QEMU 11.1.0 has been released, featuring significant security enhancements and new functionalities, including NVMe hotplug capabilities and specific purpose memory emulation. This update addresses over 12 assigned CVEs, targeting vulnerabilities across various subsystems to improve host-mode security. Additionally, it introduces dynamic management of QMP monitors and enhancements in RISC-V emulation, as well as updates to the UI with a full VT100 terminal emulator. Users are strongly urged to upgrade their production instances to mitigate potential exploits, especially those relating to memory exhaustion and out-of-bounds access

QEMU 11.1.0 Released: NVMe Hotplug, sp-mem Emulation, and 12+ CVE Fixes

QEMU 11.1.0 has officially landed, wrapping up roughly 3,500 commits and over 111,000 lines of code from 285 contributors. The release is squarely focused on hardening host-mode QEMU, patching at least 12 assigned CVEs across virtio, 9pfs, the dmg parser, and NVMe subsystems. Beyond the security work, you can now hotplug NVMe namespaces at runtime, enable the new sp-mem device for Intel accelerator workloads, and dynamically manage QMP monitors without restarting the daemon. While the new RISC-V IOMMU and VT100 terminal emulator round out the feature set, production deployments should prioritize this update immediately to close out-of-bounds access and memory exhaustion vulnerabilities.

QEMU 11.1.0 Released: NVMe Hotplug, sp-mem Emulation, and 12+ CVE Fixes @ Linux Compatible