QEMU IP checksum CVE and PostgreSQL WAL work

QEMU developers posted a fix for an out-of-bounds bug in IP checksum handling, while PostgreSQL discussion covered hash-index WAL logging and statement timeout races. Smaller QEMU device and NBD patches also moved.

QEMU fixes out-of-bounds access in IP checksum code

A patch series on qemu-devel fixes CVE-2026-127233 in net/checksum.c, where crafted IP packets can cause out-of-bounds reads and writes. The bug affects virtio-net and xen-nic. A v2 of the series was posted for the 11.2 release.

PostgreSQL hash indexes drop pin-only WAL registration

A patch series proposes stopping registration of pin-only bucket pages in WAL by removing REGBUF_NO_CHANGE. The change also addresses a pre-existing torn-page hazard during recovery. The thread drew 23 messages from six participants.

Two statement_timeout races reported in PostgreSQL

Tomas Vondra reported two race conditions around statement_timeout and supplied patches. Follow-up discussion added further cases and tests.

QEMU virtio-snd gets another round of small fixes

A v2 series of six patches proposes hardening and correctness fixes for the QEMU virtio-snd device. One patch received a Reviewed-by.

QEMU NBD pull rejects protocol violations

A pull request covering NBD patches through 2026-11-10 fixes two low-severity CVEs. The code now rejects protocol violations instead of asserting.

QEMU SMMUv3 model gains Secure state support

A v6 series of 35 patches adds Secure state support and MMIO fixes to the QEMU SMMUv3 ARM model.