The following patches are queued for QEMU stable v10.0.15:
https://gitlab.com/qemu-project/qemu/-/commits/staging-10.0
Patch freeze is 2026-10-26, and the release is planned for 2026-10-28:
https://wiki.qemu.org/Planning/10.0
Please respond here or CC qemu-stable@nongnu.org on any additional patches
you think should (or shouldn't) be included in the release.
The changes which are staging for inclusion, with the original commit hash
from master branch, are given below the bottom line.
Thanks!
/mjt
--------------------------------------
01 653b0c06c83d Jean-Francois Bortolotti:
target/arm: Fix PMSAv8 shareability decode for R-profile MPU regions
02 66d4ea65a064 Fuad Tabba:
target/arm: Fix next timer tick when the offset puts the count ahead
03 998b6db69e3e Fuad Tabba:
target/arm: Fix WFxT timeouts when the offset puts the count ahead
04 89e653b77369 Thomas Huth:
hw/usb/hcd-xhci: Limit DMA transfers to plain memory
05 92b935de2709 Eric Farman:
virtio-ccw: Limit ISC to MAX_ISC
06 13c7ba5e0f14 Eric Farman:
virtio-ccw: Do not overwrite existing indicators
07 bd5bc2861fb6 Eric Farman:
virtio-ccw: Fix rc check in read configuration path
08 057ca01937b7 Eric Farman:
vfio/ap: Clear error object pointer after non-fatal errors
09 77cc481c2311 Eric Farman:
hw/intc/s390x: Fix check after g_try_realloc
10 930a188edbbc Eric Farman:
s390x/css: Use datastream pointer for checking no-data CCWs
11 119860f15cd2 Eric Farman:
s390x/sclp: Reject short headers in PV case
12 e57ad3670188 Matthew Rosato:
s390x/pci: Fix frame stepping in rpcit_service_call()
13 10a81449a279 Matthew Rosato:
s390x/pci: Use qemu_log_mask() for guest-triggered errors in reg_ioat()
14 d818e2b0e631 Matthew Rosato:
s390x/pci: Reject apertures beyond IOAT capacity in translation mode
15 1847dcd96d7d Marc-André Lureau:
hw/usb/dev-smartcard-reader: validate interrupt transfer length
16 49851e859506 Marc-André Lureau:
hw/usb/dev-smartcard-reader: fix OOB read from pending bulk-in ring
17 d7f20657e756 Marc-André Lureau:
hw/usb/dev-smartcard-reader: fix assert on pending answers overflow
18 069dcc103be7 Marc-André Lureau:
hw/usb/dev-smartcard-reader: decode bulk-out length as little-endian
19 665494c3ac07 Marc-André Lureau:
hw/usb/dev-smartcard-reader: validate migrated fields in post_load
20 050f5408bfcf Andrey Drobyshev:
hw/display/qxl: factor out qxl_guest_phys2virt()
21 95bc45193bbe Andrey Drobyshev:
hw/display/qxl: validate replayed commands in qxl_post_load
22 7e429d3624c4 Andrey Drobyshev:
hw/display/qxl: trace skipped stale loadvm commands
23 9998d225bb95 Denis V. Lunev:
block/nbd: clear reply.cookie when the reply is rejected
24 75b0a993dacb Denis V. Lunev:
block/nbd: never index requests[] with an unchecked cookie
25 cd3be3bd96c0 Denis V. Lunev:
block/nbd: clear reply.cookie under receive_mutex
26 90fcba23c526 Daniel Paziyski:
hw/nvme: fix assertion failure on sr-iov capable nvme controller removal
27 6ee626e34979 Daniel Paziyski:
hw/nvme: fix memory leak on sr-iov capable nvme controller removal
28 8d496d8f9fce Jakub Lipový:
target/i386/tcg: raise #GP(0) on null SS load with RPL != CPL
29 6802a4b23919 Simon Scherer:
target/i386: clear C1 for all x87 compare instructions
30 6d5fb14d36a6 Simon Scherer:
target/i386: Don't clear C1 for FCOMI/FCOMIP/FUCOMI/FUCOMIP
31 0f98b46846eb Maxim Levitsky:
accel/kvm: protect kvm_resample_fd_list with a mutex
32 a5b4837a253e Paolo Bonzini:
target/i386/tcg: ignore VEX.L for unary scalar instructions
33 d198957674b3 Tommaso Califano:
hw/usb: Fix USB MTP Use-After-Free in usb_mtp_deletefn List Iteration
34 4668899d6615 Daniel P. Berrangé:
io: prevent unbounded read of websocket data from client
35 429bf66a1f23 Denis V. Lunev:
block/throttle-groups: fix crash when enabling I/O limits on a busy disk
36 2910b995f6c8 Denis V. Lunev:
iotests: cover inactivating a read-only node
37 8daaf8d3b1c5 Denis V. Lunev:
block: fix bdrv_next() skipping monitor-owned nodes
38 196a50b0902b Stefan Hajnoczi:
file-posix: add statx(STATX_DIOALIGN) support
39 af28b65fae6f Denis V. Lunev:
qcow2: do not clear the dirty bit when reopening a read-only node
40 efe98c2a0932 Denis V. Lunev:
block: reject a reopen of an unusable node instead of crashing
41 0bd5a1b3d60c Kevin Wolf:
block: Fix corruption from broken RMW atomicity
42 cf4f672c11d6 Kevin Wolf:
block: Remove now redundant bdrv_wait_serialising_requests() calls
43 c08b84cd6e55 Philippe Mathieu-Daudé:
accel/kvm: Replace legacy cpu_physical_memory_write() call
44 12916d64b78e Maxim Levitsky:
accel/kvm: coalesced mmio: check lenght of the MMIO write entry
45 99a8b5a0dda9 Daniel P. Berrangé:
io: cork TLS writes to avoid small TLS records
46 6728170d2d08 Stefan Berger:
tpm_emulator: Reject sending commands smaller than the request header
47 35164929cfa3 Marc-André Lureau:
hw/display/vga: fix OOB writes after external surface resize
48 d228536a5142 Dominic P:
tcg/optimize: Do not derive s_mask from rotated s_mask
49 f9ca6b19acb1 Dominic P:
tests/tcg: Add tests for sign extension after rotate
50 0dd9fb43ea22 Artemii Mashanov:
target/i386/tcg: zero FXSAVE FOP and reserved slot bytes
51 21b6c3e5bccf Artemii Mashanov:
target/i386: fix immediate stack adjustment for RET and RETF
52 306d9ab85fdb Aurelien Jarno:
tcg/riscv64: Remove vector min/max ops with immediates
53 0dedeff9328d Fuad Tabba:
target/arm: Clear TTBR[5:0] from a 52-bit table base address
54 bb79850255c8 Fuad Tabba:
tests/tcg/aarch64: Add a test for a two-entry 52-bit TTBR table
55 2c372119465e Fuad Tabba:
target/arm: Use the 52-bit TTBR base address layout when TCR.DS is set
56 2579771a28a2 Fuad Tabba:
tests/tcg/aarch64: Test the TTBR layout with TCR.DS and a 48-bit OA
57 366b4fba0fae imaginos:
target/riscv: check G-stage write permission for VS-stage A/D updates
58 410166b550cc Zephyr Li:
target/riscv: stop translating after WFI
59 e52de6b65f5f Xie Bo:
target/riscv/kvm: Preserve FCSR across migration
60 ba280c351011 Rick Richard:
tests/qtest/bios-tables-test: Allow changes to riscv64 virt SPCR
61 ee23f530e99d Rick Richard:
hw/riscv/virt-acpi-build: Fix the UART register width in SPCR
62 71041ce05c95 Rick Richard:
tests/qtest/bios-tables-test: Update riscv64 virt SPCR golden reference
63 cb82463fa9bf dodochicha:
target/riscv: Check Svnapot PTE before updating A/D bits