpu_helper.c: add PMA access fault - target/riscv/cpu_helper.c: fault with reserved PTE.PBMT val - target/riscv/insn_trans/trans_rvzicbo.c.inc: save opcode before helpers - disas/riscv.c: add 'cbo' insns to disassembler - target/riscv/csr.c: fix mstatus.UXL reserved value - target/riscv/csr.c: do not allow mstatus MPV/GVA writes - target/riscv/cpu_helper.c: allow LOAD_ADDR_MIS promotion to AMO fault - virtio: Allow to fill a whole virtqueue in order - libvduse: fix buffer overflow in vduse_queue_read_indirect_desc() (Closes: CVE-2026-6425) - libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc() (Closes: CVE-2026-6425) - tests/qtest: Add amd-iommu command buffer head wrap test - amd_iommu: Update command buffer head ptr in MMIO region after wraparound - amd_iommu: restrict command buffer head/tail ranges to ring size - linux-user: add preadv2/preadv2 - system/rtc: Fix a possible year-2038 integer overflow problem - linux-user/strace: add fsmount series of syscalls - linux-user: implement fsmount(2) series of syscalls - fpu: Handle all rounding modes in partsN_uncanon_normal - hw/usb/hcd-ohci: Clean up USBPacket before freeing ISO TD packet - qed: Don't try to flush during incoming migration - qcow2: Fix data loss on zero write with detect-zeroes=unmap - iotests/046: Test that discard/write_zeroes wait for dependencies - qcow2: Fix corruption on discard during write with COW - qemu-io: Add 'aio_discard' command - virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check (Closes: #1139923, CVE-2026-48914) - block/io: fallback to bounce buffer if BLKZEROOUT is not supported because of alignment - s390x/pci: Fix interrupt forwarding disable for interpreted devices - target/s390x: Make container ids in SysIB_15x 1-based - tests/unit: add test-envlist covering setenv/unsetenv name matching - util/envlist: fix prefix-match in envlist_unsetenv() name lookup - 9pfs: fix missing rename lock in v9fs_co_readdir_many (Closes: CVE-2026-48004) - tests/9pfs: add deep absolute path test - tests/qtest/libqos: add qvirtqueue_reset_pool() for descriptor pool reset - hw/9pfs: let callers of v9fs_path_sprintf() and v9fs_fix_path() handle errors - hw/9pfs: add error handling to v9fs_fix_path() - hw/9pfs: change V9fsPath.size to size_t and v9fs_path_sprintf() return type - hw/9pfs: add NULL check in v9fs_path_is_ancestor() - hw/9pfs: move G_GNUC_PRINTF to header - linux-user/s390x: restore fpu_status rounding mode from FPC on sigreturn - linux-user/sh4: restore FP rounding mode on sigreturn - linux-user/sh4: preserve T/M/Q bits across signal delivery - linux-user/mips: save/restore FCSR across signal delivery - linux-user/ppc: restore fp_status from FPSCR on sigreturn - hw/net/rocker_of_dpa: Avoid unaligned accesses in _of_dpa_flow_match() - hw/net/rocker_of_dpa: Check group ID pointers are not NULL - target/arm: Don't assert if 64-bit EL2 AT insn sees a Domain fault - target/arm: Set correct fp flags