The applications we know are affected are luajit and mozjs (libv8 is
not a problem). But this has a follow-on cost: both of these are used
by other packages. Other jit/runtime packages could have their own
issues.
The mozjs bug is fixed on trunk, and will hopefully make it into
release 49[2], but it remains to be seen if that's too late for some
distributions.
Since mozjs is “special” when it comes to API, you have to depend on a specific version of it, so policykit hard-depends on mozjs17, which has no fixes available for the VA problem :( I’ve seen reports of systems unable to boot because of the systemd->polkit->mozjs chain. Is anyone working on fixing that?