[ptxdist] [PATCH] qemu: Version bump. 11.0.1 -> 11.0.3

[ptxdist] [PATCH] qemu: Version bump. 11.0.1 -> 11.0.3

[Christian Melki]

Bug and security fixes.
https://github.com/qemu/qemu/compare/v11.0.1...v11.0.3

Plugs CVEs:
CVE-2026-48004: fix missing rename lock in v9fs_co_readdir_many
CVE-2026-48914: add missing VIRTIO_BLK_T_SCSI_CMD size check
CVE-2026-9238: cap Treaddir allocation

* Forward patchset, adjust for line offset.

Signed-off-by: Christian Melki <christian.melki@t2data.com>
---
 ...9pfs-allow-real-symlinks-for-security_model-mapped-f.patch | 4 ++--
 .../0101-python-don-t-install-local-package-with-e.patch      | 0
 patches/{qemu-11.0.1 => qemu-11.0.3}/series                   | 0
 rules/qemu.make                                               | 4 ++--
 4 files changed, 4 insertions(+), 4 deletions(-)
 rename patches/{qemu-11.0.1 => qemu-11.0.3}/0100-9pfs-allow-real-symlinks-for-security_model-mapped-f.patch (96%)
 rename patches/{qemu-11.0.1 => qemu-11.0.3}/0101-python-don-t-install-local-package-with-e.patch (100%)
 rename patches/{qemu-11.0.1 => qemu-11.0.3}/series (100%)

diff --git a/patches/qemu-11.0.1/0100-9pfs-allow-real-symlinks-for-security_model-mapped-f.patch b/patches/qemu-11.0.3/0100-9pfs-allow-real-symlinks-for-security_model-mapped-f.patch
similarity index 96%
rename from patches/qemu-11.0.1/0100-9pfs-allow-real-symlinks-for-security_model-mapped-f.patch
rename to patches/qemu-11.0.3/0100-9pfs-allow-real-symlinks-for-security_model-mapped-f.patch
index ac80a6e1f..fe53dcafe 100644
--- a/patches/qemu-11.0.1/0100-9pfs-allow-real-symlinks-for-security_model-mapped-f.patch
+++ b/patches/qemu-11.0.3/0100-9pfs-allow-real-symlinks-for-security_model-mapped-f.patch
@@ -11,7 +11,7 @@ Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
  1 file changed, 27 insertions(+), 13 deletions(-)
 
 diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c
-index 24cb1da90ae0..9827cefbe12a 100644
+index ee592b62f81f..b795afaa46d6 100644
 --- a/hw/9pfs/9p-local.c
 +++ b/hw/9pfs/9p-local.c
 @@ -463,8 +463,7 @@ static ssize_t local_readlink(FsContext *fs_ctx, V9fsPath *fs_path,
@@ -50,7 +50,7 @@ index 24cb1da90ae0..9827cefbe12a 100644
          close_preserve_errno(dirfd);
      out:
          g_free(name);
-@@ -907,18 +918,21 @@ static int local_symlink(FsContext *fs_ctx, const char *oldpath,
+@@ -910,18 +921,21 @@ static int local_symlink(FsContext *fs_ctx, const char *oldpath,
          int fd;
          ssize_t oldpath_size, write_size;
  
diff --git a/patches/qemu-11.0.1/0101-python-don-t-install-local-package-with-e.patch b/patches/qemu-11.0.3/0101-python-don-t-install-local-package-with-e.patch
similarity index 100%
rename from patches/qemu-11.0.1/0101-python-don-t-install-local-package-with-e.patch
rename to patches/qemu-11.0.3/0101-python-don-t-install-local-package-with-e.patch
diff --git a/patches/qemu-11.0.1/series b/patches/qemu-11.0.3/series
similarity index 100%
rename from patches/qemu-11.0.1/series
rename to patches/qemu-11.0.3/series
diff --git a/rules/qemu.make b/rules/qemu.make
index a6a8e712d..aee3848da 100644
--- a/rules/qemu.make
+++ b/rules/qemu.make
@@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_ARCH_LP64)-$(PTXCONF_QEMU) += qemu
 #
 # Paths and names
 #
-QEMU_VERSION	:= 11.0.1
-QEMU_SHA256	:= 0d235f5820278d914a3155ec27af8e4258d697ea892895570807d69c0cb8cd64
+QEMU_VERSION	:= 11.0.3
+QEMU_SHA256	:= da5fcffc32762820568b828ed430a728864d34d50b6d2f30358597760cbb0523
 QEMU		:= qemu-$(QEMU_VERSION)
 QEMU_SUFFIX	:= tar.xz
 QEMU_URL	:= https://download.qemu.org/$(QEMU).$(QEMU_SUFFIX)
-- 
2.43.0

Re: [ptxdist] [APPLIED] qemu: Version bump. 11.0.1 -> 11.0.3

[Michael Olbrich]

Thanks, applied as 2bc6a18cdfb356cb744886a004d161abd86d1534.

