qemu (1:6.2+dfsg-2ubuntu6.31) jammy; urgency=medium

  * d/qemu-guest-agent.postinst: trigger udev rule to start the service
    (LP: #2102093)
  * d/p/u/lp2133804/*: linux-user: Add termios2 support (LP: #2133804)

 -- Hector Cao <hector.cao@canonical.com>  Wed, 22 Apr 2026 11:24:43 +0200

qemu (1:6.2+dfsg-2ubuntu6.30) jammy-security; urgency=medium

  * SECURITY UPDATE: use-after-free
    - debian/patches/CVE-2024-6519-pre1.patch: dd missing decrement of
      reentrancy counter in hw/scsi/lsi53c895a.c.
    - debian/patches/CVE-2024-6519.patch: keep a reference to the device while
      SCRIPTS in hw/scsi/lsi53c895a.c.
    - CVE-2024-6519
  * SECURITY UPDATE: out-of-bounds read
    - debian/patches/CVE-2026-2243.patch: fix OOB read in vmdk_read_extent()
      in block/vmdk.c.
    - CVE-2026-2243

 -- Fabian Toepfer <fabian.toepfer@canonical.com>  Wed, 01 Apr 2026 18:19:07 +0200

qemu (1:6.2+dfsg-2ubuntu6.29) jammy; urgency=medium

  * Fix crash on concurrent `block-stream` and `query-named-block-nodes`
    (LP: #2126951)
    - d/p/ubuntu/lp2126951-block-Drop-detach_subchain-for-bdrv_replace_node.patch

 -- Wesley Hershberger <wesley.hershberger@canonical.com>  Wed, 11 Mar 2026 09:13:21 -0500

qemu (1:6.2+dfsg-2ubuntu6.28) jammy-security; urgency=medium

  * SECURITY UPDATE: denial-of-service
    - debian/patches/CVE-2024-8354-2.patch: don't assert for SETUP to non-0
      endpoint in hw/usb/hcd-uhci.
    - CVE-2024-8354
  * SECURITY UPDATE: use-after-free
    - debian/patches/CVE-2025-11234-1.patch: release active GSource in TLS
      channel finalizer in io/channel-tls.c.
    - debian/patches/CVE-2025-11234-2.patch: move websock resource release to
      close method in io/channel-websock.c.
    - debian/patches/CVE-2025-11234-3.patch: fix use after free in websocket
      handshake code in io/channel-websock.c.
    - CVE-2025-11234

 -- Fabian Toepfer <fabian.toepfer@canonical.com>  Tue, 03 Mar 2026 15:02:56 +0100

qemu (1:6.2+dfsg-2ubuntu6.27) jammy-security; urgency=medium

  * SECURITY UPDATE: double-free in QEMU virtio devices
    - debian/patches/CVE-2024-3446-pre1.patch: add an optional reentrancy
      guard to the BH API in docs/devel/multiple-iothreads.txt,
      include/block/aio.h, include/qemu/main-loop.h,
      tests/unit/ptimer-test-stubs.c, util/async.c, util/main-loop.c,
      util/trace-events.
    - debian/patches/CVE-2024-3446-pre2.patch: replace most qemu_bh_new
      calls with qemu_bh_new_guarded.
    - debian/patches/CVE-2024-3446-pre3.patch: introduce
      virtio_bh_new_guarded() helper in hw/virtio/virtio.c,
      include/hw/virtio/virtio.h.
    - debian/patches/CVE-2024-3446-1.patch: protect from DMA re-entrancy
      bugs in hw/virtio/virtio-crypto.c.
    - debian/patches/CVE-2024-3446-2.patch: protect from DMA re-entrancy
      bugs in hw/char/virtio-serial-bus.c.
    - debian/patches/CVE-2024-3446-3.patch: protect from DMA re-entrancy
      bugs in hw/display/virtio-gpu.c.
    - CVE-2024-3446
  * SECURITY UPDATE: heap overflow in SDHCI device emulation
    - debian/patches/CVE-2024-3447.patch: do not update TRNMOD when Command
      Inhibit (DAT) is set in hw/sd/sdhci.c.
    - CVE-2024-3447
  * SECURITY UPDATE: resource consumption in disk utility
    - debian/patches/CVE-2024-4467-pre1.patch: do not reopen data_file in
      invalidate_cache in block/qcow2.c.
    - debian/patches/CVE-2024-4467-1.patch: don't open data_file with
      BDRV_O_NO_IO in block/qcow2.c, tests/qemu-iotests/061*.
    - debian/patches/CVE-2024-4467-2.patch: don't store data-file with
      protocol in image in tests/qemu-iotests/244.
    - debian/patches/CVE-2024-4467-3.patch: don't store data-file with
      json: prefix in image in tests/qemu-iotests/270.
    - debian/patches/CVE-2024-4467-4.patch: parse filenames only when
      explicitly requested in block.c.
    - CVE-2024-4467
  * SECURITY UPDATE: heap overflow in virtio-net device RSS feature
    - debian/patches/CVE-2024-6505.patch: ensure queue index fits with RSS
      in hw/net/virtio-net.c.
    - CVE-2024-6505
  * SECURITY UPDATE: Dos via improper synchronization during socket closure
    - debian/patches/CVE-2024-7409-1.patch: plumb in new args to
      nbd_client_add() in blockdev-nbd.c, include/block/nbd.h,
      nbd/server.c, qemu-nbd.c.
    - debian/patches/CVE-2024-7409-2.patch: cap default max-connections to
      100 in block/monitor/block-hmp-cmds.c, blockdev-nbd.c,
      include/block/nbd.h, qapi/block-export.json.
    - debian/patches/CVE-2024-7409-3.patch: close stray clients at
      server-stop in blockdev-nbd.c.
    - debian/patches/CVE-2024-7409-4.patch: drop non-negotiating clients in
      nbd/server.c, nbd/trace-events.
    - debian/patches/CVE-2024-7409-5.patch: avoid use-after-free when
      closing server in blockdev-nbd.c.
    - CVE-2024-7409
  * SECURITY UPDATE: DoS via assert failure in usb_ep_get()
    - debian/patches/CVE-2024-8354.patch: change ohci validation in
      hw/usb/hcd-ohci.c, hw/usb/trace-events.
    - CVE-2024-8354
  * SECURITY UPDATE: possibly binfmt privilege escalation (LP: #2120814)
    - debian/binfmt-install: stop using C (Credentials) flag for
      binfmt_misc registration.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 25 Aug 2025 19:16:14 -0400

