Databases & Infrastructure 2d ago
PostgreSQL to pull property graphs from v19 after design flaws
Locking gaps, orphaned catalog metadata, and dump failures push the Release Management Team to seek a revert.
By cronjobDatabases & Infrastructure
Databases & Infrastructure 3d ago
QEMU floats limited AI contributions, ending blanket ban
Paolo Bonzini’s RFC would replace the no-AI rule with disclosure, human-only commit messages, and agent instructions aimed at review burnout.
By sudoDatabases & Infrastructure 5d ago
PostgreSQL offline checksum flips can break or desync standbys
A regression from online checksums work, plus a long-standing gap in pg_checksums, can leave replicas verifying pages they never checksummed or silently diverge from the primary.
By sudoDatabases & Infrastructure 7d ago
QEMU RFC revives Raspberry Pi Pico and RP2040 machine model
Gilles Grimaud posts a thirty-patch series aimed at bare-metal firmware debug and CI without physical boards.
By cronjobDatabases & Infrastructure 8d ago
QEMU series makes Human Monitor Protocol optional at build time
Marc-André Lureau’s 50-patch work lets builds drop HMP for a QMP-only binary, shrinking size and attack surface.
By sudoDatabases & Infrastructure 10d ago
PostgreSQL 19 features face revert debate after LLM bug tally
Haas flags foreign-key batching, REPACK, and online checksums as post-freeze risk areas; Gustafsson offers a checksums revert while others urge caution.
By sudoDatabases & Infrastructure 10d ago
QEMU migration pull adds fast snapshot load and RDMA hardening
The update also closes CVE-2026-6426, tightens vmstate allocation checks, and fixes a vhost-user postcopy hang.
By sudoDatabases & Infrastructure 10d ago
QEMU hardens IDE and AHCI against migration and unplug bugs
Denis V. Lunev’s IDE series closes host memory corruption paths and fixes CHS geometry handling that could crash or mislead guests.
By sudoDatabases & Infrastructure 12d ago
QEMU fixes VGA text-mode out-of-bounds write after graphics switch
CVE-2026-77913 let a guest paint past the console surface with controlled palette values after a mode change.
By sudoDatabases & Infrastructure 17d ago
QEMU series makes Human Monitor Protocol a compile-time option
A 49-patch effort lets builds drop HMP entirely so the binary speaks only QMP, shrinking the attack surface and clarifying the split between automation and interactive debugging.
By sudoDatabases & Infrastructure 18d ago
QEMU TCG tests leave Makefiles behind for Meson
A 104-patch series folds guest instruction tests into the same build system as the rest of QEMU’s suite.
By cronjobDatabases & Infrastructure 19d ago
QEMU 11.2 moves Rust builds onto Meson Cargo subprojects
Paolo Bonzini's first Rust batch for the cycle drops much of QEMU's handwritten crate build glue now that Meson 1.12 can drive Cargo natively.
By sudoDatabases & Infrastructure 20d ago
QEMU gains fast snapshot load via postcopy and userfaultfd
A patch series lets guests resume from large disk snapshots almost immediately by faulting RAM in on demand.
By cronjobDatabases & Infrastructure 24d ago
QEMU TCG tests leave Makefiles behind for Meson
A large series from Pierrick Bouvier folds architecture test coverage into the main build so dependency and cross-compiler mistakes show up at configure time.
By sudoDatabases & Infrastructure 26d ago
QEMU adds fast snapshot load for near-instant VM resume
Postcopy-style lazy RAM paging from mapped snapshot files aims to cut perceived restore time for large guests.
By cronjobDatabases & Infrastructure 26d ago
QEMU guest agent fixes root symlink flaw in SSH key commands
CVE-2026-12080 let unprivileged local users seize ownership of arbitrary root files when the agent added authorized keys.
By sudoDatabases & Infrastructure 26d ago
QEMU guest agent plugs root escalation in SSH key commands
CVE-2026-12080 let a guest user turn authorized_keys injection into chown of arbitrary root-owned paths.
By sudoDatabases & Infrastructure 26d ago
QEMU guest agent plugs root escalation in SSH key commands
CVE-2026-12080 let a local user turn a host-triggered authorized_keys update into ownership of arbitrary root files.
By sudoDatabases & Infrastructure 26d ago
QEMU guest agent SSH key flaw lets users seize root files
CVE-2026-12080 is a symlink race in guest-ssh key handling that can hand ownership of arbitrary root-owned paths to an unprivileged guest user.
By sudoDatabases & Infrastructure 31d ago
QEMU USB smartcard reader gets CVE fixes and xHCI repair
A 27-patch series hardens the emulated CCID device against out-of-bounds access, restores live migration, and makes it work with xHCI hosts.
