This bug was fixed in the package qemu-hwe - 1:11.0.3+ds-2ubuntu2
---------------
qemu-hwe (1:11.0.3+ds-2ubuntu2) stonking; urgency=medium
* Merge with src:qemu (LP: #2153234). Remaining changes:
- d/*: creation of hwe packages (LP 2143146)
* New changes
- revert: d/control-in: add dependencies to -hwe components (LP 2143146)
- d/hwe-helper/99-ubuntu-virt.conf: Fix version setting for the hook script
This can be squashed into: hwe: create -hwe packages
qemu (1:11.0.3+ds-2ubuntu1) stonking; urgency=medium
* Merge with Debian unstable (LP: #2153234). Remaining changes:
- Add qemu-kvm host preparation systemd unit
(LP 2157739 2033565)
+ d/qemu-kvm-init: preparation script (KVM modules, arch specifics)
+ d/qemu-system-common.qemu-kvm.service: systemd oneshot unit invoking
qemu-kvm-init
+ d/qemu-system-common.install: install helper script
+ d/rules: call dh_installinit and dh_installsystemd for qemu-kvm
- Ubuntu specific machine types
(LP 1304107 1621042 1776189 1761372 1761372 1776189 2131822)
+ d/p/ubuntu/define-ubuntu-machine-types.patch: define distro machine
types with release-versioned machine attributes; add the ubuntu-q35
alias selecting the most recent q35 ubuntu type; add v2 types for
arch_caps handling and to fix the questing type's wrong base version;
emit a hint when instantiating a now-unsupported old guest type
+ d/qemu-system-x86.NEWS: document the -hpb (huge-page-backed) type
- Enable nesting by default
+ d/p/ubuntu/enable-svm-by-default.patch: Enable nested svm by default
in qemu64 on amd
[ No more strictly needed, but required for backward compatibility ]
- d/rules: Use upstream vDSO on non-amd64 architectures and disable
upstream tests depending on qemu-system-data
- d/control-in: B-D on multipath libs for multipath persist in
qemu-pr-helper (LP 2117378)
- d/control-in: add dependencies to -hwe components (LP 2143146)
- d/p/u/lp2133188/*: Add riscv64 vector state to signal context
(LP 2133188)
- d/p/u/* : fix early stop for module loading function
(LP 2146445)
- Make Zicbop extension available in RISC-V KVM VMs (LP 2154708)
+ d/p/u/target-riscv-kvm-add-KVM-support-for-Zicbop-extensio.patch
* Dropped changes:
- d/control: remove dependency on deprecated edk2 arm
(LP 2145209)
[Fixed in Debian 1:11.0.0+ds-1]
- d/qemu-guest-agent.postinst: trigger udev rule to start the service
(LP 2102093)
[Fixed in Debian 1:11.0.0+ds-1]
- d/qemu-block-extra.postinst: Use latest Ubuntu's QEMU
package version when deciding whether to invoke
'deb-systemd-helper purge'.
[This can be dropped since we are after 26.04]
- tolerate ipxe size change on migrations to >=18.04 (LP 1713490)
+ d/p/ubuntu/pre-bionic-256k-ipxe-efi-roms.patch: old machine types
reference 256k path
+ d/control-in: depend on ipxe-qemu-256k-compat-efi-roms to be able to
handle incoming migrations from former releases.
[Machine type 2.10 is removed]
- Fix race condition when using iothreads and throttle groups (LP 2150154)
+ d/p/lp2150154-1-*.patch
[Fixed in upstream v11.0.0]
- Fix crash due to memory region unset for virgl (LP 2156706)
d/u/virtio-gpu-virgl-Add-virtio-gpu-virgl-hostmem-region.patch
[Fixed in upstream v11.0.0]
- d/control-in: breaks/replaces for dtb files moving qemu-system-misc
to qemu-system-data
[Can be dropped after 26.04]
- d/rules: Use upstream vDSO for architecture variant builds (LP 2131236)
[squashed to Use upstream vDSO on non-amd64 architectures]
- d/p/u/hw-acpi-correct-field-sequence-in-SPCR-table (LP 2146419)
[Fixed in upstream 11.0.3]
* The following bugs are fixed in the new merged Debian/Upstream version:
- s390x - interface hardening fixes (LP: #2160034)
[Fixed in upstream 11.0.3]
- Fix silent guest data loss during drive-mirror/blockdev-mirror/active
blockcommit startup race (LP: #2156307).
