[ Reason ]
New upstream stable/bugfix release. With more than 120 fixes all
over the places, - fixing bugs, correctness. Including the following
CVE fixes:
CVE-2026-8348 CVE-2026-9238 CVE-2026-15578 CVE-2026-15705
CVE-2026-16043 CVE-2026-48002 CVE-2026-61475 CVE-2026-63319
[ Tests ]
This is an upstream qemu release, which passed all relevant upstream
CI tests. Additionally, my usual set of various guest images are being
tested now, - I'll update this report if anything pops out, but I don't
expect anything. All changes were taken from the qemu master branch,
where things are being tested all the time too.
[ Risks ]
This is a big update, with large number of changes. Most of them are
small and easy to verify, but some are more complex. However I don't
expect significant risks from this update, as has been usual for the
stable qemu updates.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
d/changelog differences is on top of the debdiff.
[ Other info ]
The diff between two source tarballs is rather large, due to the amount
of individual changes included in this release. It might be better to
see individual commits on salsa, from
https://salsa.debian.org/qemu-team/qemu/-/commits/v10.0.12
up to v10.0.11 which is already in debian. The same commits and tags
can be found on the upstream qemu git repository,
https://gitlab.com/qemu-project/qemu
Thanks,
/mjt
diff -Nru qemu-10.0.11+ds/debian/changelog qemu-10.0.12+ds/debian/changelog
--- qemu-10.0.11+ds/debian/changelog 2026-06-28 08:33:17.000000000 +0300
+++ qemu-10.0.12+ds/debian/changelog 2026-07-25 09:35:02.000000000 +0300
@@ -1,8 +1,198 @@
+qemu (1:10.0.12+ds-0+deb13u1) trixie; urgency=medium
+
+ * new upstream stable/bugfix release:
+ - Update version for 10.0.12 release
+ - hw/audio/intel-hda: restrict all DMA engine paths to memories
+ (update to CVE-2021-3611)
+ - hw/net/cadence: Return current Cadence GEM queue pointers
+ - hw/misc/applesmc: Fix a typo setting MSSD key
+ - replay: fix use of uninitialized pointer on error
+ - hw/display/qxl: validate monitors_config heads[] in phys2virt
+ https://gitlab.com/qemu-project/qemu/-/work_items/4027
+ - net: Correct padding check in qemu_receive_packet()
+ - hw/net/xilinx_axienet: Fix PHY register 17 link status reporting
+ - hw/usb/hcd-xhci-sysbus: Fix OOB heap access in xhci_sysbus_intr_raise()
+ https://gitlab.com/qemu-project/qemu/-/work_items/4001
+ (Closes: CVE-2026-16043)
+ - hw/usb/hcd-xhci: Fix guest-triggerable assert() in xhci_find_stream()
+ https://gitlab.com/qemu-project/qemu/-/work_items/273, 2020-06-16
+ - usbredir: fix infinite loop and SIGFPE with zero max_packet_size
+ https://gitlab.com/qemu-project/qemu/-/work_items/3995
+ (Closes: CVE-2026-63319)
+ - usbredir: fix use-after-free on buffered bulk packet overflow
+ https://gitlab.com/qemu-project/qemu/-/work_items/3808
+ (Closes: CVE-2026-15705)
+ - tests/qtest: add xhci-pci unplug finalize regression test
+ - hw/usb/hcd-xhci-pci: break host link cycle so device_finalize()
+ runs on unplug
+ - hw/usb/xhci: clamp interval exponent to avoid UB shift
+ in xhci_init_epctx()
+ https://gitlab.com/qemu-project/qemu/-/work_items/3703
+ - accel/tcg: move jit thread manipulation into do_tb_phys_invalidate
