SUSE-SU-2025:20036-1

Fix bsc#1221812:
- block: Reschedule query-block during qcow2 invalidation (bsc#1221812)
Fix bsc#1229007, CVE-2024-7409:
- nbd/server: CVE-2024-7409: Close stray clients at server-stop (bsc#1229007)
- nbd/server: CVE-2024-7409: Drop non-negotiating clients (bsc#1229007)
- nbd/server: CVE-2024-7409: Cap default max-connections to 100 (bsc#1229007)
- nbd/server: Plumb in new args to nbdclientadd() (bsc#1229007, CVE-2024-7409)
- nbd: Minor style and typo fixes (bsc#1229007, CVE-2024-7409)
Update to version 8.2.6:

Full backport lists (from the various releases) here: https://lore.kernel.org/qemu-devel/1721203806.547734.831464.nullmailer@tls.msk.ru/

Some of the upstream backports are: hw/nvme: fix number of PIDs for FDP RUH update sphinx/qapidoc: Fix to generate doc for explicit, unboxed arguments char-stdio: Restore blocking mode of stdout on exit virtio: remove virtiotswap16s() call in vringpackedeventread() virtio-pci: Fix the failure process in kvmvirtiopcivectoruseone() block: Parse filenames only when explicitly requested iotests/270: Don't store data-file with json: prefix in image iotests/244: Don't store data-file with protocol in image qcow2: Don't open datafile with BDRVONOIO (bsc#1227322, CVE-2024-4467) target/arm: Fix FJCVTZS vs flush-to-zero target/arm: Fix VCMLA Dd, Dn, Dm[idx] i386/cpu: fixup number of addressable IDs for processor cores in the physical package tests: Update our CI to use CentOS Stream 9 instead of 8 migration: Fix file migration with fdset tcg/loongarch64: Fix tcgoutmovi vs some pcrel pointers target/sparc: use signed denominator in sdiv helper linux-user: Make TARGETNRsetgroups affect only the current thread accel/tcg: Fix typo causing tb->pageaddr[1] to not be recorded stdvga: fix screen blanking hw/audio/virtio-snd: Always use little endian audio format ui/gtk: Draw guest frame at refresh cycle virtio-net: drop too short packets early target/i386: fix size of EBP writeback in gen_enter()

References

Affected packages

SUSE:Linux Micro 6.0 / qemu

Package

Name: qemu
Purl: pkg:rpm/suse/qemu&distro=SUSE%20Linux%20Micro%206.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.2.6-1.1

Ecosystem specific

{
    "binaries": [
        {
            "qemu-vgabios": "8.2.61.16.3_3_ga95067eb-1.1",
            "qemu": "8.2.6-1.1",
            "qemu-arm": "8.2.6-1.1",
            "qemu-accel-tcg-x86": "8.2.6-1.1",
            "qemu-img": "8.2.6-1.1",
            "qemu-block-rbd": "8.2.6-1.1",
            "qemu-block-curl": "8.2.6-1.1",
            "qemu-hw-usb-host": "8.2.6-1.1",
            "qemu-lang": "8.2.6-1.1",
            "qemu-ipxe": "8.2.6-1.1",
            "qemu-hw-usb-redirect": "8.2.6-1.1",
            "qemu-hw-display-virtio-gpu": "8.2.6-1.1",
            "qemu-pr-helper": "8.2.6-1.1",
            "qemu-x86": "8.2.6-1.1",
            "qemu-ui-opengl": "8.2.6-1.1",
            "qemu-hw-display-virtio-gpu-pci": "8.2.6-1.1",
            "qemu-audio-spice": "8.2.6-1.1",
            "qemu-guest-agent": "8.2.6-1.1",
            "qemu-block-iscsi": "8.2.6-1.1",
            "qemu-chardev-spice": "8.2.6-1.1",
            "qemu-ksm": "8.2.6-1.1",
            "qemu-s390x": "8.2.6-1.1",
            "qemu-tools": "8.2.6-1.1",
            "qemu-block-ssh": "8.2.6-1.1",
            "qemu-ui-spice-core": "8.2.6-1.1",
            "qemu-hw-display-virtio-vga": "8.2.6-1.1",
            "qemu-hw-display-qxl": "8.2.6-1.1",
            "qemu-seabios": "8.2.61.16.3_3_ga95067eb-1.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:20036-1.json"