QEMU CCID CVE fixes and Postgres stream safety

QEMU developers shipped large security-oriented patch series for the USB CCID smartcard device and QXL display, while PostgreSQL addressed a memory-corruption risk in recent streaming changes. Several RFC series continued work on vhost-user isolation, TCG test infrastructure, and Arm64 CPU models for live migration.

QEMU CCID smartcard fixes close three CVEs

A 27-patch series for QEMU repairs out-of-bounds and assertion failures in the USB CCID smartcard reader device, addressing three CVEs. The same work also corrects migration handling, endianness problems, and specification compliance issues in the emulated device. Guests that expose CCID to untrusted workloads gain tighter bounds checking and more reliable state transfer.

QXL primary-surface stride checks block host OOB read

A v4 patch for QEMU's QXL display device validates the primary surface stride against width, format, and zero values. The checks prevent a malicious guest from triggering an out-of-bounds read on the host through crafted surface parameters. The change hardens the graphics path used by many KVM guests.

Postgres read_stream change risked metapage corruption

A reporter identified that recent read_stream work in PostgreSQL could invalidate a cached metapage during hashbulkdelete, opening a memory-corruption window. A simple reordering of the affected code paths was proposed and accepted as the fix. The correction restores safe bulk-delete behavior for hash indexes under the new streaming I/O paths.

vhost-user memory isolation via bounce buffers

An RFC series of 15 patches proposes isolating guest memory access for vhost-user by introducing bounce buffers and shadow virtqueues. The design aims to restrict what portions of guest RAM a vhost-user backend may touch. Discussion centers on the performance and correctness trade-offs of the isolation approach.

TCG tests move from Makefiles to Meson

A 103-patch v6 series converts QEMU's TCG test suite from Makefiles to the Meson build system. The change is intended to improve integration with the rest of the QEMU build and to simplify long-term maintenance. Review traffic focuses on build-system edge cases and test coverage parity.

Named Arm64 CPU models for KVM migration

RFC v3 proposes named CPU models for Arm64 guests running under KVM so that live migration can succeed across hosts with differing CPU implementations. Review comments address build fixes and the rationale for the accompanying QMP command. The work targets operators who need predictable migration compatibility on heterogeneous Arm fleets.

Customizable AArch64 KVM host model properties

RFC v7 adds QEMU properties that expose writable AArch64 ID-register fields obtained from KVM. The series lets users refine the host CPU model presented to guests, improving both customization and migration success rates. Discussion remains focused on the property interface and register-field handling.

var_eq_const MCV selectivity summation debated

A PostgreSQL patch changes var_eq_const so that it sums selectivities of every matching most-common-value entry instead of stopping at the first match, which matters for non-default collations. Tom Lane observed that the added runtime cost is unlikely to be justified in the common case. The thread weighs correctness for uncommon collations against planner overhead for typical workloads.