[Stable-10.0.13 v2 000/135] Patch Round-up for stable 10.0.13, freeze on 2026-08-24

The following patches are queued for QEMU stable v10.0.13:

  https://gitlab.com/qemu-project/qemu/-/commits/staging-10.0

Patch freeze is 2026-08-24, and the release is planned for 2026-08-26:

  https://wiki.qemu.org/Planning/10.0

Please respond here or CC [email protected] on any additional patches
you think should (or shouldn't) be included in the release.

The changes which are staging for inclusion, with the original commit hash
from master branch, are given below the bottom line.

Thanks!

/mjt

--------------------------------------
01* 702216619e2a Gerd Hoffmann:
   hw/uefi: add sanity check
02* ff5a9eb13c86 Gerd Hoffmann:
   hw/uefi: remove debug function
03* 647ba95eda5a Gerd Hoffmann:
   hw/uefi: check lower limit for signature list size
04* 8e0ddb4a6ebd Gerd Hoffmann:
   hw/uefi: account variable policy entries against storage size
05* acba2d78176d Gerd Hoffmann:
   hw/uefi: add post_load checks
06* bd9b3c50f458 Gerd Hoffmann:
   hw/uefi: make SetupMode read-only
07* c822ecd80661 Mario Casquero:
   vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom()
08* 256229e8f9b9 Tomita Moeko:
   vfio/igd: Clear saved BDSM in legacy VBIOS ROM at load time
09* dff528657fc1 Denis V. Lunev:
   vfio/pci: don't narrow a failed config read to a plausible value
10* 86abb10256a5 Denis V. Lunev:
   vfio/pci: reject invalid PCI_INTERRUPT_PIN values
11* 51aa3f3e0577 Andrey Polivoda:
   target/i386: helper_sysret(): Check that RCX contains a canonical address 
   when emulating an Intel CPU
12* d149a11c6c82 Paolo Bonzini:
   scsi-disk: protect against guest sending truncated data for MODE SELECT 
   commands
13* e2da3d92744d Paolo Bonzini:
   scsi-disk: fix off by one in assertion
14* 443e02410695 Artem Nasonov:
   hw/ide: replace assert with proper error handling
15* f604b807a55a Thomas Huth:
   hw/display/vmware_vga: Don't allow guest to trigger long running loop in 
   host
16* a0414545a212 Christian Schoenebeck:
   hw/9pfs: fix O_TRUNC bypass on read-only export
17* 210701c82e30 Jia Jia:
   hw/9pfs/virtio: drain in-flight PDUs before virtio-9p unrealize
18* 1de8aea061b9 Christian Schoenebeck:
   hw/9pfs/xen: drain in-flight PDUs before xen-9p disconnect
19* b7520c9a5912 Thomas Huth:
   hw/usb/dev-uas: Fix guest-triggerable heap OOB access
20* 9b899ddb2706 Thomas Huth:
   hw/ide/core: Fix possible crash via NULL pointer in ide_cancel_dma_sync()
21* 68809288c7e5 Thomas Huth:
   hw/usb/core: Avoid possible assert() in do_parameter() --> 
   usb_packet_copy()
22* 92abc3c51ebb Thomas Huth:
   hw/usb/hcd-xhci: Check return value of xhci_xfer_create_sgl() for errors
23* 861372428b05 Marc-André Lureau:
   hw/display/virtio-gpu: validate stride against width on scanout
24* 9c724426f519 Akihiko Odaki:
   hw/display/virtio-gpu: reject strides exceeding INT_MAX
25* 76dcc0832c5c Akihiko Odaki:
   hw/display/virtio-gpu: Remove the bytes_pp field
26* 1c1232c2ee07 Marc-André Lureau:
   hw/display/vhost-user-gpu: validate message payload sizes
27* efa7244b2a0b Marc-André Lureau:
   ui/vnc: remove redundant rows computation
28* 4727cc883b7e Haotian Jiang:
   hw/display/qxl: unregister vm_change_state handler and BHs
29* b28778131fad Marc-André Lureau:
   net/colo: fix g_hash_table_destroy assertion on uninitialized filter
