-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 16 Oct 2026 16:28:47 +0200
Source: xen
Architecture: source
Version: 4.20.4+39-gf1e1321c87-0+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: Debian Xen Team <pkg-xen-devel@lists.alioth.debian.org>
Changed-By: Hans van Kranenburg <hans@knorrie.org>
Changes:
 xen (4.20.4+39-gf1e1321c87-0+deb13u1) trixie-security; urgency=medium
 .
   * Update to new upstream version 4.20.4+39-gf1e1321c87, which also contains
     security fixes for the following issues:
     - x86: DMs may cause mem leak by IRQ binding
       XSA-509 CVE-2026-62437
     - x86: improper handling of HVM emulation return codes
       XSA-510 CVE-2026-79602
     - Unconditionally do TLB flushing ahead of page scrubbing
       XSA-511 CVE-2026-79603
     - oxenstored: Unbounded accumulation of watches
       XSA-512 CVE-2026-79604
     - x86/AMD: ineffectual Zenbleed workaround
       XSA-515 CVE-2026-79608
     - x86: XPTI may break on huge-memory systems
       XSA-516 CVE-2026-79609
     - grant-table: double version change race
       XSA-517 CVE-2026-79610
     - VMX: VMentry failure with branch tracing and blocked states
       XSA-518 CVE-2026-79611
     - Arm: multiple issues with GNTTABOP_cache_flush
       XSA-519 CVE-2026-102699 CVE-2026-102702
     - gnttab: cache-flush handling may cause page reference leak
       XSA-520 CVE-2026-102700
   * Note that the following XSA are not listed, because...
     - XSA-513 applies to blktap which is not included in Debian
     - XSA-514 only applies to Xen 4.22
     - XSA-521 applies to blktap which is not included in Debian
     - XSA-522 has patches for the Linux kernel
Checksums-Sha1:
 ff5195eb8d03d23a3f92f8dd094c7cd929d41c7e 4054 xen_4.20.4+39-gf1e1321c87-0+deb13u1.dsc
 0f2c5f7af9266bb793e58d382b9dc5a3d827b002 4963496 xen_4.20.4+39-gf1e1321c87.orig.tar.xz
 dbd92dd2d1f1b56212368847a4bc278f22058fde 139784 xen_4.20.4+39-gf1e1321c87-0+deb13u1.debian.tar.xz
Checksums-Sha256:
 cfd2746eed8e8594d23c3817bf80be050f725dae74cba4d5be4856a9adf7b8f5 4054 xen_4.20.4+39-gf1e1321c87-0+deb13u1.dsc
 1f5ff12b9dc664ac519ca52e0b5f746cfb1149f74e932e23ed584b092a46bc46 4963496 xen_4.20.4+39-gf1e1321c87.orig.tar.xz
 678d4f6dcf5fd791d5811ebf10d031d4e11fa37e493a7250cb116f11c9c064d9 139784 xen_4.20.4+39-gf1e1321c87-0+deb13u1.debian.tar.xz
Files:
 a32ca30630df358972c4a231c88abcb0 4054 admin optional xen_4.20.4+39-gf1e1321c87-0+deb13u1.dsc
 1a7697e2104c9150968cd903a112ce18 4963496 admin optional xen_4.20.4+39-gf1e1321c87.orig.tar.xz
 5952755b096fd57fd53a0257c1d96b54 139784 admin optional xen_4.20.4+39-gf1e1321c87-0+deb13u1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmrSWdsACgkQEMKTtsN8
TjbAExAAwBmHLWtXNOZbAmaBEwYksVU0pWX/h3KxASrQeGsL5APwMVv8uRJntT94
Vr0vf+wG08LopmSG6GJvBSGJHWe5vuM1y6kNpfd8e3OEs/IjJboBeCAsR7yQzWbB
oqIGdrQPfoqvw51S4ZpVRvgsu5S9yUGste1IztoC6d0PU4L7Jh7kTOtHk8R4SZI+
ghynkuPoSnOGdNmC5Q+nahj+PPoo1SV38u8XBqcnG5q5D/Q3V9f6/5TKxnjb6v2f
/6yJ+9PE0tJ3rBy8dO1LK3svDH9p7lWAf7wG+fZCE3FAirKRCGa3AGnFlTSnKJN/
rOUBl9fGrMZ9HfoIIK83Vt0mkPxdo0O+tgzF1Pr9PQLzmMR0/LBrFWdoUViD35UP
ZVWGU6H0klCJ0EBTdSwvMiQUZ5MmD9NzRTcqoXSaZoGWdU2hGZBY1yPNpLQ/mIa1
3ezCPVWozVkPPzHGi3zx6s11G1ZFFIFHmS+U0+eWwkMwDSKhxcTmzmwiItFV8QZ3
+HkR29HnT5kgQmXC0jFJ429T9WUuM67MWaMFKkfC7U6db6UbfNd4/j25Eog1bti7
DW7yJir4cBq5FaVf0vFtQkGzK46mnX4qdCb0AIBqluCizwixqhi9EA4GQBihCCQH
f0xeIdT8y0PcyUS8oGsxfOsAs/wIn3xW/Jp2Gocxeiu4+Qfr6rw=
=i8vo
-----END PGP SIGNATURE-----