QEMU 9pfs and Kubernetes CVEs, PostgreSQL repack race

Security fixes landed for QEMU 9pfs and two Kubernetes advisories, while PostgreSQL developers tracked a silent update loss in concurrent repack and kept advancing larger TOAST pointers. QEMU also moved RFCs on AI contribution rules and named Arm64 CPU models for KVM.

QEMU 9pfs FID path fix for CVE-2026-93834

The QEMU 9pfs maintainer posted and merged a single-commit pull that resolves CVE-2026-93834 by confining FID path mutation to the main thread instead of a worker thread. The change closes a concurrency hole in 9p filesystem emulation. Operators using 9pfs guests should treat the update as a required security fix.

Kubernetes CVE-2026-2270 on StatefulSet write rights

Kubernetes published a medium-severity advisory for CVE-2026-2270. Write permissions on StatefulSet and ControllerRevision objects can be abused to create pods across namespaces. Cluster operators need to audit RBAC grants for those resources and apply the published remediation.

REPACK CONCURRENTLY can silently drop TOAST updates

On pgsql-hackers, a report showed that REPACK CONCURRENTLY can lose committed TOAST updates when the toast table is rewritten, owing to a relfilenode race. A patch was proposed to detect the condition and fail rather than proceed. Sites that rely on concurrent repack of TOAST-heavy tables should watch the thread closely.

QEMU RFC on regulated AI-generated contributions

An RFC series proposes replacing QEMU's blanket ban on AI-generated code with disclosure rules documented in AGENTS.md and llm-usage.rst. Maintainers are debating the concrete policy details across a multi-message thread. The outcome will shape how future patches are submitted and accepted.

Named Arm64 CPU models for KVM

RFC v4 adds hierarchical named CPU models for Arm64 under KVM, plus query-cpu-definitions, expansion, and props-info commands. The work aims to support live migration and bring Arm64 tooling in line with existing x86 practice. It matters for anyone managing long-lived Arm64 KVM guests in QEMU.

Kubernetes CVE-2026-76654 Windows subPath NTLM coercion

Kubernetes issued a medium advisory for CVE-2026-76654. On Windows nodes, subPath symlinks can be used to coerce NTLM authentication via the kubelet. Windows cluster operators should evaluate exposure and apply the vendor fixes.

PostgreSQL 8-byte TOAST pointer work continues

The second-round patch set for 8-byte TOAST values is progressing through review on pgsql-hackers, with noted compatibility impact on extensions. Larger TOAST pointers would raise the ceiling for out-of-line data. Extension authors and users of very large values have a stake in the final design.