QEMU CVEs and HMP optionality, Postgres feature reverts

QEMU developers shipped security fixes for CCID and VNC websocket paths while advancing optional HMP and LoongArch nested virtualization. PostgreSQL hackers debated reverting complex PG19 features after high post-freeze bug counts and tracked checksum and logical replication defects.

QEMU CCID smartcard CVE and correctness fixes

A 27-patch series on qemu-devel addresses three CVEs for out-of-bounds access and assertion failures in the USB CCID smartcard reader device, plus migration, endianness, and specification problems. The work hardens device emulation used with USB passthrough. Operators running QEMU with smartcard readers should apply the series.

QEMU HMP made compile-time optional

A 50-patch series proposes making the Human Monitor Protocol optional via --disable-hmp so it can later stand alone and be cleanly separated from QMP. Builds can omit the interactive monitor for a smaller surface. Maintainers seeking leaner or more locked-down QEMU configurations will care about the split.

PostgreSQL debate on reverting PG19 features

Postgres hackers heatedly discussed reverting three complex features (RI FK batching, REPACK CONCURRENTLY, and online checksums) after LLM-assisted analysis showed high post-freeze bug counts. The thread weighs stability against new capability ahead of release. Operators planning PG19 upgrades should watch whether the features stay.

QEMU VNC websocket pre-auth crash fix

A 6-patch series fixes an unauthenticated crash in the VNC websocket handshake that occurred on malformed HTTP requests because of error-handling bugs. The flaw allows denial of service before authentication. Sites exposing QEMU VNC over websockets need the patches.

PostgreSQL offline checksums break standby state

A report shows that offline data checksum changes can leave standbys with mismatched or unreadable checksum state. Patch discussion is under way on pgsql-hackers. Administrators who enable checksums and use streaming standbys should review the failure modes.

QEMU LoongArch LVZ nested virtualization

A 14-patch series adds LVZ guest support under LoongArch TCG, enabling nested virtualization for that architecture. The change expands what LoongArch guests can run inside QEMU. Developers targeting LoongArch platforms gain a missing nesting path.

QEMU TCG per-block dispatch cuts

A v3 seven-patch series for accel/tcg introduces inline jump-cache probes, larger caches, and cross-page chaining to reduce per-translation-block dispatch overhead, with measured gains of 5-9 percent. Emulation workloads that spend time in the dispatcher stand to improve. The technical review continues on qemu-devel.

PostgreSQL logical replication toast filter bug

A bug report and fix thread document that row filters in logical replication turn unchanged toasted columns into NULL on the subscriber. Filtered publications can therefore lose data integrity for TOAST values. Users of logical replication with large columns need the correction.