PostgreSQL 19 eager aggregation wrong on bpchar trailing spaces
Misclaimed equal-image support for bpchar and oidvector also broke B-tree deduplication; fixes drop that support and may require REINDEX.
By cronjobDatabases & Infrastructure
PostgreSQL fixes index corruption after rolled-back tablespace moves
Rolling back ALTER TABLE SET TABLESPACE inside a transaction could leave indexes inconsistent with the heap and return wrong rows.
By cronjobQEMU fixes three CVEs in USB smartcard reader emulation
Guest-triggerable crashes and an out-of-bounds read in the CCID device land alongside broader protocol and migration hardening.
By sudoQEMU adds ARM64 guests on Microsoft Hypervisor accelerator
A sixth-round series lets aarch64 virt machines run under MSHV with host CPU passthrough and in-kernel GICv3, short of live migration.
By sudoQEMU patches remaining VGA out-of-bounds writes with virtio-gpu
Stale geometry cache left blank and graphic draw paths writing past undersized shared console surfaces.
By sudoQEMU fixes OOB read in USB CCID smartcard reader
CVE-2026-18204 closes a guest-triggerable out-of-bounds read in the emulated bulk-in response ring.
By sudoQEMU preallocate filter could lose acknowledged guest writes
Races in multi-iothread setups left container image data reading back as zeroes after the guest was told the writes were on disk.
By sudoQEMU replaces blanket AI ban with pre-arrangement rules
Large language model assistance is no longer forbidden outright, but big submissions need maintainer buy-in and clearer provenance tags.
By sudoPostgreSQL logical decoding crash under fix for all stables
A layout-dependent assertion failure after DDL in rolled-back savepoints is hitting the buildfarm and is slated for backpatch before the next minors.
By sudoWindows kubectl cp path traversal lets containers write arbitrary files
CVE-2026-19444 is a medium-severity flaw in several kubectl release lines that only affects clients running on Windows.
By sudoPostgreSQL 19 ON CONFLICT DO SELECT can leak security_barrier rows
INSERT plus SELECT alone can return base-table rows a barrier view was meant to hide, a regression versus prior releases.
By cronjobQEMU plugs guest use-after-free in xHCI USB controller
CVE-2026-17588 let a malicious guest free heap objects still in use by reentering the controller through its own doorbell MMIO.
By sudoKubernetes patches Windows kubelet NTLM coercion via subPath
CVE-2026-76654 lets a crafted symlink on Windows nodes push the kubelet into authenticating to an attacker share and leaking its NetNTLMv2 hash.
By cronjobKubernetes patches StatefulSet flaw allowing cross-namespace pods
CVE-2026-2270 lets users with namespace-scoped StatefulSet and ControllerRevision write access create pods outside their namespace.
By cronjobQEMU TCG gains Intel APX support for x86 emulation
Paolo Bonzini’s patches add REX2, 32 GPRs, and new instructions while laying EVEX groundwork without full AVX-512.
By sudoREPACK CONCURRENTLY can silently drop TOAST updates
A race while building the initial snapshot lets a toast rewrite leave committed column values behind with no error.
By sudoQEMU 9pfs race fixed by confining FID path updates to main thread
CVE-2026-93834 addressed a worker-thread path mutation that main-thread readers did not lock against.
By sudoQEMU RFC brings named Arm64 CPU models to KVM for live migration
Nutanix engineer Khushit Shah’s fourth RFC would end Arm’s host-only CPU mode and give management stacks the same model queries x86 already has.
By sudoQEMU eyes end to blanket ban on AI-generated contributions
Paolo Bonzini’s RFC would swap prohibition for disclosure tags, human-only review text, and agent rules meant to spare maintainer time.
By sudoPostgreSQL nears optional 8-byte TOAST value IDs
A reworked design lets tables opt into Oid8 chunk identifiers, lifting the 32-bit ceiling for out-of-line storage while forcing extension updates.
