-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 04 Nov 2026 17:52:28 +0100
Source: xen
Architecture: source
Version: 4.17.7+13-g2445b30a44-0+deb12u1
Distribution: bookworm-security
Urgency: medium
Maintainer: Debian Xen Team <pkg-xen-devel@lists.alioth.debian.org>
Changed-By: Hans van Kranenburg <hans@knorrie.org>
Changes:
 xen (4.17.7+13-g2445b30a44-0+deb12u1) bookworm-security; urgency=medium
 .
   * Update to new upstream version 4.17.7+13-g2445b30a44, which also contains
     security fixes for the following issues:
      - x86: DMs may cause mem leak by IRQ binding
        XSA-509 CVE-2026-62437
      - x86: improper handling of HVM emulation return codes
        XSA-510 CVE-2026-79602
      - Unconditionally do TLB flushing ahead of page scrubbing
        XSA-511 CVE-2026-79603
      - oxenstored: Unbounded accumulation of watches
        XSA-512 CVE-2026-79604
      - x86: XPTI may break on huge-memory systems
        XSA-516 CVE-2026-79609
      - grant-table: double version change race
        XSA-517 CVE-2026-79610
      - VMX: VMentry failure with branch tracing and blocked states
        XSA-518 CVE-2026-79611
      - Arm: multiple issues with GNTTABOP_cache_flush
        XSA-519 CVE-2026-102699 CVE-2026-102702
      - gnttab: cache-flush handling may cause page reference leak
        XSA-520 CVE-2026-102700
      - arbitrary read/write via grant copy
        XSA-523 CVE-2026-102703 CVE-2026-102704
    * Note that the following XSA are not listed, because...
      - XSA-513 applies to blktap which is not included in Debian
      - XSA-514 only applies to Xen 4.22
      - XSA-515 only applies to Xen 4.19 and later
      - XSA-521 applies to blktap which is not included in Debian
      - XSA-522 has patches for the Linux kernel
Checksums-Sha1:
 bbcfe43c15862984996b0652d602f0d7114d2bec 4389 xen_4.17.7+13-g2445b30a44-0+deb12u1.dsc
 e361bf700efdc3bc163223b3b60a40f397c73be0 4740076 xen_4.17.7+13-g2445b30a44.orig.tar.xz
 e332b633d4c22c81278b0c76717912769fe46e3a 140728 xen_4.17.7+13-g2445b30a44-0+deb12u1.debian.tar.xz
Checksums-Sha256:
 07fe8c96e7b9317e95d1cf44e197753e9b49f883070f86a22b99b1bbe98227d4 4389 xen_4.17.7+13-g2445b30a44-0+deb12u1.dsc
 7722ae68830ff50647bbbc6c1ff3bbdea84f4eae9c92c35d43f160d4640f6193 4740076 xen_4.17.7+13-g2445b30a44.orig.tar.xz
 658ca4fb50d5b75541497fb101051b339f81ad39e539fc61ddeb458843abf137 140728 xen_4.17.7+13-g2445b30a44-0+deb12u1.debian.tar.xz
Files:
 e20e8ea1b222b2f3ceb4686467fe2cfe 4389 admin optional xen_4.17.7+13-g2445b30a44-0+deb12u1.dsc
 ff15675382a0d0de0fd8ac223b33a099 4740076 admin optional xen_4.17.7+13-g2445b30a44.orig.tar.xz
 34a49f6c252efa88a557e5460bfb7b79 140728 admin optional xen_4.17.7+13-g2445b30a44-0+deb12u1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEESWyddwNaG9637koYssHfcmNhX2wFAmrrcFgACgkQssHfcmNh
X2yEvBAAvlfRphYon4+GyH7jnU1jNQxdFbNR4hh9wReO1ZPpHxv7Fty+y8f5mveL
h12ozvus3zSG5bFnzCWYKBczTEfadL6nxGwNITUe+xrNr53bnmM7M2MkF2C/sorG
LIH5PtmkrIn6+tzZpzYwKsNLYzUv6KkzOeJnRYO3L6NpPt45ucNJGd48bgcTN1Yd
DDEGPjukz+OKlN8U6aAi7MAeB94hhjuS+ZcnmYMmHcmm2IwAmoh/T9e7r+WJc8ZM
d54O3tptdgRfk+M5elny3THDJ7m7uXr5w5JdrX0kiKIafLmzVrcmj7pKXrF2LunP
To80ubYXqL1KVRFKw4pwY78WN4FD6nTNv8/IJ2lMYAU6AzCnZ1290YSXHzrCZLUb
+4LeqEJPnlA/fKafLIf2VUCiP2gVUZ6dFdPe6ixt4BOrf+aG9lbUq0w97FJgCDqL
1/evWIXTfKNTl6Gozu0QvAgzjzcIFkMlLWtxJ78hE0pSSXd++UcLJtlTcvOezVT0
MZPq6YcNiqNg/BX+ukKq5EqFeb1sf+HpHw7WSLaoxOWB3Eu4aIv6iTeLDQ5JNNZQ
JdaN/fkm9UEVIAklGx++ll1yH6xYZHNIj+wgb9XI4hRRV+arwwCSD6aT5Iq5KsWf
o0PHYy4PrBICiLY8dGBBdBZMbtWPoDOCtrgaTBg/9MxaDSNVZR0=
=EqKK
-----END PGP SIGNATURE-----