+ https://gitlab.com/qemu-project/qemu/-/work_items/3444
+ - hw/display/virtio-gpu: Check pixman_image_create_bits() results
+ - hw/display/virtio-gpu: handle migration iov allocation failure
+ https://gitlab.com/qemu-project/qemu/-/work_items/3753
+ - hw/display/virtio-gpu: cap submit_3d command buffer allocation
+ https://gitlab.com/qemu-project/qemu/-/work_items/3776
+ - ui/vnc: validate SetPixelFormat field ranges
+ https://gitlab.com/qemu-project/qemu/-/issues/3976
+ (Closes: CVE-2026-15578)
+ - ui/vnc: fix out-of-bounds write in lossy refresh dirty marking
+ https://gitlab.com/qemu-project/qemu/-/work_items/3935
+ (Closes: CVE-2026-61475)
+ - ui/gtk: Narrow DMA-BUF critical section
+ - ui/input-barrier: fix off-by-one in keycode bounds check
+ https://gitlab.com/qemu-project/qemu/-/issues/3951
+ - ui/vnc: validate color shifts in SetPixelFormat
+ https://gitlab.com/qemu-project/qemu/-/work_items/3948
+ - ui/vnc: fix OOB write in vnc_refresh_lossy_rect
+ https://gitlab.com/qemu-project/qemu/-/work_items/3950
+ (Closes: CVE-2026-48002)
+ - hw/usb/hcd-xhci: Turn guest-triggerable abort() into qemu_log_mask()
+ https://gitlab.com/qemu-project/qemu/-/work_items/3784
+ - hw/usb/hcd-ohci: Make sure that ohci_service_ed_list() cannot loop forever
+ https://gitlab.com/qemu-project/qemu/-/work_items/3781
+ - hw/display/virtio-gpu: fix dmabuf_fd leak on remap failure
+ - hw/scsi/vmw_pvscsi: add a comment to explain the endianness
+ - hw/scsi/vmw_pvscsi: translate data endianness
+ - hw/sparc64/niagara: use int64_t for vdisk size to avoid truncation
+ - hw/display/qxl: fix TOCTOU in cursor chunk data_size handling
+ https://gitlab.com/qemu-project/qemu/-/work_items/3757
+ - hw/misc/ivshmem: clear chardev handlers before freeing peers
+ https://gitlab.com/qemu-project/qemu/-/work_items/3594
+ - linux-user/alpha: populate AT_HWCAP from env->amask
+ - linux-user/alpha: add coredump support
+ - s390x/css: firm up handling of chained TIC CCWs
+ - s390x/sclp: prevent re-reading the sclp header
+ - hw/s390x/sclp: Do not ignore address_space_read/write() errors
+ - hw/s390x/sclp: Replace [cpu_physical_memory -> address_space]_r/w()
+ - hw/misc/stm32_rcc: Correct offset-to-irq calculation
+ - hw/display/sm501: Don't allow guest to set ram size larger than it is
+ https://gitlab.com/qemu-project/qemu/-/work_items/3811
+ - hw/display/sm501: Avoid overflow problems in bounds check calculations
+ https://gitlab.com/qemu-project/qemu/-/work_items/3584
+ - hw/display/sm501: Catch bad coordinates for RTL operations
+ https://gitlab.com/qemu-project/qemu/-/work_items/3920
+ - hw/usb/dev-wacom: Don't write off end of buffer
+ https://gitlab.com/qemu-project/qemu/-/work_items/3672
+ - hw/net/vmxnet3: Correct bounds check on tx queue index
+ https://gitlab.com/qemu-project/qemu/-/work_items/3780
+ - target/arm: Be more defensive for invalid tlbi_aa64_get_range
+ - linux-user: Validate guest-passed dm_ioctl data_size
+ https://gitlab.com/qemu-project/qemu/-/work_items/3736
+ - tests: update SPCR loongarch64 and riscv64 test data
+ - hw/acpi: correct field sequence in SPCR table
+ https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2146419
+ - tests: allow differences in SPCR
+ - hw/pci/pcie_doe: Check mailbox length for overflows
