[Git][security-tracker-team/security-tracker][master] Add commit references for qemu fixes

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
56de0386 by Salvatore Bonaccorso at 2026-09-29T20:47:47+02:00
Add commit references for qemu fixes

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -412,16 +412,36 @@ CVE-2026-XXXX [groff issues]
 	NOTE: https://savannah.gnu.org/bugs/?68688 (private)
 CVE-2026-16271 [hw/display/qxl: validate primary surface stride against width]
 	- qemu 1:11.1.2+ds-1
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/f39ebe53c3f319132cfb60030de12c8547426ace (v11.1.2)
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/e6d0120e039a961392eea2c566a4b110884a1b60 (v10.0.14)
 CVE-2026-77913 [hw/display/vga: fix text-mode OOB write after a graphics surface switch]
 	- qemu 1:11.1.2+ds-1
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/f3c6a0a6dcae7b6beef21a9ee332c1c6e8035c8a (v11.1.2)
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/931861685366c372e1c12faf8e10786409ee4d12 (v10.0.14)
 CVE-2026-84788 [io/channel-socket: do not treat a zero length write as an error]
 	- qemu 1:11.1.2+ds-1
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/98b79943b28d417327e36281dca180dd2b95c75d (v11.1.2)
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/756836f32a394b3cd29dff540a7dd907600dc589 (v11.1.2)
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/a1bc6e49b357458eecd94e05ca9eea00336c4dce (v11.1.2)
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/0fdf54ddd5021e51be0dc6eb0119cfee35b8006f (v11.1.2)
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/c6f7053d768581974e95d4215ae298ccd25733f0 (v11.1.2)
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/f86e368f256e37513dabf949c3141eb5551abd82 (v10.0.14)
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/ade3c1a1000315ac0f58a217063829796cd15cfe (v10.0.14)
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/d95c50ff7a031db996cb77f7af3e2d7719d71a18 (v10.0.14)
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/833d5a50360c317ce4542142fe60cdee6c29dc46 (v10.0.14)
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/316989d81e9bb4d253c8e726d462c7bb7031d04c (v10.0.14)
 CVE-2026-66900 [hw/net/virtio-net: strip trailing padding when caching RSC segment]
 	- qemu 1:11.1.2+ds-1
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/ec2fdc85829a5090ebaea2f4094b9616a4ea6309 (v11.1.2)
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/cc48e48a3a3a836ce712305bbeeb9515900dd4ef (v10.0.14)
 CVE-2026-66899 [virtio-balloon: fix free-page BH teardown on unrealize]
 	- qemu 1:11.1.2+ds-1
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/f731c7d2d4cc511abba74607bea4184c207a069e (v11.1.2)
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/be1244c42390de95fa5201a722f3db1302ccef2d (v10.0.14)
 CVE-2026-17588 [hw/usb/hcd-xhci: Set reentrancy guard in timer functions]
 	- qemu 1:11.1.2+ds-1
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/f731c7d2d4cc511abba74607bea4184c207a069e (v11.1.2)
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1622c9abec17d5cba63383d4d4cb1419cedf8158 (v10.0.14)
 CVE-2026-46675 [Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression]
 	- libpng1.6 <unfixed>
 	NOTE: https://github.com/pnggroup/libpng/security/advisories/GHSA-qvg3-h654-xq3j
@@ -10760,6 +10780,8 @@ CVE-2026-81627 (A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/v
 	[trixie] - qemu <no-dsa> (Minor issue)
 	NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/4206
 	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/d61c8a6fb7388486353aa267ba0d75b098f16662 (master)
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/d79bb5387c137fc6603ecfd56a47d47138ed9adf (v11.1.2)
+	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/c9cfa87402ca7ec40817397416b6567d76bb8611 (v10.0.14)
 CVE-2026-81505 (Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's G ...)
 	NOT-FOR-US: Convoy
 CVE-2026-81321 (CM2507 IP cameras store configured wireless network credentials in cle ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/56de0386374a42cde1348d3e87fa03b15984de39

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/56de0386374a42cde1348d3e87fa03b15984de39
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260929/81f74c7a/attachment-0001.htm>