[Fixed in upstream 11.0.0]
- s390x: Make container ids in SysIB_15x 1-based (LP: #2164517)
[Fixed in upstream 11.0.2]
qemu (1:11.0.3+ds-2) unstable; urgency=medium
* iotest-161-fix-race.patch: try to address iotest 161 race
qemu (1:11.0.3+ds-1) unstable; urgency=medium
[ Miao Wang ]
* target-loongarch-fix-data-race-in-CSR_ESTAT.patch
fix dracut test error on loong64
[ Michael Tokarev ]
* new upstream stable/bugfix release
* drop patches which were applied upstream
qemu (1:11.0.2+ds-2) unstable; urgency=medium
[ Miao Wang ]
* pvscsi-translate-data-endianness.patch
fix x86_64 ovmf test error on s390x
* target-loongarch-Enable-TARGET_PAGE_BITS_VARY-for-lo.patch
fix qemu-loong64 test error on loong64
* target-loongarch-Fixes-for-endianness-problems-in-ve.patch
fix qemu-loong64 test error on s390x
qemu (1:11.0.2+ds-1) unstable; urgency=medium
[ Michael Tokarev ]
* new upstream stable/bugfix release:
- Update version for 11.0.2 release
- linux-user: Fix AT_PHDR when program headers are relocated
into their own segment
- hw/pci: Replace assert with bounds check and return
- ppc/pnv_phb3: Error out on invalid config access
- linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn
- linux-user/xtensa: save/restore FP registers across signal delivery
- target/xtensa: add cpu_set_fcr/fsr helpers to sync fp_status
- target/arm/hvf: Stop pre-allocating cpreg_vmstate arrays
- ui/sdl2: Set GL ES profile before creating initial GL context
- ui/sdl2: Explicitly specify EGL platform
- hw/9pfs: reject . and .. in Twstat rename
- hw/9pfs: fix abort due to illegal name with Twstat rename
- gdbstub: Update x86 control register bits
- target/i386: apply mod to immediate count of an RCL/RCR operation
- hw/uefi: fix parse_hexstr
(Closes: CVE-2026-48915)
- target/riscv: mask vxrm csrw write to the low 2 bits
- disas/riscv.c: fix inst_length()
- target/riscv/tcg: disable svnapot if satp_mode < sv39
- target/riscv/cpu_helper.c: add PMA access fault
- target/riscv/cpu_helper.c: fault with reserved PTE.PBMT val
- target/riscv/insn_trans/trans_rvzicbo.c.inc: save opcode before helpers
- disas/riscv.c: add 'cbo' insns to disassembler
- target/riscv/csr.c: fix mstatus.UXL reserved value
- target/riscv/csr.c: do not allow mstatus MPV/GVA writes
- target/riscv/tcg: disable svpbmt if satp_mode < sv39
- target/riscv/cpu_helper.c: allow LOAD_ADDR_MIS promotion to AMO fault
- virtio: Allow to fill a whole virtqueue in order
- amd_iommu: Reject non-decreasing NextLevel in fetch_pte()
- amd_iommu: Follow root pointer before page walk and use 1-based levels
- libvduse: fix buffer overflow in vduse_queue_read_indirect_desc()
(Closes: CVE-2026-6425)
- libvhost-user: fix buffer overflow in virtqueue_read_indirect_desc()
(Closes: CVE-2026-6425)
- tests/qtest: Add amd-iommu command buffer head wrap test
- amd_iommu: Update command buffer head ptr in MMIO region after wraparound
- amd_iommu: restrict command buffer head/tail ranges to ring size
- linux-user: add preadv2/preadv2
- system/rtc: Fix a possible year-2038 integer overflow problem
- linux-user/strace: add fsmount series of syscalls
- linux-user: implement fsmount(2) series of syscalls
- fpu: Handle all rounding modes in partsN_uncanon_normal
- hw/usb/hcd-ohci: Clean up USBPacket before freeing ISO TD packet
- qed: Don't try to flush during incoming migration
- iotests: test shared mmap for fuse export
- block/export/fuse: set FUSE_DIRECT_IO_ALLOW_MMAP flag to fix regression
- block/export/fuse: use struct fuse_init_in
- qcow2: Fix data loss on zero write with detect-zeroes=unmap
- iotests/046: Test that discard/write_zeroes wait for dependencies
- qcow2: Fix corruption on discard during write with COW
- qemu-io: Add 'aio_discard' command
- virtio-blk: add missing VIRTIO_BLK_T_SCSI_CMD size check
(Closes: #1139923, CVE-2026-48914)
- block/io: fallback to bounce buffer if BLKZEROOUT is not supported
because of alignment
- hw/i3c: fix CMD/data FIFO depth reset values to match real silicon
- s390x/pci: Fix interrupt forwarding disable for interpreted devices