30* 415f2759d7b3 Marc-André Lureau:
   target/i386/sev: fix MemoryRegion reference leaks in gpa2hva callers
31* 8ac0a1c7b98e Haotian Jiang:
   virtio-gpu: fix NULL deref in rutabaga set_scanout
32* 0fa3e1823b9b Akihiko Odaki:
   hw/display/virtio-gpu: Fix empty blob discrimination
33* 4ae1c5c7d6f3 Akihiko Odaki:
   hw/display/virtio-gpu: Initialize blob mapping for ATTACH_BACKING
34* 5322889f07b5 Marc-André Lureau:
   rutabaga: improve error handling, fix potential crash during init
35* 5c9ef661a60a Akihiko Odaki:
   hw/display/virtio-gpu: Block Rutabaga migration
36* 52c7bb369b23 Michael S. Tsirkin:
   virtio-net: fix OOB read in RSC receive path
37* 772488562053 Michael S. Tsirkin:
   virtio-net: fix short frame OOB read in receive_filter()
38* fbdfdbb9920c Michael S. Tsirkin:
   libvhost-user: protect against OOB writes in vu_set_inflight_fd
39* 758ef96a2dba Michael S. Tsirkin:
   libvhost-user: protect against OOB vring queue access
40* 6dbdc271f56b Laurent Vivier:
   hw/virtio: reject zero-length packed indirect descriptor table
41* 27806d2ddba2 Michael S. Tsirkin:
   vhost: do not crash on ring map failure
42* f404bf0e6504 Michael S. Tsirkin:
   virtio-scsi: fix SCSIRequest leak on a bad request
43* 665c854390e0 Michael S. Tsirkin:
   virtio: fail early on bad config_len in migration
44* cf89b769cdd1 Michael S. Tsirkin:
   vhost-user: assert nregions within limit
45* 5cc182ba39a3 Michael S. Tsirkin:
   virtio-pmem: wait for flush requests on unrealize
46* bf21298c082c Michael S. Tsirkin:
   libvhost-user: validate last_batch_head in vu_check_queue_inflights
47* b9d248dfaca5 Michael S. Tsirkin:
   libvhost-user: fix heap overflow in vu_check_queue_inflights
48* 733a98a552e4 Michael S. Tsirkin:
   libvduse: validate vq size
49* 67550d65b4bf Michael S. Tsirkin:
   virtio-iommu: fix OOM due to unbounded call_rcu
50* 7ea56dcc9406 Peter Maydell:
   hw/pci-host/q35.c: Always initialize smram-region even if SMM disabled
51* a90fcf0080da Peter Maydell:
   hw/pci-host/q35.c: Factor out creation of SMRAM MRs
52* e07c67584c69 Peter Maydell:
   hw/pci-host/q35.c: Avoid early return in mch_write_config()
53* 421f45d03f32 GuoHan Zhao:
   hw/virtio/vdpa-dev: pass set_config buffer to vhost backend
54* 292902ae4e93 Haotian Jiang:
   hw/cxl: fix OOB access in cxl_doe_cdat_rsp via entry_handle
55* 0691bb257a7c Clément MATHIEU--DRIF:
   intel_iommu: Check address mask before using it in pasid-based iotlb 
   invalidation
56* df12999cc813 Laurent Vivier:
   hw/net/virtio-net: Protect from DMA re-entrancy bugs
57* 0be94d8d9c28 Laurent Vivier:
   hw/virtio-rng: Fix host use-after-free (CVE-2026-50624)
58* 70074cc48f45 Laurent Vivier:
   backends/rng: cap request size to avoid oversized allocation
59* 6682ea339127 Stefan Hajnoczi:
   virtio: avoid packed vring virtio_queue_empty() infinite loops 
   (CVE-2026-16457)
60* 8268d216a004 Cédric Le Goater:
   linux-user: Guard local FUTEX_CMD_MASK definition
61* 8cbcf7579355 Peter Maydell:
   hw/net/xilinx_axienet: Don't write checksums off end of packet
62* aba80ad9d853 Matt Turner:
   linux-user: fix guards for the fsmount(2) syscall series
63* b395a655ae0e Laurent Vivier:
   hw/net/e1000e: recalculate rx_desc_len on migration load
64* 1e5efe6d9370 Laurent Vivier:
   hw/net/igb: recalculate rx_desc_len on migration load
65* d8813fdc4bdf Mark Cave-Ayland:
