QEMU security merges and PostgreSQL readiness fights

QEMU landed websocket denial-of-service fixes and deprecations while PostgreSQL developers contested PGQ readiness and complex v19 features after heavy bug reports. ClickHouse tightened view security barriers, and QEMU advanced RP2040 and Arm Realm support.

QEMU merges websocket DoS fixes and AF_ALG deprecation

Pull request series on qemu-devel merged miscellaneous fixes that address websocket denial-of-service issues tracked as CVE-2026-84788, which permitted unauthenticated crashes. The same merges deprecate the AF_ALG crypto backend. Operators exposing websocket interfaces or depending on kernel crypto offload need to track the change for stability and future compatibility.

PostgreSQL developers report PGQ locking and crash bugs

Core developers on pgsql-hackers documented multiple locking, dependency, and crash defects in PGQ catalog representation and pg_dump support. Release management questioned readiness for versions 19 and 20. The volume of issues raises the chance of schedule pressure or feature deferral for anyone planning on PGQ.

ClickHouse hardens DEFINER and NONE view barriers

A ClickHouse GitHub thread detailed fixes that strengthen security barriers for DEFINER and NONE views against additional_table_filters and row-policy predicate pushdown. The changes close paths that could weaken isolation under those policies. Deployments using view security and row policies should treat the fixes as material for access-control integrity.

Postgres hackers debate reverting three PG19 features

A heated pgsql-hackers thread examined high post-freeze bug counts, identified in part via LLM analysis, for RI foreign-key batching, REPACK CONCURRENTLY, and online checksums. Participants argued over whether the three complex features should be reverted before release. The outcome directly affects what lands in the next major version and the stability risk of adopting those capabilities early.

Offline checksum changes can break PostgreSQL standby state

Discussion on pgsql-hackers reported that offline data checksum changes can leave standbys with mismatched or unreadable checksum state. Patch work to correct the behavior remains under review. Operators who toggle checksums offline or rely on standbys for failover need the fix path before relying on those workflows.

QEMU RFC adds Raspberry Pi Pico and RP2040 machine model

An RFC v3 series proposed an extensive RP2040 and Pico machine model for QEMU, covering DMA, XIP, boot ROM, USB, and tests. The work expands embedded board coverage for developers targeting that platform. It matters for firmware and driver testing without physical hardware.

QEMU RFC advances Arm Realm confidential VM support

RFC v4 posted patches adding Arm RME and Realm support to QEMU-VMM, aligned with recent KVM CCA work. The series continues confidential computing integration for Arm guests. Readers building or testing Realm-based isolation should watch the series for host and guest enablement.