- target/s390x: Make container ids in SysIB_15x 1-based
- lcitool: remove Cirrus CI support
- gitlab: remove x64-freebsd-14-build Cirrus job
- gitlab: add initial MacOS 15 on gitlab runner
- ci: drop cirrus MacOS build
- tests/unit: add test-envlist covering setenv/unsetenv name matching
- util/envlist: fix prefix-match in envlist_unsetenv() name lookup
- 9pfs: fix missing rename lock in v9fs_co_readdir_many
(Closes: CVE-2026-48004)
- tests/9pfs: add deep absolute path test
- tests/qtest/libqos: add qvirtqueue_reset_pool() for descriptor pool reset
- hw/9pfs: let callers of v9fs_path_sprintf() and v9fs_fix_path()
handle errors
- hw/9pfs: add error handling to v9fs_fix_path()
- hw/9pfs: change V9fsPath.size to size_t and v9fs_path_sprintf()
return type
- hw/9pfs: add NULL check in v9fs_path_is_ancestor()
- linux-user/s390x: restore fpu_status rounding mode from FPC on sigreturn
- linux-user/sh4: restore FP rounding mode on sigreturn
- linux-user/sh4: preserve T/M/Q bits across signal delivery
- linux-user/mips: save/restore FCSR across signal delivery
- linux-user/ppc: restore fp_status from FPSCR on sigreturn
- hw/net/rocker_of_dpa: Avoid unaligned accesses in _of_dpa_flow_match()
- hw/net/rocker_of_dpa: Check group ID pointers are not NULL
- target/arm: SME BFCVT, BFCVTN have "Alternate BFloat16 behaviors"
- target/arm: Don't assert if 64-bit EL2 AT insn sees a Domain fault
- target/arm: Enable REVD for SVE2.1
- vfio/container: Restrict dma_map_file() to shared RAM or RAM devices
- vfio-user: reject zero migration page size capability
- vfio-user: reject zero DMA page size capability
- target/arm: Set correct fp flags for FLOGB when FPCR.AH = 1
- target/arm: Use FPST_A64_F16 for SVE FCVTLT_hs
- target/arm: SVE2 FMAXP, FMINP must honour AH=1
- block/linux-aio: bound ioq_submit() recursion depth
- mc146818rtc: Fix get_guest_rtc_ns() overflow bug
- apic: fix delivery bitmask with modified xAPIC ids
- lsi53c895a: clear tag byte when processing messages
- lsi53c895a: fix use-after-free of cancelled request
- ui: fix validation of VNC extended clipboard data length
(Closes: CVE-2026-8343)
- ui/vnc: fix OOB read updating VNC update frequency stats
(Closes: CVE-2026-48003)
- ui/vnc: fix OOB write in lossy rect worker code
(Closes: CVE-2026-48002)
- ui/vnc: fix OOB write in VNC stats array
(Closes: CVE-2026-48002)
- ui/vnc: fix OOB read access in VNC SASL mechname array
- linux-user/mips64: fix mipsn32 elf_core_copy_regs entry width
- linux-user/mips64: fix elf_core_copy_regs register layout in core files
- target/riscv: Make hpmcounterh return the upper 32-bits
- target/riscv/csr.c: fix read of pmpaddr(0-63) CSRs
- target/riscv: clear mseccfg on reset for all dependent extensions
- target/riscv: Update the local interrupt mask
- target/riscv: Add mseccfg to VMStateDescription
- target/riscv/pmp: Fix integer overflow in TOR and NA4 address computation
- target/riscv: Fix medeleg[11] read-only zero bit for M-mode ECALL
- hw/char: Check interrupt after txctrl register is written
- target/riscv: rvv: Handle source overlap of vector widening reduction
instructions
- target/riscv: Allow mseccfg access based on ext_zicfilp
- hw/riscv/riscv-iommu: Fix Svnapot 64KB pages
- target/riscv: Update MISA.X for non-standard extensions
- target/riscv: Update MISA.C for Zc* extensions
- crypto: fix client side anonymous TLS credentials
* tcg-loongarch64-Fix-cmp_vec-with-TCG_COND_NE.patch
[ Miao Wang ]
* tests/test-qemu-user.sh: also test qemu-loong64
* tests/test-qemu-user.sh: skip armhf when page size is large than 4K
qemu (1:11.0.1+ds-1) unstable; urgency=medium
* new upstream stable/bugfix release
Closes: multiple vulnerabilities in the UEFI code:
CVE-2026-8341 CVE-2026-41435 CVE-2026-41436 CVE-2026-41437
CVE-2026-41438 CVE-2026-41439 CVE-2026-41440
* remove hw-display-don-t-accidentally-autofree-existing-virg.patch
* d/control: add Depends: native-architecture to qemu-user-binfmt
(Closes: #1136993)
Similar dependency for qemu-user should probably be added too
