QEMU, a popular open-source machine emulator and virtualizer, has officially released version 10.2 (following a four-release candidate cycle) as the second point update to the 10.x series.

A notable change is a clarification of QEMU’s security policy. The project now explicitly defines which machine types fall under the “virtualization use case” when determining what qualifies as a security bug.

Several legacy components have been removed. The long-deprecated -old-param option is gone, and the Arm PXA CPU family has been fully removed.

On the architecture side, Arm emulation gains multiple new CPU features, including SCTLR2, TCR2, LSE128, and RME-related extensions. Debugging support improves with the gdbstub now exposing SME and SME2 registers.

Platform support is expanded with new and updated board models, including a new amd-versal2-virt board, improved modelling for Xilinx ZynqMP systems, and added PCIe and secure boot–related devices for several ASPEED SoCs.

RISC-V sees steady progress, with fixes to control-flow integrity, configurable PMP granularity, updated OpenSBI firmware, and multiple correctness fixes affecting timers, MMU handling, and instruction behavior.

PowerPC emulation adds support for newer PowerNV and PPE machines, introduces FADUMP support on pSeries, updates firmware components, and removes unusable legacy CPUs. Similar incremental improvements land across s390x, LoongArch, HPPA, and other supported architectures.

Regarding device emulation, QEMU 10.2 adds Replay Protected Memory Block (RPMB) support to the eMMC model, removes deprecated VFIO platform devices, and improves support across PCIe, storage, networking, and virtio subsystems. FreeBSD host support is extended in areas such as 9pfs, while user-mode emulation gains new syscalls, better signal handling, and architecture-specific fixes.

On the security and cryptography side, minimum versions for GNUTLS, libgcrypt, and nettle have been raised. QEMU now supports loading multiple X.509 certificate identities, a prerequisite for transitioning toward post-quantum cryptography. TLS handling has been tightened with fixes for potential use-after-free issues and more accurate certificate validation logic.

Migration and performance also improve. QEMU 10.2 introduces new migration modes, fixes multiple postcopy and snapshot regressions, and addresses VFIO-related performance issues after migration. On hosts that support it, QEMU’s main loop now uses io_uring, laying groundwork for future performance and scalability improvements.

Finally, for developers, tracing code generation has been optimized to reduce binary size, new TCG plugin hooks are available, and the minimum supported Rust version is now 1.83. Rust support remains experimental and limited to development use, but feature parity continues to improve for Rust-backed devices.

For more information, see the changelog. QEMU 10.2’s source code is available for download from the project’s website.