Your message dated Tue, 29 Sep 2026 15:20:57 +0000
with message-id <[email protected]>
and subject line Bug#1149064: fixed in qemu 1:11.1.2+ds-1
has caused the Debian Bug report #1149064,
regarding qemu: CVE-2026-93834
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149064: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149064
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: qemu
Version: 1:11.1.1+ds-1
Severity: grave
Tags: security upstream
Forwarded: https://gitlab.com/qemu-project/qemu/-/work_items/4491
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for qemu.
CVE-2026-93834[0]:
| A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A
| race condition between the main thread and a worker thread when
| processing concurrent Tlcreate and Twalk requests allows a malicious
| guest user to craft a fid path containing stale heap data, bypassing
| directory traversal restrictions and escaping the shared directory
| boundary. This can lead to arbitrary host file read/write and code
| execution (VM escape) as the QEMU process user.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-93834
https://www.cve.org/CVERecord?id=CVE-2026-93834
[1] https://gitlab.com/qemu-project/qemu/-/work_items/4491
[2]
https://gitlab.com/qemu-project/qemu/-/commit/fe9e30899ffceef25cf345ec83f76546afca19dd
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: qemu
Source-Version: 1:11.1.2+ds-1
Done: Michael Tokarev <[email protected]>
We believe that the bug you reported is fixed in the latest version of
qemu, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Michael Tokarev <[email protected]> (supplier of updated qemu package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 29 Sep 2026 17:59:06 +0300
Source: qemu
Architecture: source
Version: 1:11.1.2+ds-1
Distribution: unstable
Urgency: medium
Maintainer: Debian QEMU Team <[email protected]>
Changed-By: Michael Tokarev <[email protected]>
Closes: 1146606 1148473 1149064
Changes:
qemu (1:11.1.2+ds-1) unstable; urgency=medium
.
* new upstream stable/bugfix release:
- Update version for 11.1.2 release
- target/sh4: Replace TB_FLAG_GUSA_EXCLUSIVE with CF_STEP_ATOMIC
- accel/tcg: Set CF_NOIRQ during cpu_exec_step_atomic
- linux-user/sh4: align the vdso sigreturn trampolines
- linux-user/sh4: fix vdso CFA for rt_sigreturn frames
- linux-user/sh4: use the kernel's sigreturn trampoline sequence
in the vdso
- target/i386: Mark MOVNTI as not valid with prefixes 0x66, 0xF2, 0xF3
- target/i386: Update FPU tag word for FXCH
- target/i386: Update FPU tag word for FSTP
- target/i386: Update FPU tag word for FXTRACT's old ST(0)
- target/i386: Fix FXCH to unconditionally clear C1
- target/ppc: Stop vCPU thread before calling parent_unrealize
- tests/qtest/usb-hcd-xhci: test isoch endpoint type mismatch
- tests/qtest/usb-hcd-xhci: test isoch pacing with MFINDEX above 2^32
- hw/usb/hcd-xhci: don't assert on NAK when retrying an isoch transfer
- hw/usb/hcd-xhci: fix interval alignment after MFINDEX passes 2^32
- hw/usb/hcd-xhci: Set reentrancy guard in timer functions
(Closes: CVE-2026-17588)
- tcg/riscv64: Set vtype before whole-register vector loads
- tests/tcg/s390x: Add regression test for #4449
- tcg/optimize: Fix expansion/simplification of deposit
