QEMU security pulls and Postgres JSON deparse fix

QEMU maintainers landed a large pull of virtio, vhost, and display security fixes spanning several CVEs, while a Meson migration for TCG tests drew extended review. PostgreSQL developers discussed a deparsing correction for JSON_ARRAY constructors.

QEMU pull bundles virtio, vhost, and IOMMU CVE fixes

A 30-patch pull request for QEMU delivers bugfixes across pci, vhost, virtio, and iommu code. The series resolves multiple CVEs involving out-of-bounds access and infinite loops in virtio, vhost-user, iommu, and CXL paths. Virtualization users should treat the update as priority hardening for common device backends.

libvduse adds vq size checks for CVE-2026-61402

One patch in the QEMU series validates virtqueue size inside libvduse. The change closes CVE-2026-61402 and stops related out-of-bounds writes. It strengthens the shared library used by vduse-based virtio devices.

QXL hot-unplug use-after-free closed

QEMU QXL display code now stores the VMChangeStateEntry and registers an exit path that unregisters the handler and bottom halves. The work fixes a use-after-free on hot-unplug tracked as CVE-2026-63322. Clean teardown prevents crashes when QXL devices are removed at runtime.

TCG tests move from Makefiles to Meson

A 98-patch series proposes running QEMU TCG tests under Meson rather than Makefiles. Seven participants debated cross-compiler detection and container support during review. The conversion modernizes the test infrastructure that exercises the emulator's code generators.

virtio-net RSC path blocks OOB read

A targeted QEMU virtio-net patch inserts a bounds check on the receive-side coalescing path. It eliminates an out-of-bounds read fixed as CVE-2026-63321. Guests using virtio-net RSC benefit from stricter packet handling.

Incomplete VNC OOB write fix reaches stables

An out-of-bounds write in QEMU VNC lossy rectangle refresh (CVE-2026-48002) required two successive patches. Stable branches shipped only the first incomplete change while keeping the same CVE identifier. Operators need to verify that both corrections are present in their packages.

PostgreSQL JSON_ARRAY deparsing round-trip fix

A proposed PostgreSQL patch stores JsonFormat inside JsonConstructorExpr. This lets JSON_ARRAY(subquery FORMAT JSON) survive view deparsing without losing the format clause. Accurate deparsing improves dump, restore, and schema-tool fidelity.

vmstate size type confusion for large vhost buffers

A QEMU vmstate patch corrects type confusion in vmstate_size for VMSTATE_VBUFFER_UINT64. The bug produced negative or truncated sizes when vhost-user buffers exceeded 2 GB. The fix stabilizes migration and live-state handling for large memory regions.