QEMU CVE fixes and PostgreSQL stream hardening

QEMU maintainers merged security fixes for the 11.1 release candidate covering virtio-gpu CVEs, while PostgreSQL developers closed a memory corruption path in hash index bulk deletion. Parallel threads advanced Hexagon translation and device work, vhost-user isolation, Arm64 CPU models, and Meson-based TCG tests.

QEMU 11.1-rc security fixes

A git pull request for QEMU 11.1-rc merges nine fixes, four of them CVE-assigned issues in virtio-gpu and vhost-user-gpu. The changes address security holes in GPU device emulation that affect guest isolation. Operators running virtualized graphics workloads should track the fixes ahead of the final release.

Helper-to-TCG translator for Hexagon

A fifty-patch series introduces an LLVM-based helper-to-TCG translator and applies it to the Hexagon target in QEMU. The work converts helper functions into TCG operations to improve translation quality. Hexagon emulator maintainers gain a more maintainable path for helper handling.

PostgreSQL hashbulkdelete memory fix

A reporter found that recent read_stream changes could invalidate a cached metapage during hashbulkdelete, creating a memory corruption risk. A simple reorder fix was proposed and accepted on pgsql-hackers. Sites using hash indexes should watch for the corrective commit.

vhost-user memory isolation RFC

An RFC series proposes isolating vhost-user memory access through bounce buffers and shadow virtqueues. The design restricts the guest memory a backend can reach. Userspace vhost implementers gain a clearer path to tighter security boundaries.

Named CPU models for Arm64 KVM

RFC v3 adds hierarchical named CPU models for Arm64 KVM guests in QEMU. The models support live migration between heterogeneous hosts. Cloud and cluster operators running mixed Arm hardware benefit from more reliable migration.

TCG tests moved to Meson

A 103-patch series converts QEMU TCG tests from Makefiles to Meson. The change improves integration with the rest of the build system and long-term maintainability. Contributors working on TCG backends face a simpler test infrastructure.

pg_wal_preallocate SQL function

A patch adds a superuser SQL function pg_wal_preallocate() that eagerly creates future WAL segments. Discussion covered interface details, limits via max_wal_size, and possible automatic alternatives. Administrators who hit WAL allocation latency obtain an explicit control point.

Hexagon L2VIC and QTimer devices

A v4 series adds Hexagon L2VIC and QTimer device emulation, shared subsystem refactoring, and tests to QEMU. The devices expand the set of hardware that Hexagon guests can use. Target maintainers obtain more complete platform coverage.