The following patches are queued for QEMU stable v11.0.5:

  https://gitlab.com/qemu-project/qemu/-/commits/staging-11.0

Patch freeze is 2026-09-26, and the release is planned for 2026-09-28:

  https://wiki.qemu.org/Planning/11.0

Please respond here or CC qemu-stable@nongnu.org on any additional patches
you think should (or shouldn't) be included in the release.

The changes which are staging for inclusion, with the original commit hash
from master branch, are given below the bottom line.

Thanks!

/mjt

--------------------------------------
01 ab7183ed4eec Marc-André Lureau:
   hw/display/qxl: validate primary surface stride against width
02 eb2b3a1fa807 Marc-André Lureau:
   virtio-gpu: use g_try_malloc to avoid guest-triggered abort
03 0e62034ca10f Marc-André Lureau:
   crypto: fix build against nettle >= 4
04 ddf5738503e2 Fabiano Rosas:
   chardev: Don't unregister yank upon async path connection failure
05 418396be8013 Warisjeet Singh:
   hw/display/vga: fix text-mode OOB write after a graphics surface switch
06 0846740652d1 Christian Quante:
   hw/input/ps2: answer unknown mouse commands with a resend
07 2667133c2799 Denis V. Lunev:
   job: keep job paused across overlapping pause requests
08 438ee08bc97a Denis V. Lunev:
   tests/unit/test-blockjob: cover keeping a job paused while a pause is 
   pending
09 59ecd8a1ac3f Denis V. Lunev:
   block/monitor: reject persistent bitmap add on a read-only node
10 3f3f5cdb929e Denis V. Lunev:
   migration/block-dirty-bitmap: reject bitmap load onto ro node
11 9a77ef813f5f Denis V. Lunev:
   block/monitor: allow dropping a bitmap never stored on disk
12 dc04053687ec Denis V. Lunev:
   dirty-bitmap: fix integer overflow in serialization coverage
13 569aa6280d14 Nicholas Piggin:
   target/riscv: tt-ascalon: Enable Zkr extension
14 51362da8f73b Ivan Efremov:
   target/riscv: Fix seed CSR sign extension
15 e80cf2947978 Ivan Efremov:
   tests/qtest: Add seed CSR zero extension test
16 d7913fac7747 Christian Borntraeger:
   s390x/sclp: pv: only copy the original SCCB buffer
17 6c712a86f6c8 Denis V. Lunev:
   hw/ide: reject an unsupported CHS translation
18 0905ef5b6d48 Denis V. Lunev:
   tests/qtest/ide-test: cover a CHS translation with zero sectors
19 0df27c66dc72 Denis V. Lunev:
   hw/ide: report the default CHS translation in IDENTIFY DEVICE
20 1332990194b5 Denis V. Lunev:
   hw/ide: reject an out-of-range PIO transfer window on load
21 d30254aec931 Paolo Bonzini:
   scsi-disk: fix out-of-bound read in WRITE SAME
22 0f410adf6b0d Paolo Bonzini:
   scsi: hide MODE SELECT block size change behind a quirk
23 d61c8a6fb738 Paolo Bonzini:
   vapic: confine the VAPIC region to 0xc0000..0xe0000
24 cfa6e2c52ca8 Paolo Bonzini:
   i386/vapic: unref MemoryRegion if vapic_map_rom_writable fails
25 b78c6d5b1bf0 Gautam Menghani:
   ppc/xive: Trigger the pending interrupt for a guest after migration
26 f63124af7846 Alexandre Frey:
   target/arm: fix TTA instruction S bit for IDAU-exempt addresses
27 59716ac3067d Peter Maydell:
   target/arm: Correct reset value of SCTLR for arm926, arm1026
28 c05e01a88581 Peter Maydell:
   target/arm: Make CBZ/CBNZ UNDEF before v6T2
29 50d6757147db Peter Maydell:
   target/arm: Make IT insn undef when not present
30 2931a675e9d3 Peter Maydell:
   target/arm: Make Thumb T1 hint space UNDEF before v6T2
31 10dddf15e294 Bin Meng:
   hw/sd: sdhci: Accept version 4 enable without UHS-I
32 15d4bc75f817 Alberto Garcia:
   hw/sd/sdcard: Register device ops in drives without media
33 259b877eac36 Junjie Cao:
   hw/cxl: fix timer leak in cxl_destroy_cci()
34 a3de21bfa5d0 Denis V. Lunev:
   io/channel-socket: do not treat a zero length write as an error
35 cd71c2f40a53 Denis V. Lunev:
   io/channel-websock: send an HTTP 400 when the greeting has no space
36 2295deb48898 Denis V. Lunev:
   io/channel-websock: handle a blocked write during the handshake
37 e867e2047c6c Denis V. Lunev:
   tests/unit: add websock handshake test
38 7a72a4652a79 Denis V. Lunev:
   io/channel-websock: do not lose QIO_CHANNEL_ERR_BLOCK while reading
39 0e5718799199 Denis V. Lunev:
   tests/unit: cover blocked IO during the websock handshake
40 3ece85b53c12 Marc-André Lureau:
   virtio-gpu: disable blob scanouts on mapping cleanup
41 c7254cd584bb Marc-André Lureau:
   virtio-gpu: clear res->blob on mapping cleanup
42 713e7e85a2b4 Junjie Cao:
   hw/cxl: Fix guest-triggerable QEMU exit on reserved interleave ways
43 f10977073cb4 Zhang Chen:
   qapi/misc: Fix missed query-iothreads items
44 5d85a09554fb Laurent Vivier:
   hw/net/virtio-net: check packet size before VLAN tag access in 
   receive_filter()
45 73c3d017ef6a Laurent Vivier:
   hw/net/virtio-net: strip trailing padding when caching RSC segment
46 15dcee919555 Jia Jia:
   hw/virtio: reject inverted virtio-iommu IOVA ranges
47 fdc3f9a83ddf Michael S. Tsirkin:
   virtio-balloon: fix free-page BH teardown on unrealize
48 5440b6b5de46 Stefan Hajnoczi:
   virtio-scsi: set dataplane_started to false upon failure
49 0ddbce88c45a Junjie Cao:
   hw/cxl: fix the CDAT DOE overlapping the Flex Bus DVSEC when sn= is set
50 2c43897356ac Denis V. Lunev:
   hw/display/qxl: hold ssd.lock while replacing ssd.cursor
51 1063bbb71185 Denis V. Lunev:
   ui/cursor: make the cursor refcount atomic
52 01df81b24c50 Marc-André Lureau:
   vhost-user-gpu: validate command buffer size in submit_3d
53 7e5c85f7f2a8 Kostiantyn Kostiuk:
   qga: Change effective user/group ID in guest-ssh-* commands
54 2a8b740e7acf Bin Guo:
   hw/intc/bcm2835_ic: reject out-of-range FIQ source values
55 6ae0b0426705 Doug Cook:
   target/arm/whpx: Don't try to sync ARM_CP_CONST registers
56 518f45b32d04 Doug Cook:
   target/arm/whpx: incorrect ENCODE_AA64_CP_REG parameter order
57 57197bf183f3 Doug Cook:
   target/arm/whpx: fix whpx-arm post-reset CPU state