+ https://gitlab.com/qemu-project/qemu/-/work_items/3679
+ - hw/riscv/riscv-iommu: Fix MemoryRegion owner
+ - hw/riscv/riscv-iommu.c: set ftype and iova in riscv_iommu_ctx()
+ https://gitlab.com/qemu-project/qemu/-/work_items/3564
+ - hw/riscv: riscv-iommu: Don't look up DDT cache in Off and Bare modes
+ - hw/riscv/riscv-iommu: Avoid caching PCI device IDs
+ - hw/riscv/riscv-iommu: forbid GATE/SADE if caps.AMO_HWADD is zero
+ https://gitlab.com/qemu-project/qemu/-/work_items/3549
+ - hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch()
+ https://gitlab.com/qemu-project/qemu/-/work_items/3559
+ - hw/riscv/riscv-iommu.c: check for misaligned IOHGATP_PPN
+ https://gitlab.com/qemu-project/qemu/-/work_items/3550
+ - hw/riscv/riscv-iommu-sys.c: record fault on IOMMU-generated MSI write
+ https://gitlab.com/qemu-project/qemu/-/work_items/3572
+ - hw/riscv/riscv-iommu.c: check reserved MSI PTE basic bits
+ https://gitlab.com/qemu-project/qemu/-/work_items/3563
+ - hw/riscv/riscv-iommu.c: fault for non-user PTE in G_STAGE
+ https://gitlab.com/qemu-project/qemu/-/work_items/3555
+ - hw/riscv/riscv-iommu.c: fault when !PTE_U and no priv access
+ https://gitlab.com/qemu-project/qemu/-/work_items/3553
+ - hw/riscv/riscv-iommu.c: check for reserved PTE bits
+ https://gitlab.com/qemu-project/qemu/-/work_items/3554
+ - hw/riscv/riscv-iommu.c: fix fault type for spa_fetch() faults
+ https://gitlab.com/qemu-project/qemu/-/work_items/3557
+ https://gitlab.com/qemu-project/qemu/-/work_items/3577
+ - hw/ufs: avoid double unref of wrapped scsi-hd
+ - target/sh4: fixup tcg for sh4 fipr/ftrv instructions
+ - tcg/loongarch64: Fix cmp_vec with TCG_COND_NE
+ https://gitlab.com/qemu-project/qemu/-/work_items/3589
+ - tcg/loongarch64: Improve constraints for TCG_CT_CONST_VCMP
+ - tcg/loongarch64: Fix vec_val computation in tcg_target_const_match
+ - accel/tcg: Make PageFlagsNodes' start and last immutable
+ - accel/tcg: Use TLB_FORCE_SLOW not TLB_MMIO for user-only plugins
+ - hw/net: fix e1000e/igb ip_len inflation by Ethernet minimum-frame padding
+ - hw/core/qdev-clock: Fix potential null pointer dereference
+ https://gitlab.com/qemu-project/qemu/-/work_items/2342
+ - vdpa: fix use-after-free of vqs in vhost_vdpa_device_unrealize
+ - hw/display/qxl: Fix mono cursor validation that can read
+ past a cursor chunk
+ https://gitlab.com/qemu-project/qemu/-/work_items/3646
+ - hw/scsi/mptsas: Reset doorbell state on reset
+ https://gitlab.com/qemu-project/qemu/-/work_items/304, 2020-12-17
+ - hw/dma/i8257: Return zeroes for read_memory in verify mode
+ https://gitlab.com/qemu-project/qemu/-/work_items/3487
+ - tests/qtest/ahci: test ATAPI read completing after engine restart
+ - hw/ide/ahci: cancel in-flight buffered reads on command engine restart
+ - hw/misc/edu: restrict dma access to dma buffer
+ https://gitlab.com/qemu-project/qemu/-/work_items/3852
+ - s390x/css: limit number of CHPIDs in description
+ - s390x/ioinst: Require strict length and format for SEI CHSC handler
+ - s390x/pci: Shrink RPCIT ranges to registered window
+ - s390x/pci: Tighten region detection for BAR read/write
+ - s390x/sclp: reject invalid write event data headers
+ - hw/nvme: ensure sgl forward progress
