QEMU memory bugs and PostgreSQL 19 wrong results

QEMU developers posted fixes for guest-facing memory bugs in NBD, the DMG LZFSE decoder, and the network checksum path. PostgreSQL hackers discussed wrong query results in version 19 and a partition-attach slowdown that worsened in version 18.

QEMU NBD pull merges two low-severity CVE fixes

A pull request on qemu-devel, covering NBD patches through 2026-11-10, merges fixes for two low-severity CVEs along with new robustness tests and TLS security guidance. Users of QEMU's NBD paths should track the merge for those security and hardening changes.

Checksum code mishandles IP header length

A patch series for net/checksum.c fixes CVE-2026-127233, where a crafted IP header length can cause a buffer overread or overwrite. Incorrect signed versus unsigned handling of the header length can allow out-of-bounds reads and writes on virtio-net and similar paths.

DMG LZFSE decoder can disclose heap contents

Patches for block/dmg-lzfse address CVE-2026-116483, in which a short LZFSE decode can leak uninitialized heap memory to a guest. The fix requires extra decode capacity, rejects short decodes, and adds a regression test.

PostgreSQL 19 NOT NULL simplification returns wrong results

Discussion on pgsql-hackers covers multiple correctness bugs in PostgreSQL 19's NOT NULL-based expression simplification, including effects on ON CONFLICT and MERGE. Fixes are under discussion, and some items remain open.

Partition attach slows as pg_constraint grows

ATTACH PARTITION cost grows linearly with the size of pg_constraint because CloneFkReferenced performs a sequential scan, and the cost is much worse since PostgreSQL 18 stores not-null constraints in that catalog. A proposed patch adds an index on confrelid.

Series resolves QOM type conflicts for multi-target builds

A 48-patch series resolves QOM type name conflicts across targets so QEMU can produce multi-target binaries with unified introspection. The work is aimed at builds that combine more than one target in one binary.