I'm looking at CVE-2015-8553 which is fixed by:
commit 7681f31ec9cdacab4fd10570be924f2cef6669ba Author: Konrad Rzeszutek Wilk konrad.wilk@oracle.com Date: Wed Feb 13 18:21:31 2019 -0500
xen/pciback: Don't disable PCI_COMMAND on PCI device reset.
I'm aware that this change is incompatible with qemu < 2.5, but that's now quite old. Do you think it makes sense to apply this change to some stable branches?
Ben.