+ - hw/nvme: fix FDP set FDP events
+ https://gitlab.com/qemu-project/qemu/-/work_items/3631
+ - hw/arm: use cortex-a9 mpcore base for CBAR on npcm7xx machines
+ - hw/net/fsl_etsec: validate FCB offsets in process_tx_fcb()
+ https://gitlab.com/qemu-project/qemu/-/work_items/3517
+ - virtio-net: validate RSS indirections_len in post_load
+ - hw/char/virtio-serial-bus: fix guest-triggerable OOM in control_out()
+ https://gitlab.com/qemu-project/qemu/-/issues/3585
+ - hw/riscv/riscv-iommu.c: always fault with SADE=0 and A=0
+ https://gitlab.com/qemu-project/qemu/-/work_items/3551
+ - target/riscv: Apply UXL WARL handling to vsstatus
+ - target/riscv: avoid abort when reading vtype before env->xl is set
+ https://gitlab.com/qemu-project/qemu/-/issues/3545
+ - hw/riscv/virt-acpi-build: Fix RINTC PLIC context ID for KVM
+ - target/riscv: Check PMP before updating PTE
+ - hw/9pfs/local: harden local_fid_fd() on FID types
+ - hw/9pfs: fix invalid union access by v9fs_co_fstat()
+ - hw/9pfs: fix invalid union access by v9fs_co_fsync()
+ - tests/9p: add 3 xattr FID limit test cases (local fs driver)
+ - tests/9p: add 3 xattr FID limit test cases (synth fs driver)
+ - tests/9p: add virtio_9p_add_synth_driver_args() test client function
+ - tests/9p: increase P9_MAX_SIZE for test client
+ - hw/9pfs: add xattr count query interface to fs synth driver
+ - hw/9pfs: enable xattr (mockup) support for synth fs driver
+ - tests/9p: add Txattrcreate / Rxattrcreate test client functions
+ - tests/9p: add Tclunk / Rclunk test client functions
+ - tests/9p: add Tread / Rread test client functions
+ - qemu-options: document 9pfs max_xattr option
+ - hw/9pfs: add max_xattr option
+ - hw/9pfs: add xattr FID limit to prevent memory exhaustion
+ (Closes: CVE-2026-8348)
+ - hw/9pfs: cap Treaddir allocation
+ (Closes: CVE-2026-9238)
+ - 9pfs/xen: implement response_buffer_size callback
+ - 9pfs/virtio: implement response_buffer_size callback
+ - hw/9pfs: add response_buffer_size transport callback
+ - hw/9pfs: cap negotiated msize to transport limit
+ - 9pfs/xen: implement msize_limit callback
+ - 9pfs/virtio: implement msize_limit callback
+ - hw/9pfs: add msize_limit transport callback
+ - 9pfs: local : Introduce local_fid_fd() helper
+ - 9pfs: Don't use file descriptors in core code
+ - s390x/kvm: clamp stsi 3.2.2 size
+ - ui/gtk: fix bad widget realize on non-GFX VC
+
+ -- Michael Tokarev <mjt@tls.msk.ru> Sat, 25 Jul 2026 09:35:02 +0300
+
qemu (1:10.0.11+ds-0+deb13u1) trixie; urgency=medium
* new upstream stable/bugfix release:
- Update version for 10.0.11 release
- - linux-user: Fix AT_PHDR when program headers are relocated into their own segment
+ - linux-user: Fix AT_PHDR when program headers are relocated
+ into their own segment
- hw/pci: Replace assert with bounds check and return
- ppc/pnv_phb3: Error out on invalid config access
- linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn
@@ -45,7 +235,8 @@
- qemu-io: Add 'aio_discard' command
- virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check
(Closes: #1139923, CVE-2026-48914)
- - block/io: fallback to bounce buffer if BLKZEROOUT is not supported because of alignment
+ - block/io: fallback to bounce buffer if BLKZEROOUT is not supported