qemu (1:6.2+dfsg-2ubuntu6.26) jammy; urgency=medium

  [ Christian Ehrhardt ]
  * d/p/u/lp-2098896-hw-nvme-fix-narrowing-conversion.patch:
    Fix nvme devices >= 1 TiB in size (LP: #2098896)
    Thanks to Ryan Harper for the report, bisect and preparation!
  * d/p/u/lp-2019967-*: Add Rome types with updated cache info (LP: #2019967)

 -- Lukas Märdian <slyon@ubuntu.com>  Wed, 05 Mar 2025 11:48:26 +0100

qemu (1:6.2+dfsg-2ubuntu6.25) jammy; urgency=medium

  * d/p/u/lp-2019968-add-missing-feature-bits-epyc-milan-*.patch: Add
    missing feature bits to EPYC-Milan CPU model. (LP: #2019968)

  [ Louis Bouchard ]
  * d/p/monitor-only-run-coroutine-commands-in-qemu_aio_cont.patch:
    Backport upstream fix for qmp timeouts.
    Upstream commit effd60c878176bcaf97fa7ce2b12d04bb8ead6f7
    (LP: #2091013)

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Wed, 29 Jan 2025 13:30:23 -0500

qemu (1:6.2+dfsg-2ubuntu6.24) jammy-security; urgency=medium

  * SECURITY UPDATE: denial of service
    - debian/patches/CVE-2023-3019-pre1.patch: Add definition for
      MemReentrancyGuard struct and add to DeviceState struct
    - debian/patches/CVE-2023-3019-1.patch: Provide MemReentrancyGuard * 
      to qemu_new_nic()
    - debian/patches/CVE-2023-3019-2.patch: Update MemReentrancyGuard for
      NIC
    - CVE-2023-3019

 -- Bruce Cable <bruce.cable@canonical.com>  Tue, 22 Oct 2024 16:33:28 +1100

qemu (1:6.2+dfsg-2ubuntu6.23) jammy; urgency=medium

  * Implement support for secure execution guest dump encryption with
    customer keys on s390x. (LP: #1959966)
    - d/p/u/lp1959966-kvm-secure-guest-exec-*.patch: Backport upstream
      patches to implement feature.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Tue, 20 Aug 2024 14:35:13 -0400

qemu (1:6.2+dfsg-2ubuntu6.22) jammy-security; urgency=medium

  * SECURITY UPDATE: null dereference
    - debian/patches/CVE-2023-6683-1.patch: Check size before
      populating info->types data
    - debian/patches/CVE-2023-6683-2.patch: Check clipboard types
      for if a callback needs to be set
    - CVE-2023-6683
  * SECURITY UPDATE: stack based buffer overflow
    - debian/patches/CVE-2023-6693.patch: Correctly copy vnet header 
      when flushing TX
    - CVE-2023-6693
  * SECURITY UPDATE: integer underflow
    - debian/patches/CVE-2024-24474.patch: Restrict non-DMA transfer 
      length to that of available data
    - CVE-2024-24474

 -- Bruce Cable <bruce.cable@canonical.com>  Thu, 01 Aug 2024 13:08:05 +1000

# For older changelog entries, run 'apt-get changelog qemu-utils'