   target/sparc: set reg window data structures currently after vmstate load
66* db3abd36e4c7 Laurent Vivier:
   linux-user/sh4: allow full 32-bit address space
67* c4580a3a6d1c botszhuang:
   hw/i2c/bcm2835_i2c: Correct CLKT register offset
68* 4f635bddf50c Peter Maydell:
   hw/display/exynos4210_fimd: Factor out finding screen width/height
69* 7dd1e2218835 Peter Maydell:
   hw/display/exynos4210_fimd: Pass width to draw_line functions
70* a5f8d33682be Peter Maydell:
   hw/display/exynos4210_fimd: Clamp windows to screen size
71* a5cff318f06c Michael S. Tsirkin:
   virtio-mmio: fix QUEUE_NUM_MAX
72* df67805ee9b1 Klaus Jensen:
   hw/nvme: fix cross-namespace copy dif buffer overflow
73* c39e05af439a Klaus Jensen:
   hw/nvme: fix unintentional integer overflow in shift
74* 6e5ca34f3870 Daniel Paziyski:
   hw/nvme: fix assertion failure on subregion removal
75* 9e3df3019d21 Helge Deller:
   linux-user: Fix msqid_ds struct wrt 32-bit big endian architectures
76* 518a4aa01b88 no92:
   linux-user: fix incorrect msg_l[sr]pid members of target_msqid_ds
77* 0d3db94a8866 malike:
   block/cloop: fix integer overflow in total_sectors calculation
78* a55402d5c3a8 Kevin Wolf:
   block: Fix crash after setting latency historygram with single bin
79* 5b0ba385a024 Denis V. Lunev:
   block/accounting: take stats->lock in latency histogram setters
80* 16f94ef4c6ce Denis V. Lunev:
   block/qapi: take stats->lock when reading BlockAcctStats for 
   query-blockstats
81* 842c89281a20 Denis V. Lunev:
   tests/unit: add reproducer for BlockAcctStats histogram locking race
82* 0c43f801c0d7 Stefan Hajnoczi:
   dmg: fix out-of-bounds load in search_chunk() (CVE-2026-65929)
83* ab7b872f0c38 Stefan Hajnoczi:
   dmg: refuse to open files with no chunks
84* 370882d08695 Stefan Hajnoczi:
   dmg: reject inconsistent UDRW chunk sector count and length 
   (CVE-2026-65928)
85* fe0f9e3ab2a8 Denis V. Lunev:
   qcow2: do not try to clear the dirty bit on a read-only node
86* 43e4791d99ab Denis V. Lunev:
   iotests: run the test pool with the 'fork' start method
87* e554413bd2b4 Denis V. Lunev:
   coroutine: fix lost wakeup in qemu_co_sleep_wake()
88* 241095547a5d Marc-André Lureau:
   hw/display/virtio-gpu: validate blob iov size
89* 95687639e647 Marc-André Lureau:
   hw/display/vga: fix panning_buf OOB after text/graphics switch
90* a113e0c53fb5 Marc-André Lureau:
   vhost-user-gpu: fix integer overflow in buffer allocation
91* b8ef970532c3 Marc-André Lureau:
   hw/display/virtio-gpu: fix offset wraparound in scanout_blob_to_fb
92* 1f24066fc88d Ankur Saini:
   virtio-gpu: reject requests with short/truncated control headers
93* d513c644b893 Akihiko Odaki:
   hw/display/virtio-gpu: Always reject invalid scanout bounds
94* 5ce01c92389a Bin Guo:
   hw/display/virtio-gpu: Unmap DMA regions on reset
95* 1d5e53df1674 Minwoo Im:
   hw/nvme: drop AER requests without aiocb in nvme_del_sq()
96* 849ea354ddc1 Minwoo Im:
   hw/nvme: factor out nvme_sq_cancel_inflight()
97* 86f938333e2f Minwoo Im:
   hw/nvme: cancel inflight requests on controller reset
98* 7a34f7b8794b Klaus Jensen:
   hw/nvme: fix leak on copy ranges
99* 923222000443 Stefan Hajnoczi:
   gitlab: disable provenance attestations to work around CI bug
100* bc4681990bb6 Mikulas Patocka:
   linux-user/sh4: Deliver SIGILL on invalid instruction
101* 668d571bf0c2 Mikulas Patocka:
   linux-user/sh4: Initialize the FPSCR register on signal
102* f7ad7b1f8c81 Mikulas Patocka:
   linux-user/sh4: Fix crashes on signal delivery in conditional delay slot
103 4713988da1c3 Matt Turner:
   linux-user: implement mount_setattr(2)
104 6440880ed371 Philippe Mathieu-Daudé:
   hw/arm/aspeed: Add missing Kconfig dependencies on required components
105 fcc2699d41ed Philippe Mathieu-Daudé:
   target/s390x: Have MSA helper pass a mmu_idx argument
106 aae77f5dddef Ilya Leoshkevich:
   target/s390x: Make PRNO TRNG interruptible
107 abe1d893f41d Ilya Leoshkevich:
   tests/tcg/s390x: Test PRNO TRNG interruptibility
108 0103cb1cd175 Ilya Leoshkevich:
   target/s390x: Fix DR/D INT64_MIN / -1 host crash
109 aa5d03bc9351 Ilya Leoshkevich:
   tests/tcg/s390x: Test DR overflow (INT64_MIN / -1)
110 4e994ebb0144 Christian Borntraeger:
   hw/char/sclpconsole-lm: avoid guest triggerable assert
111 df607fd05604 Joshua Daley:
   s390x/ipl: validate num_comp against iplb length before iterating
112 a9f1e84c6b82 Joshua Daley:
   pc-bios/s390-ccw: fix out-of-bounds read in iso_get_file_size()
113 33909d4ebd5c Joshua Daley:
   pc-bios/s390-ccw: bounds-check zipl menu entry index before array write
114 a3856a7ba44b Joshua Daley:
   pc-bios/s390-ccw: bound zipl menu strlen and replace VLA in 
   zipl_print_entry
115 27ad1a030fa Michael Tokarev:
   pc-bios/s390-ccw.img: update s390x bios
116 4228a92b2a3a Jared Rossi:
   s390x: Remove duplicate definitions of IPL types
117 2c32c273da6d Ilya Leoshkevich:
   target/s390x/tcg: Set STCK/STCKF condition code after the store
118 e79ea4472691 Ilya Leoshkevich:
   tests/tcg/s390x: Test STCKF condition code on a faulting store
119 ac7fa2e9d457 Peter Xu:
   migration/multifd: Validate next_packet_size in zlib/zstd recv
120 cf45083edc2b Peter Xu:
   migration/multifd: Replace assert() with error_setg() in recv paths
121 80776c4df92c Bin Guo:
   hw/intc/loongarch_pch_pic: Validate htmsi_vector before indexing 
   parent_irq
122 15700a66ecb5 Thomas Huth:
   hw/usb/dev-uas: Don't abort if guest provided an undersized buffer for 
   status
123 46099d990055 Thomas Huth:
   hw/net/vmxnet3: Do not abort if guest provides bad interrupt numbers
124 ebec7c732298 Denis V. Lunev:
   tests/qtest/ide-test: parametrize the ATAPI CD-ROM read test
125 fe543c2d787a Denis V. Lunev:
   tests/qtest/ide-test: add a multi-sector ATAPI DMA read test
126 502dbdfd9687 Denis V. Lunev:
   tests/qtest/ide-test: cover raw (2352-byte) ATAPI CD reads
127 de86ef3dfd33 Denis V. Lunev:
   tests/qtest/libqos/ahci: support raw (2352-byte) READ CD
128 31f13e71afd1 Denis V. Lunev:
   tests/qtest/ahci: cover raw (2352-byte) ATAPI CD reads
129 12289dc700d9 Denis V. Lunev:
   hw/ide/atapi: read the whole elementary transfer asynchronously
130 be1ee6a8f6e3 Denis V. Lunev:
   tests/qtest/ahci: regression test for ATAPI read vs. drain
131 59fc7b747d56 Peter Maydell:
   hw/net/rtl8139: Fix handling of VLAN tags on incoming short packets
132 f3a10c1c4547 Peter Maydell:
   hw/net/rtl8139: Send whole of vlan-tagged packet when doing loopback
133 60d010f66f2a Bin Guo:
   hw/block/pflash_cfi01: Restore ROMD mode after migration
134 6dab35f5492b Stefan Hajnoczi:
   hw/nvme: add SPDM_SOCKET Kconfig dependency
135 260d49d8e283 Alex Bennée:
   hw/elf_ops: defend against weird elf headers

(commit(s) marked with * were in previous series and are not resent)