- tests/tcg/arm: Add regression test for #4448
- tcg/optimize: Fix fold_multiply2 vs 1
- accel/tcg: Fix TLB_MMIO check in tlb_plugin_lookup()
- accel/tcg: Use TLB_FORCE_SLOW not TLB_MMIO for system plugins
- hw/9pfs: mutate FID path from main thread only
(Closes: #1149064, CVE-2026-93834)
- s390x/pci: fix DMA slot leak on I/O TLB entry replacement
- hw/s390x/ipl: Fix incorrect PCI IPL block lengths
- linux-user/loongarch64: Detect vector stores in host_signal_write()
- linux-user: implement mlock2(2) syscall
- linux-user/riscv: honor zicntr=false for base counterCSRs
- system/ram-discard-manager: fix offset_within_address_space
in replay_by_populated_state()
- igvm: mark qigvm_find_param_entry as static
- igvm: validate and honor byte_offset in parameter directives
- hw/uefi: add missing uefi_str_is_valid check
to uefi_vars_mm_lock_variable
- target/loongarch: Fix data race in CSR_ESTAT
- hw/riscv/virt.c: fix aclint soc/mtimer nodename
- target/arm/hvf: implement MDCCSR_EL0 as RAZ
- target/arm/whpx: fix whpx-arm post-reset CPU state
- target/arm/whpx: incorrect ENCODE_AA64_CP_REG parameter order
- target/arm/whpx: Don't try to sync ARM_CP_CONST registers
- hw/intc/bcm2835_ic: reject out-of-range FIQ source values
- qga: Change effective user/group ID in guest-ssh-* commands
(Closes: CVE-2026-12080)
- vhost-user-gpu: validate command buffer size in submit_3d
- ui/cursor: make the cursor refcount atomic
- hw/display/qxl: hold ssd.lock while replacing ssd.cursor
- hw/cxl: fix the CDAT DOE overlapping the Flex Bus DVSEC when sn= is set
- virtio-scsi: set dataplane_started to false upon failure
- virtio-balloon: fix free-page BH teardown on unrealize
(Closes: CVE-2026-66899)
- hw/virtio: reject inverted virtio-iommu IOVA ranges
- hw/net/virtio-net: strip trailing padding when caching RSC segment
(Closes: CVE-2026-66900)
- hw/net/virtio-net: check packet size before VLAN tag access
in receive_filter()
- qapi/misc: Fix missed query-iothreads items
- hw/cxl: Fix guest-triggerable QEMU exit on reserved interleave ways
- virtio-gpu: clear res->blob on mapping cleanup
- tests/unit: cover blocked IO during the websock handshake
- io/channel-websock: do not lose QIO_CHANNEL_ERR_BLOCK while reading
- tests/unit: add websock handshake test
- io/channel-websock: handle a blocked write during the handshake
- io/channel-websock: send an HTTP 400 when the greeting has no space
- io/channel-socket: do not treat a zero length write as an error
(the 5 changes above: Closes: CVE-2026-84788)
- target/loongarch: Fix SWI interrupt delivery via CSR_ESTAT
- hw/cxl: fix timer leak in cxl_destroy_cci()
- hw/sd/sdcard: Register device ops in drives without media
- hw/sd: sdhci: Accept version 4 enable without UHS-I
- target/arm: Make Thumb T1 hint space UNDEF before v6T2
- target/arm: Make IT insn undef when not present
- target/arm: Make CBZ/CBNZ UNDEF before v6T2
- target/arm: Correct reset value of SCTLR for arm926, arm1026
- target/arm: fix TTA instruction S bit for IDAU-exempt addresses
- ppc/xive: Trigger the pending interrupt for a guest after migration
- i386/vapic: unref MemoryRegion if vapic_map_rom_writable fails
- vapic: confine the VAPIC region to 0xc0000..0xe0000
(Closes: #1148473, CVE-2026-81627)
- scsi: hide MODE SELECT block size change behind a quirk