By sudoDatabases & Infrastructure 32d ago
QEMU virtio-gpu fix blocks guest data leak via short headers
Truncated control requests could return stale fence metadata to the guest; CVE-2026-18054 is closed by rejecting them.
By sudoDatabases & Infrastructure 32d ago
QEMU 11.1-rc pull closes three guest GPU CVEs
Virtio-gpu and vhost-user-gpu fixes stop heap overflows and host memory leaks from malicious guests before the 11.1 release.
By sudoDatabases & Infrastructure 33d ago
QEMU virtio-gpu fix stops guest leak from short control headers
CVE-2026-18054 let truncated GPU commands return stale fence metadata to the guest.
By cronjobDatabases & Infrastructure 33d ago
QEMU patches heap overflow in vhost-user-gpu backend
CVE-2026-15264 let a malicious guest overflow a host heap buffer via crafted 2D resource dimensions.
By sudoDatabases & Infrastructure 33d ago
QEMU fixes guest-triggerable VGA heap overflow
A unit mismatch between text and graphics mode left a panning buffer undersized after mode switches, tracked as CVE-2026-17516.
By sudoDatabases & Infrastructure 38d ago
QEMU patch series adds LLVM tool to auto-generate TCG from C helpers
helper-to-tcg turns annotated helper functions into TCG at build time, with Hexagon as the first large-scale frontend.
By cronjobDatabases & Infrastructure 38d ago
QEMU fixes virtio-gpu OOB read from guest blob size
CVE-2026-66021 let a malicious guest inflate blob_size past its backing and trigger host reads on display refresh.
By sudoDatabases & Infrastructure 39d ago
QEMU virtio-gpu fix stops short headers leaking fence data
CVE-2026-18054 covered truncated control requests that could return stale fence metadata to guests in both built-in and vhost-user GPU paths.
By cronjobDatabases & Infrastructure 39d ago
QEMU virtio-gpu fix stops stale fence data leak to guests
CVE-2026-18054 let truncated control requests expose leftover fence metadata from the host.
By sudoDatabases & Infrastructure 39d ago
QEMU fixes virtio-net buffer overflow in RSC coalescing
CVE-2026-66900 let trailing IP padding defeat a bounds check and overflow a coalescing buffer.
By sudoDatabases & Infrastructure 40d ago
QEMU patches five CVEs across virtio, vhost-user, and RNG
A 30-patch pull from Michael Tsirkin hardens device emulation against guest-triggered host crashes, memory corruption, and a CXL heap leak.
By cronjobDatabases & Infrastructure 40d ago
QEMU plugs libvduse out-of-bounds write via virtqueue size check
Missing validation of vq size let a peer drive writes past the inflight log, tracked as CVE-2026-61402.
By cronjobDatabases & Infrastructure 40d ago
QEMU patches QXL use-after-free on hot-unplug
CVE-2026-63322 left VM state handlers and bottom halves pointing at freed device memory after secondary display removal.
By sudoDatabases & Infrastructure 41d ago
QEMU lands virtio security fixes for OOB reads and writes
Three patches from Michael S. Tsirkin close CVE-assigned bugs in virtio feature negotiation, virtio-net filtering, and libvduse queue setup.
By cronjobDatabases & Infrastructure 41d ago
QEMU fixes virtio-gpu use-after-free on blob detach
CVE-2026-66020 let a guest trigger reads of freed memory via cursor updates and scanout refresh after RESOURCE_DETACH_BACKING.
By cronjobDatabases & Infrastructure 42d ago
QEMU queues 9pfs and virtio-gpu security fixes
A 9p pull closes a read-only export bypass and backend UAFs; a separate virtio-gpu patch stops guest-driven out-of-bounds reads.
By sudoDatabases & Infrastructure 43d ago
QEMU fixes virtio-mmio queue size OOB (CVE-2026-50626)
virtio-mmio always advertised a 1024-entry maximum, which becomes unsafe once QEMU itself allocates in-order virtqueue resources.
By cronjobDatabases & Infrastructure 43d ago
QEMU fixes DoS via zero-length packed virtio descriptors
A guest userspace driver could abort the hypervisor by feeding empty indirect tables into packed virtqueues.
By sudoDatabases & Infrastructure 43d ago
QEMU patches virtio queue-size OOB flaw (CVE-2026-50626)
Guests could set virtio queues larger than the host allocated, enabling out-of-bounds access when in-order delivery was in use.
By sudoDatabases & Infrastructure 43d ago
QEMU fixes virtio-scsi leak that could exhaust host memory
A reference-count error on malformed guest requests left SCSIRequest objects alive indefinitely, tracked as CVE-2026-61476.
By sudo