for FLOGB when FPCR.AH = 1 - target/arm: Use FPST_A64_F16 for SVE FCVTLT_hs - target/arm: SVE2 FMAXP, FMINP must honour AH=1 - block/linux-aio: bound ioq_submit() recursion depth - mc146818rtc: Fix get_guest_rtc_ns() overflow bug - apic: fix delivery bitmask with modified xAPIC ids - lsi53c895a: clear tag byte when processing messages - lsi53c895a: fix use-after-free of cancelled request - ui: fix validation of VNC extended clipboard data length (Closes: CVE-2026-8343) - ui/vnc: fix OOB read updating VNC update frequency stats (Closes: CVE-2026-48003) - ui/vnc: fix OOB write in lossy rect worker code (Closes: CVE-2026-48002) - ui/vnc: fix OOB write in VNC stats array (Closes: CVE-2026-48002) - ui/vnc: fix OOB read access in VNC SASL mechname array - target/riscv: clear mseccfg on reset for all dependent extensions - target/riscv: Update the local interrupt mask - target/riscv: Add mseccfg to VMStateDescription - target/riscv: Save stimer and vstimer in CPU vmstate - target/riscv/pmp: Fix integer overflow in TOR and NA4 address computation - target/riscv: Fix medeleg[11] read-only zero bit for M-mode ECALL - hw/char: sifive_uart: Implement txctrl.txen and rxctrl.rxen - hw/char: sifive_uart: Avoid infinite delay of async xmit function - target/riscv: Allow mseccfg access based on ext_zicfilp - hw/riscv/riscv-iommu: Fix Svnapot 64KB pages - target/riscv: Update MISA.X for non-standard extensions - target/riscv: Update MISA.C for Zc* extensions Checksums-Sha1: 5255195eb156694543364510e44f1aa409ae276e 2136216 qemu-system-data_10.0.11+ds-0+deb13u1_all.deb adb963e33c562349c5ca5e94cca1804f197fca57 16392 qemu_10.0.11+ds-0+deb13u1_all-buildd.buildinfo Checksums-Sha256: 5ab6916f8cbda16c9bfee3bc4ebdad917b47c6cceeed9309d920f85c01a73c4e 2136216 qemu-system-data_10.0.11+ds-0+deb13u1_all.deb 74c564ef75071687b26b24bf5978d077471817eb5185bcd3064e7ad2e97b37d0 16392 qemu_10.0.11+ds-0+deb13u1_all-buildd.buildinfo Files: e2b55496e745f9b284351c2caa961c2d 2136216 otherosfs optional qemu-system-data_10.0.11+ds-0+deb13u1_all.deb 2ae0074b2de41c420cc6be71bd09f587 16392 otherosfs optional qemu_10.0.11+ds-0+deb13u1_all-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmpJt/8ACgkQmgPNRvTf /zey5g//RzU/2RS4PBVfVl4i/I34hSiAWp+Ftr94XNcfcU9Xa+mezaTFBhKrflNT JkjLM4ke0FvocSLPP10bf8Y9nGWKTnc1c3r+RvTOktYooEf1ygexBl6Xztr9miUh okyResMADyovjif7aHk7KgY7GF+d6hmsQHCPN2+EPeBHkkSIkqSgsX3jZ+tpxQbI Q0oHJ00uTv02SkS6TEPZ55jCexS2O4eJ69vY0xTsVGL0mtWW4OM3vkreYpBMtO0C i+X+c8M4W/dyqyaFJgQ2X05s91irl/40enNBG/VQeefPzJTBfZAw1oMLQfa5+Xt4 fN97wbJU7svJXDdBBfvlaLP21Ny/Dxhda/GgVn4EKGi17uf55fUrRxI0uUck73KN o01+JFg9pe6y7ohJ+kB5FNLoBGeaKhRIEV7ypml33Xf+0KJSJJv5uVL5PkvaBzTn YVkyrSPfOC3zHzPlj8swv7dpIHKvdPocieOxGERkabtSfj0E05wDCtcQHZwvzuRv A3nbFzVhGuN8p88OOnBhFFCxvUG0kcdebsXTvBuaeakVFaoBal4rnYA+Ghs53jf7 +J7RKoraCEtdBHKXUz8kWn8dp5Zxh3OnSZ+AZZ5HJSVQ0szVrlDedpUAEnpritWS ZUvBtbPkZzSnJJB5hhd2QLUkcCiao6aCji8DrRtaUbxAEFnBda8= =P+QG -----END PGP SIGNATURE-----