- scsi-disk: fix out-of-bound read in WRITE SAME
- target/riscv/kvm: Preserve MP state across migration
- target/riscv/kvm: Synchronize privilege mode
- hw/ide: report the default CHS translation in IDENTIFY DEVICE
- tests/qtest/ide-test: cover a CHS translation with zero sectors
- hw/ide: reject an unsupported CHS translation
- s390x/sclp: pv: only copy the original SCCB buffer
- dirty-bitmap: fix integer overflow in serialization coverage
- block/monitor: allow dropping a bitmap never stored on disk
- migration/block-dirty-bitmap: reject bitmap load onto ro node
- block/monitor: reject persistent bitmap add on a read-only node
- tests/unit/test-blockjob: cover keeping a job paused
while a pause is pending
- job: keep job paused across overlapping pause requests
- hw/input/ps2: answer unknown mouse commands with a resend
- hw/display/vga: fix text-mode OOB write after a graphics surface switch
(Closes: CVE-2026-77913)
- chardev: Don't unregister yank upon async path connection failure
- crypto: fix build against nettle >= 4
- virtio-gpu: use g_try_malloc to avoid guest-triggered abort
- hw/display/qxl: validate primary surface stride against width
(Closes: CVE-2026-16271)
* d/control: libjack-dev => libjack-jackd2-dev (Closes: #1146606)
Checksums-Sha1:
0749709e1b40dec613bb598fc233bd6c3c8194d2 9929 qemu_11.1.2+ds-1.dsc
d58acaf257de04d16418e5d61b0e1befe2ef2b45 39228664 qemu_11.1.2+ds.orig.tar.xz
0157831965b9ef40c44daf973def3adf6582b548 134776 qemu_11.1.2+ds-1.debian.tar.xz
e93a9afd9df1df6fc6feebefb5609b1cb4ebfaa8 8025 qemu_11.1.2+ds-1_source.buildinfo
Checksums-Sha256:
0a793f94777a1d150fa12bd7d02702c252ad4b4675c887cb13324f9327f7bb9a 9929
qemu_11.1.2+ds-1.dsc
4f41c3df35a86d2497f842a585b014fe5aef45ceec6450e61615f0164ca39761 39228664
qemu_11.1.2+ds.orig.tar.xz
6a25aefcd0203b14209fd54aab4ec904e69b45d62bf5924e99a71c60b62773c1 134776
qemu_11.1.2+ds-1.debian.tar.xz
6b0e04a466011abb09387b54c0f6fb9f1e4632596f8deff748c008140059033f 8025
qemu_11.1.2+ds-1_source.buildinfo
Files:
d6448f1ab815c4a1d5a6258fb5361af5 9929 otherosfs optional qemu_11.1.2+ds-1.dsc
26e6bc30fdfe4b08a614772a69347614 39228664 otherosfs optional
qemu_11.1.2+ds.orig.tar.xz
c20d346b331d36f73e47671fb6d7f9f2 134776 otherosfs optional
qemu_11.1.2+ds-1.debian.tar.xz
077a0ab7f5b5ee68f3edf332ba86dc6f 8025 otherosfs optional
qemu_11.1.2+ds-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEZKoqtTHVaQM2a/75gqpKJDselHgFAmq71LMACgkQgqpKJDse
lHjQMg/+IcKcj0lN4hKs49EEtVNeL0Kud6xITZJ1vdEy7HqF7yTAuFR6uasjKGzX
ScLDC/nadCvZ/DjUUCVrajlbK4uDEuyQ0O6UrTvBtOSzMmnIVvTa8nNL7waaD1Lu
E9mZGWCPgNcv/HrifPk57or1RRDEw2vcGRFFm4B9EVAFfQkaALWQxk5pZFc+0Rmv
KgCfujoFsTcSI+XVjIRfADoKr7GXtK6OVG3MFBvcmcxfXm2qmiI6Pc1qIygZ8z/F
S6i+c5iF+BdbmcGEtY93gRVW+rWqY3tJKTvEhMHk8lfuJUoAdSG8TA3solHVAi3+
SxhuXKj4tkjfxhvdrLPCXgAX/0sqf1JT+LVnDt9Qb3g1WGwPP0+lRUB6/uXMveA2
x9TdzosEA1bha4NWFDNgeGiMGxJH9mE+3zNaIA5yv3iHQMtbuTWj2TQ0z/LTMiu/
euJsVKUoDo7DAIAiMyVsYyOC8n3mgCvgCAi5TUO+7B9ze2kRWehTwVAWhh2BuonM
w1dgiz6DZy9DaGWTlD+tck2gLpRvOuARBufaI1hbslv8CgTCljsgyQ78vAKh/7lS
1CB0SPkYRfbEzLv7M/9meKqHFDKu9LifQVMriiWdDOz6s5KGCJRqN3BTeeYhaC83
CobieGf7ki/wlsLiCSBNQurPMt4USsh2dx/KSU3fVknGbUQA56A=
=QQSd
-----END PGP SIGNATURE-----
pgpmq8Wodicrp.pgp
Description: PGP signature
--- End Message ---
