QEMU Arm64 models and CVEs, PostgreSQL TOAST and detach fixes

QEMU developers advanced named Arm64 CPU models for KVM, a revised AI contribution policy, and two security patches, while PostgreSQL hackers progressed 8-byte TOAST pointers plus fixes for partition detach crashes and replication slot leaks. ClickHouse reviewed tighter authorization around KILL QUERY.

Named hierarchical Arm64 CPU models for KVM

QEMU received RFC patch series v4 that introduces named hierarchical Arm64 CPU models for KVM guests. The work adds query-cpu-definitions, expansion, and props-info interfaces so live migration can match the tooling already used on x86. Operators running Arm64 virtualization gain consistent CPU feature exposure across hosts and versions.

Eight-byte TOAST pointers in PostgreSQL

PostgreSQL hackers continued review of a second-round patch that enlarges TOAST pointers to eight bytes. Discussion focused on compatibility consequences for existing extensions that inspect or manipulate toasted values. The change would allow larger out-of-line data while altering on-disk and in-memory layouts that extension authors must accommodate.

QEMU policy shift on AI-generated contributions

QEMU circulated RFC patch series v3 that replaces a blanket ban on AI-generated material with regulated disclosure via new AGENTS.md and llm-usage.rst documents. Maintainers debated the concrete rules that would apply to submitted patches. The proposal sets clearer expectations for how AI assistance must be declared in the project.

9pfs FID path race fix (CVE-2026-93834)

A QEMU patch moves FID path mutation in hw/9pfs back to the main thread only. The change closes the race tracked as CVE-2026-93834. Deployments that expose host directories through 9p passthrough need the update to avoid the concurrency flaw.

xHCI timer reentrancy fix (CVE-2026-17588)

A QEMU patch for hw/usb/hcd-xhci installs a reentrancy guard inside timer functions. It eliminates a use-after-free on the paths assigned CVE-2026-17588. Guests that rely on the emulated xHCI controller are protected from the resulting crashes or potential exploits.

Crashes after interrupted concurrent partition detach

PostgreSQL developers examined a bug report and accompanying patches for crashes that occur when DETACH PARTITION CONCURRENTLY is interrupted before completion. The thread also covers a PostgreSQL 19 regression in publication handling for such partitions. Sites that detach partitions under load require the fixes to restore stability.

ClickHouse KILL QUERY authorization tightening

A ClickHouse pull request corrects authorization so KILL QUERY can succeed without a SELECT privilege on system.processes. Reviewers noted that several edge cases remain open. The change improves least-privilege control over query termination.

Replication slot release on SQL-callable errors

PostgreSQL hackers reviewed a patch that releases replication slots when errors occur inside SQL-callable slot functions. The fix targets leaks that appear on subtransaction abort paths. It prevents slot exhaustion when slot operations fail inside larger transactions.