Michael

[sent from post-receive hook]

On Fri, 14 Aug 2026 17:38:36 +0200, Christian Melki <christian.melki@t2data.com> wrote:
> Bug and security fixes.
> https://github.com/qemu/qemu/compare/v11.0.1...v11.0.3
> 
> Plugs CVEs:
> CVE-2026-48004: fix missing rename lock in v9fs_co_readdir_many
> CVE-2026-48914: add missing VIRTIO_BLK_T_SCSI_CMD size check
> CVE-2026-9238: cap Treaddir allocation
> 
> * Forward patchset, adjust for line offset.
> 
> Signed-off-by: Christian Melki <christian.melki@t2data.com>
> Message-Id: <20260727200354.2401578-1-christian.melki@t2data.com>
> Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
> 
> diff --git a/patches/qemu-11.0.1/0100-9pfs-allow-real-symlinks-for-security_model-mapped-f.patch b/patches/qemu-11.0.3/0100-9pfs-allow-real-symlinks-for-security_model-mapped-f.patch
> similarity index 96%
> rename from patches/qemu-11.0.1/0100-9pfs-allow-real-symlinks-for-security_model-mapped-f.patch
> rename to patches/qemu-11.0.3/0100-9pfs-allow-real-symlinks-for-security_model-mapped-f.patch
> index ac80a6e1fa88..fe53dcafee05 100644
> --- a/patches/qemu-11.0.1/0100-9pfs-allow-real-symlinks-for-security_model-mapped-f.patch
> +++ b/patches/qemu-11.0.3/0100-9pfs-allow-real-symlinks-for-security_model-mapped-f.patch
> @@ -11,7 +11,7 @@ Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
>   1 file changed, 27 insertions(+), 13 deletions(-)
>  
>  diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c
> -index 24cb1da90ae0..9827cefbe12a 100644
> +index ee592b62f81f..b795afaa46d6 100644
>  --- a/hw/9pfs/9p-local.c
>  +++ b/hw/9pfs/9p-local.c
>  @@ -463,8 +463,7 @@ static ssize_t local_readlink(FsContext *fs_ctx, V9fsPath *fs_path,
> @@ -50,7 +50,7 @@ index 24cb1da90ae0..9827cefbe12a 100644
>           close_preserve_errno(dirfd);
>       out:
>           g_free(name);
> -@@ -907,18 +918,21 @@ static int local_symlink(FsContext *fs_ctx, const char *oldpath,
> +@@ -910,18 +921,21 @@ static int local_symlink(FsContext *fs_ctx, const char *oldpath,
>           int fd;
>           ssize_t oldpath_size, write_size;
>   
> diff --git a/patches/qemu-11.0.1/0101-python-don-t-install-local-package-with-e.patch b/patches/qemu-11.0.3/0101-python-don-t-install-local-package-with-e.patch
> similarity index 100%
> rename from patches/qemu-11.0.1/0101-python-don-t-install-local-package-with-e.patch
> rename to patches/qemu-11.0.3/0101-python-don-t-install-local-package-with-e.patch
> diff --git a/patches/qemu-11.0.1/series b/patches/qemu-11.0.3/series
> similarity index 100%
> rename from patches/qemu-11.0.1/series
> rename to patches/qemu-11.0.3/series
> diff --git a/rules/qemu.make b/rules/qemu.make
> index a6a8e712d957..aee3848dab4d 100644
> --- a/rules/qemu.make
> +++ b/rules/qemu.make
> @@ -14,8 +14,8 @@ PACKAGES-$(PTXCONF_ARCH_LP64)-$(PTXCONF_QEMU) += qemu
>  #
>  # Paths and names
>  #
> -QEMU_VERSION	:= 11.0.1
> -QEMU_SHA256	:= 0d235f5820278d914a3155ec27af8e4258d697ea892895570807d69c0cb8cd64
> +QEMU_VERSION	:= 11.0.3
> +QEMU_SHA256	:= da5fcffc32762820568b828ed430a728864d34d50b6d2f30358597760cbb0523
>  QEMU		:= qemu-$(QEMU_VERSION)
>  QEMU_SUFFIX	:= tar.xz
>  QEMU_URL	:= https://download.qemu.org/$(QEMU).$(QEMU_SUFFIX)