CVE-2018-19665/qemu: update notes

mentioned patch will most likely never be merged by upstream, another
patch is currently under development.

see https://lists.debian.org/debian-lts/2019/01/msg00073.html