QEMU releases version 11.1.0 with security patches and new emulation features

The open-source virtualizer QEMU has released version 11.1.0, incorporating approximately 3,500 commits and over 111,000 lines of code. This update focuses heavily on security, addressing at least 12 CVEs to patch vulnerabilities in subsystems such as virtio, 9pfs, the dmg parser, and NVMe. These fixes aim to prevent issues like denial of service and memory exhaustion in host-mode QEMU.

Key feature enhancements include the ability to hotplug NVMe namespaces at runtime and the introduction of sp-mem emulation for Intel accelerator workloads. The release also improves architecture support, adding recent ARM CPU features—including FP8, SVE/SME AI, and MTE security features—as well as expanded emulation for RISC-V, PowerPC, and HPPA systems.

Additionally, the update introduces dynamic management for QMP monitors, allowing users to hot-add or remove monitors without restarting the virtual machine daemon. Other improvements include enhanced support for macOS Hypervisor Framework (HVF) nested virtualization and the ability to offload virtual machine clock handling to separate userspace processes via vhost-user.