PostgreSQL REPACK data loss, QEMU CVE and AI policy

PostgreSQL developers reported silent data loss risk in concurrent REPACK and refined replication slot persistence, while QEMU merged a guest-triggered use-after-free fix and advanced AI contribution rules, APX TCG support, and aarch64 KVM modeling. The day centered on storage integrity and hypervisor security plus policy and ISA work.

Silent data loss in PostgreSQL REPACK CONCURRENTLY

A pgsql-hackers thread reports that REPACK CONCURRENTLY can silently lose updates when the toast table is rewritten. Discussion includes a patch that adds detection and raises an error rather than proceeding. Operators running online table reorganization on large PostgreSQL instances face a risk of undetected data loss until the fix lands.

QEMU proposes new AI contribution policy

An RFC patch series on qemu-devel seeks to reverse QEMU's prior ban on AI-generated contributions. The draft requires disclosure, restricts agent behavior, and leaves acceptance to maintainer discretion. Contributors and maintainers need clear rules as AI tooling enters hypervisor development workflows.

QEMU merges xHCI fix for CVE-2026-17588

A pull request lands a reentrancy guard in QEMU hw/usb/hcd-xhci timer functions. The change addresses CVE-2026-17588, a guest-triggered use-after-free via reentrant timer DMA to MMIO. Virtualization hosts must track the fix to preserve guest isolation boundaries.

QEMU TCG gains Intel APX support

Paolo Bonzini posted a v2 17-patch series implementing Advanced Performance Extensions for the QEMU x86 TCG decoder. The work adds EVEX prefix handling and new instructions including CCMP, CFCMOV, and PUSH2. Emulator users targeting recent Intel CPUs obtain earlier instruction-set coverage.

PostgreSQL slot invalidation persistence order

A pgsql-hackers patch ensures replication slot invalidations are written to disk before shared-memory publication. The ordering change prevents restart inconsistencies that arise when in-memory state becomes visible ahead of durable storage. High-availability deployments gain more reliable slot recovery after crashes.

PRODUCT aggregate review continues

PostgreSQL hackers are reviewing a patch that adds a PRODUCT() aggregate function. Focus areas include performance characteristics, overflow behavior, and SQL-standard ON EMPTY syntax. Application developers who currently compute products in client code may later gain a native server-side option.

Direct TOAST addressing proposal

A v2 patch series proposes direct TID addressing for TOAST tuples in PostgreSQL. The design aims to cut index lookups and write amplification while remaining smaller and requiring no migration. Workloads that store large variable-length values could see reduced I/O if the approach is accepted.

Customizable aarch64 KVM host model

A v9 26-patch series on qemu-devel introduces a customizable aarch64 KVM host model with writable ID register fields. Generated sysreg definitions and QMP updates support more flexible migration. Arm virtualization developers obtain finer control over presented host CPU features across host changes.