QEMU security pulls and Postgres PG19 revert debate

QEMU security work led the day with hardening pulls for IDE, migration, and virtio-gpu, while PostgreSQL hackers argued over reverting several complex PG19 features after elevated post-freeze bug counts. Further QEMU series advanced bsd-user syscalls, LoongArch nested virtualization, and a single-binary build experiment.

QEMU IDE and AHCI hardening pull

A pull request on qemu-devel ships multiple fixes that harden IDE and AHCI emulation against crafted migration streams, a use-after-free on unplug, and CHS plus identify bugs. Three participants exchanged 31 messages on the series. Operators who migrate or hot-unplug disk-backed guests gain a tighter boundary against malformed state and lifecycle races.

QEMU migration pull closes CVE-2026-6426

The migration patches pull for QEMU adds RDMA and vmstate hardening, a fix for CVE-2026-6426, a vhost-user postcopy bugfix, and a fast snapshot load feature. Two participants handled 32 messages on the series. Migration and postcopy users should care because the changes close a named CVE and improve snapshot and RDMA reliability.

PostgreSQL hackers debate PG19 feature reverts

PostgreSQL hackers are debating whether to revert three complex features aimed at PG19: RI foreign-key batching, REPACK CONCURRENTLY, and online checksums. The heated thread of 33 messages from 19 participants cites high post-freeze bug counts identified through LLM analysis. Contributors and early adopters should watch the outcome, since a revert would reshape the freeze window and long-term maintenance load.

bsd-user syscall upstreaming reaches v4

Warner Losh posted version 4 of a 40-patch series that completes most of the remaining system calls for QEMU bsd-user. The work notes heavy Claude assistance with explicit attribution and drew 14 messages from two participants. BSD user-mode emulation users gain broader syscall coverage closer to host parity.

LoongArch LVZ support for TCG

A 14-patch series for QEMU implements LVZ guest support under LoongArch TCG, enabling nested virtualization. The single-participant thread of 15 messages presents the design as a technical proposal. LoongArch and nested-virt developers gain a path to run guests that themselves host virtual machines under TCG.

virtio-gpu dmabuf ownership refactor

An 18-patch RFC on qemu-devel refactors dmabuf and scanout ownership in virtio-gpu to address issues found via CVE-2026-66020. Two participants produced 22 messages on the series. Graphics and zero-copy display paths stand to become safer once ownership rules are clarified.

Single binary for ARM and RISC-V qemu-system

A 12-patch series proposes linking ARM and RISC-V into one qemu-system binary. Reviewer pushback across 44 messages from seven participants focused on the build approach and command-line impact. Packagers and multi-arch users should note the friction, because a merged binary would change how QEMU is built and invoked.

Logical replication drops unchanged toasted columns

A PostgreSQL bug report shows that logical replication row filters turn unchanged toasted columns into NULL on the subscriber. Eight participants discussed a fix across 28 messages. Replication users with toasted data and row filters risk silent data loss until the behavior is corrected.