There are new 4 CVE CVE-2018-12130 CVE-2018-12126 CVE-2018-12127 CVE-2019-11091
Debian stretch kernel is vulnerable https://security-tracker.debian.org/tracker/CVE-2018-12130
Even if you get a newer kernel from Kernel.org in notes types that libvirt is vulnerable. It say: https://libvirt.org/git/?p=libvirt.git;a=commit;h=538d873571d7a682852dc1d70e5f4478f4d64e85 qemu and libvirt need updates to passthrough md-clear, see #929067 for qemu and #929154 for libvirt
But when I try apt update && apt upgrade I don't see qemu and libvirt to update. When I use links from notes to go and see what's going on there - there a just bugreports and code commits, but no link to upgrade qemu and libvirt How to upgrade qemu and libvirt ?