cronjob
Databases & Infrastructure desk
PostgreSQL to pull property graphs from v19 after design flaws
Locking gaps, orphaned catalog metadata, and dump failures push the Release Management Team to seek a revert.
QEMU RFC revives Raspberry Pi Pico and RP2040 machine model
Gilles Grimaud posts a thirty-patch series aimed at bare-metal firmware debug and CI without physical boards.
QEMU TCG tests leave Makefiles behind for Meson
A 104-patch series folds guest instruction tests into the same build system as the rest of QEMU’s suite.
QEMU gains fast snapshot load via postcopy and userfaultfd
A patch series lets guests resume from large disk snapshots almost immediately by faulting RAM in on demand.
QEMU adds fast snapshot load for near-instant VM resume
Postcopy-style lazy RAM paging from mapped snapshot files aims to cut perceived restore time for large guests.
QEMU virtio-gpu fix stops guest leak from short control headers
CVE-2026-18054 let truncated GPU commands return stale fence metadata to the guest.
QEMU patch series adds LLVM tool to auto-generate TCG from C helpers
helper-to-tcg turns annotated helper functions into TCG at build time, with Hexagon as the first large-scale frontend.
QEMU virtio-gpu fix stops short headers leaking fence data
CVE-2026-18054 covered truncated control requests that could return stale fence metadata to guests in both built-in and vhost-user GPU paths.
QEMU patches five CVEs across virtio, vhost-user, and RNG
A 30-patch pull from Michael Tsirkin hardens device emulation against guest-triggered host crashes, memory corruption, and a CXL heap leak.
QEMU plugs libvduse out-of-bounds write via virtqueue size check
Missing validation of vq size let a peer drive writes past the inflight log, tracked as CVE-2026-61402.
QEMU lands virtio security fixes for OOB reads and writes
Three patches from Michael S. Tsirkin close CVE-assigned bugs in virtio feature negotiation, virtio-net filtering, and libvduse queue setup.
QEMU fixes virtio-gpu use-after-free on blob detach
CVE-2026-66020 let a guest trigger reads of freed memory via cursor updates and scanout refresh after RESOURCE_DETACH_BACKING.
QEMU fixes virtio-mmio queue size OOB (CVE-2026-50626)
virtio-mmio always advertised a 1024-entry maximum, which becomes unsafe once QEMU itself allocates in-order virtqueue resources.
QEMU virtio-gpu fix stops cursor update from freed blob memory
CVE-2026-66020 left a dangling pointer after RESOURCE_DETACH_BACKING, so UPDATE_CURSOR could memcpy from freed host memory.
QEMU virtio-gpu fix stops guest OOB read via blob size
A missing check let a malicious guest inflate blob size past its backing buffer and force out-of-bounds host reads on scanout.
QEMU virtio-net DMA re-entrancy guard bypass fixed
An incomplete follow-up to CVE-2024-3446 left the network device open to the same class of attack under a new CVE.
QEMU device models and migration streams keep producing host CVEs
A dense run of USB, display, NIC, and UEFI fixes shows the project still treating guest and migration input as untrusted, while the underlying C surface remains large enough that clouds must keep asking how much trust that buys them.
QEMU lands USB, UEFI, and QXL security fixes in one busy window
Developers closed multiple CVEs spanning usbredir and XHCI, the UEFI variable service, and QXL primary surfaces.