QEMU cursor and NBD fixes, Postgres stats and detach bugs

QEMU landed or proposed fixes for an out-of-bounds read in virtio-gpu cursors and for two low-severity NBD issues, including a denial-of-service path on malformed BLOCK_STATUS. PostgreSQL discussion centered on WAL statistics that have double-counted parallel workers since version 14, plus crashes after an interrupted concurrent partition detach.

QEMU rejects non-32bpp virtio-gpu cursors

A four-patch series on qemu-devel rejects virtio-gpu cursor resources that are not 32 bits per pixel in the GL, rutabaga, and vhost-user backends. The change closes CVE-2026-122027, an out-of-bounds read triggered by those non-32bpp cursor resources. Guests that can supply cursor images to those backends are the exposure.

QEMU NBD pull includes two CVE fixes

An eight-patch NBD pull through 2026-11-10 merges fixes for two low-severity CVEs, along with new robustness tests and TLS security guidance. The set is the integration point for recent NBD server hardening rather than a single isolated bugfix. Operators running QEMU's NBD server get both the CVE fixes and clearer TLS expectations in one pull.

Postgres WAL stats stop double-counting parallel workers

A patch on pgsql-hackers corrects cumulative WAL statistics that double-count work from parallel workers in pg_stat_wal and EXPLAIN. The miscount has been present since PostgreSQL 14. Anyone using those views or plans to judge WAL volume has been reading inflated numbers when parallel workers ran.

NBD server rejects bad BLOCK_STATUS instead of asserting

A QEMU NBD server change replaces an assertion on non-compliant BLOCK_STATUS with a clean reject. That is the fix for CVE-2026-124559, a denial of service. A peer that sends a malformed status request can no longer take the server down via the assert path.

Logical replication conflict log still under review

Review continues on a proposed conflict log history table for PostgreSQL logical replication, with 15 people and a long thread covering error handling, GUCs, and edge cases. The table would give operators a durable record of replication conflicts instead of transient log lines. The design is not settled; the thread is still working through failure modes and configuration.

Interrupted concurrent detach can crash Postgres

A bug report and patches address crashes on a partition whose DETACH PARTITION CONCURRENTLY never finished. The fallout includes a PostgreSQL 19 regression in publication handling. Clusters that detach partitions concurrently and then hit a crash or cancel can leave catalogs in a state that faults on later access.

QEMU marks which devices are safe to create for virt

A 28-patch series marks user-creatable devices as secure or not for virtualization use cases, defining security boundaries for KVM and Xen. The point is to make the set of devices a guest-facing configuration may instantiate explicit. It is a policy marking pass, not a single vulnerability fix.

Arm Realm support returns as QEMU RFC v4

An RFC v4 series proposes Arm Realm Management Extension confidential guest support in the QEMU VMM, wired to KVM guest-memfd and the Realm Management Monitor. It is still a request for comments, not merged code. Developers tracking confidential computing on Arm are the audience; nothing here changes default QEMU guests yet.