+ because of alignment
- s390x/pci: Fix interrupt forwarding disable for interpreted devices
- target/s390x: Make container ids in SysIB_15x 1-based
- tests/unit: add test-envlist covering setenv/unsetenv name matching
@@ -54,9 +245,11 @@
(Closes: CVE-2026-48004)
- tests/9pfs: add deep absolute path test
- tests/qtest/libqos: add qvirtqueue_reset_pool() for descriptor pool reset
- - hw/9pfs: let callers of v9fs_path_sprintf() and v9fs_fix_path() handle errors
+ - hw/9pfs: let callers of v9fs_path_sprintf() and v9fs_fix_path()
+ handle errors
- hw/9pfs: add error handling to v9fs_fix_path()
- - hw/9pfs: change V9fsPath.size to size_t and v9fs_path_sprintf() return type
+ - hw/9pfs: change V9fsPath.size to size_t and v9fs_path_sprintf()
+ return type
- hw/9pfs: add NULL check in v9fs_path_is_ancestor()
- hw/9pfs: move G_GNUC_PRINTF to header
- linux-user/s390x: restore fpu_status rounding mode from FPC on sigreturn
diff -Nru qemu-10.0.11+ds/debian/control.mk qemu-10.0.12+ds/debian/control.mk
--- qemu-10.0.11+ds/debian/control.mk 2026-06-28 08:22:14.000000000 +0300
+++ qemu-10.0.12+ds/debian/control.mk 2026-07-25 09:35:02.000000000 +0300
@@ -9,7 +9,7 @@
# since some files and/or lists differ from version to version,
# ensure we have the expected qemu version, or else scream loudly
-checked-version := 10.0.11+ds
+checked-version := 10.0.12+ds
# version of last vdso change for d/control Depends field:
vdso-version := 1:9.2.0~rc3+ds-1~
diff -Nru qemu-10.0.11+ds/VERSION qemu-10.0.12+ds/VERSION
--- qemu-10.0.11+ds/VERSION 2026-06-26 00:39:13.000000000 +0300
+++ qemu-10.0.12+ds/VERSION 2026-07-25 01:10:12.000000000 +0300
@@ -1 +1 @@
-10.0.11
+10.0.12
diff -Nru qemu-10.0.11+ds/accel/tcg/tb-maint.c qemu-10.0.12+ds/accel/tcg/tb-maint.c
--- qemu-10.0.11+ds/accel/tcg/tb-maint.c 2026-06-26 00:39:13.000000000 +0300
+++ qemu-10.0.12+ds/accel/tcg/tb-maint.c 2026-07-25 01:10:12.000000000 +0300
@@ -921,6 +921,7 @@
uint32_t orig_cflags = tb_cflags(tb);
assert_memory_lock();
+ qemu_thread_jit_write();
/* make sure no further incoming jumps will be chained to this TB */
qemu_spin_lock(&tb->jmp_lock);
@@ -931,33 +932,27 @@
phys_pc = tb_page_addr0(tb);
h = tb_hash_func(phys_pc, (orig_cflags & CF_PCREL ? 0 : tb->pc),
tb->flags, tb->cs_base, orig_cflags);
- if (!qht_remove(&tb_ctx.htable, tb, h)) {
- return;
- }
+ if (qht_remove(&tb_ctx.htable, tb, h)) {
- /* remove the TB from the page list */
- if (rm_from_page_list) {
- tb_remove(tb);
- }
+ /* remove the TB from the page list */
+ if (rm_from_page_list) {
+ tb_remove(tb);
+ }
- /* remove the TB from the hash list */
- tb_jmp_cache_inval_tb(tb);
+ /* remove the TB from the hash list */
+ tb_jmp_cache_inval_tb(tb);
- /* suppress this TB from the two jump lists */
- tb_remove_from_jmp_list(tb, 0);
- tb_remove_from_jmp_list(tb, 1);
+ /* suppress this TB from the two jump lists */
+ tb_remove_from_jmp_list(tb, 0);
+ tb_remove_from_jmp_list(tb, 1);
- /* suppress any remaining jumps to this TB */
- tb_jmp_unlink(tb);
+ /* suppress any remaining jumps to this TB */
+ tb_jmp_unlink(tb);
- qatomic_set(&tb_ctx.tb_phys_invalidate_count,
- tb_ctx.tb_phys_invalidate_count + 1);
-}
+ qatomic_set(&tb_ctx.tb_phys_invalidate_count,
+ tb_ctx.tb_phys_invalidate_count + 1);
+ }