qemu (1:11.0.0+ds-2) unstable; urgency=medium
* d/changelog: wrap long lines in previous entry
* d/control: promote ipxe-qemu & seabios to Depends for all qemu-system-ARCH
(Closes: #1135696)
* hw-display-don-t-accidentally-autofree-existing-virg.patch (CVE-2026-6502)
qemu (1:11.0.0+ds-1) unstable; urgency=medium
[ Michael Tokarev ]
* d/changelog: mention closing of #1129349
* d/patches,d/control: drop disable-pycotap.patch,
build-depend on python3-pycotap instead
* d/control: rdma is only needed for system build on linux
* d/control: libudev is only needed for system build on linux
* d/rules: make --enable-tools to depend on qemu-utils
being in build packages list or not
* new upstream release (11.0)
Closes: CVE-2026-5744 (hw/uefi: heap overflow)
Closes: CVE-2026-5761 (virtio-blk: zone report buffer out-of-memory)
Closes: CVE-2026-5763 (virtio-scsi request size mismatch)
Closes: CVE-2026-3890 (hcd-ohci: infinite loop)
Closes: #1085299, CVE-2024-6519 (UAF in lsi53c895a)
* d/copyright: remove obsolete linuxboot.bin & multiboot.bin
* d/patches: refresh
* d/control*: remove qemu-system-microblazeel
(now handled by qemu-system-microblaze -M endianness=big/little)
* d/control: add python3-pip build dependency
* d/control: add python3-qemu-qmp build dependency
* d/control: add python3-qemu-qmp to qemu-system-common:Suggests
* d/rules,d/qemu-system-common.install: install accel-qtest.so
* seabios-hppa-stdbool.diff: fix ftbfs
* d/control: remove 32bit host, system-arch and user-arch are always 64bits
* d/rules: drop another mention of 32bit host arch
* d/control: remove 32bit architectures from libseccomp build-dependency,
add comment
* d/rules: pass --cpu= explicitly for (some) 32bit architectures
* hw-q35-fix-VGA-text-console-with-SMM-disabled.patch: replace 1095935.patch
[ Hector Cao ]
* d/control-in: remove dependency on deprecated edk2 arm
* d/qemu-guest-agent.postinst: trigger udev rule to start the service
(Closes: #1134535)
qemu (1:10.2.2+ds-1) unstable; urgency=medium
* new upstream stable/bugfix release
Closes: #1128478, CVE-2026-2243
Closes: #1129604, CVE-2026-3195
Closes: #1129605, CVE-2026-3196
Closes: CVE-2026-3842
Closes: #1129349
* d/control: build utils on powerpc too
-- Hector Cao <[email protected]> Thu, 20 Aug 2026 14:52:30
+0200
** Changed in: qemu-hwe (Ubuntu)
Status: In Progress => Fix Released
** CVE added: https://cve.org/CVERecord?id=CVE-2024-6519
** CVE added: https://cve.org/CVERecord?id=CVE-2026-2243
** CVE added: https://cve.org/CVERecord?id=CVE-2026-3195
** CVE added: https://cve.org/CVERecord?id=CVE-2026-3196
** CVE added: https://cve.org/CVERecord?id=CVE-2026-3842
** CVE added: https://cve.org/CVERecord?id=CVE-2026-3890
** CVE added: https://cve.org/CVERecord?id=CVE-2026-41435
** CVE added: https://cve.org/CVERecord?id=CVE-2026-41436
** CVE added: https://cve.org/CVERecord?id=CVE-2026-41437
** CVE added: https://cve.org/CVERecord?id=CVE-2026-41438
** CVE added: https://cve.org/CVERecord?id=CVE-2026-41439
** CVE added: https://cve.org/CVERecord?id=CVE-2026-41440
** CVE added: https://cve.org/CVERecord?id=CVE-2026-48002
** CVE added: https://cve.org/CVERecord?id=CVE-2026-48003
** CVE added: https://cve.org/CVERecord?id=CVE-2026-48004
** CVE added: https://cve.org/CVERecord?id=CVE-2026-48914
** CVE added: https://cve.org/CVERecord?id=CVE-2026-48915
** CVE added: https://cve.org/CVERecord?id=CVE-2026-5744
** CVE added: https://cve.org/CVERecord?id=CVE-2026-5761
** CVE added: https://cve.org/CVERecord?id=CVE-2026-5763
** CVE added: https://cve.org/CVERecord?id=CVE-2026-6425
** CVE added: https://cve.org/CVERecord?id=CVE-2026-6502
** CVE added: https://cve.org/CVERecord?id=CVE-2026-8341
** CVE added: https://cve.org/CVERecord?id=CVE-2026-8343
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2156307
Title:
drive-mirror/blockdev-mirror/active blockcommit silently lose guest
writes during job startup
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2156307/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