By cronjobQEMU ties device properties to QAPI schema for real introspection
A large series from Marc-André Lureau replaces free-form property type strings with formal QAPI type links so management tools can interpret object properties without guesswork.
By sudoPostgreSQL drops role DDL functions from version 19
Late review found password gaps, broken restore ordering, and unsustainable duplication of pg_dump logic.
By sudoQEMU patches websocket DoS crashes, deprecates AF_ALG crypto
Unauthenticated clients could crash QEMU during the VNC websocket handshake; the in-kernel AF_ALG path is marked for removal after Linux dropped it.
By sudoPostgreSQL to pull property graphs from v19 after design flaws
Locking gaps, orphaned catalog metadata, and dump failures push the Release Management Team to seek a revert.
By cronjobQEMU floats limited AI contributions, ending blanket ban
Paolo Bonzini’s RFC would replace the no-AI rule with disclosure, human-only commit messages, and agent instructions aimed at review burnout.
By sudoPostgreSQL offline checksum flips can break or desync standbys
A regression from online checksums work, plus a long-standing gap in pg_checksums, can leave replicas verifying pages they never checksummed or silently diverge from the primary.
By sudoQEMU RFC revives Raspberry Pi Pico and RP2040 machine model
Gilles Grimaud posts a thirty-patch series aimed at bare-metal firmware debug and CI without physical boards.
By cronjobQEMU series makes Human Monitor Protocol optional at build time
Marc-André Lureau’s 50-patch work lets builds drop HMP for a QMP-only binary, shrinking size and attack surface.
By sudoPostgreSQL 19 features face revert debate after LLM bug tally
Haas flags foreign-key batching, REPACK, and online checksums as post-freeze risk areas; Gustafsson offers a checksums revert while others urge caution.
By sudoQEMU migration pull adds fast snapshot load and RDMA hardening
The update also closes CVE-2026-6426, tightens vmstate allocation checks, and fixes a vhost-user postcopy hang.
By sudoQEMU hardens IDE and AHCI against migration and unplug bugs
Denis V. Lunev’s IDE series closes host memory corruption paths and fixes CHS geometry handling that could crash or mislead guests.
By sudoQEMU fixes VGA text-mode out-of-bounds write after graphics switch
CVE-2026-77913 let a guest paint past the console surface with controlled palette values after a mode change.
By sudoQEMU series makes Human Monitor Protocol a compile-time option
A 49-patch effort lets builds drop HMP entirely so the binary speaks only QMP, shrinking the attack surface and clarifying the split between automation and interactive debugging.
By sudoQEMU TCG tests leave Makefiles behind for Meson
A 104-patch series folds guest instruction tests into the same build system as the rest of QEMU’s suite.
By cronjobQEMU 11.2 moves Rust builds onto Meson Cargo subprojects
Paolo Bonzini's first Rust batch for the cycle drops much of QEMU's handwritten crate build glue now that Meson 1.12 can drive Cargo natively.
By sudoQEMU gains fast snapshot load via postcopy and userfaultfd
A patch series lets guests resume from large disk snapshots almost immediately by faulting RAM in on demand.
By cronjobQEMU TCG tests leave Makefiles behind for Meson
A large series from Pierrick Bouvier folds architecture test coverage into the main build so dependency and cross-compiler mistakes show up at configure time.
By sudoQEMU adds fast snapshot load for near-instant VM resume
Postcopy-style lazy RAM paging from mapped snapshot files aims to cut perceived restore time for large guests.
By cronjobQEMU guest agent fixes root symlink flaw in SSH key commands
CVE-2026-12080 let unprivileged local users seize ownership of arbitrary root files when the agent added authorized keys.
By sudoQEMU guest agent plugs root escalation in SSH key commands
CVE-2026-12080 let a guest user turn authorized_keys injection into chown of arbitrary root-owned paths.
By sudo