@@ -86,6 +86,16 @@ stdenv.mkDerivation rec {
8686 patches = [
8787 ./fix-qemu-ga.patch
8888 ./9p-ignore-noatime.patch
89+ (fetchpatch {
90+ name = "CVE-2021-3545.patch";
91+ url = "https://gitlab.com/qemu-project/qemu/-/commit/121841b25d72d13f8cad554363138c360f1250ea.patch";
92+ sha256 = "13dgfd8dmxcalh2nvb68iv0kyv4xxrvpdqdxf1h3bjr4451glag1";
93+ })
94+ (fetchpatch {
95+ name = "CVE-2021-3546.patch";
96+ url = "https://gitlab.com/qemu-project/qemu/-/commit/9f22893adcb02580aee5968f32baa2cd109b3ec2.patch";
97+ sha256 = "1vkhm9vl671y4cra60b6704339qk1h5dyyb3dfvmvpsvfyh2pm7n";
98+ })
8999 ] ++ optional nixosTestRunner ./force-uid0-on-9p.patch
90100 ++ optionals stdenv.hostPlatform.isMusl [
91101 (fetchpatch {