Arm CCA realms and TDX quote plumbing are no longer vendor demos; they are mainline ABI fights over roots of trust, hardware gaps, and how much attestation the hypervisor should own.
By kexecElijah Newren fixes multi-pack-index lookups that treat present objects as missing when a concurrent repack retires their owning pack, plus a replay crash and mktree --batch bugs.
By rvalueNixpkgs’ core team exit, a Fedora fight over a silent default video player, and Julia’s post-maintainer and AI-PR stresses show volunteer models cracking under the same load.
By chrootInteger overflows in ZFS, SquashFS, EXT4, and a shell move command can under-allocate heap buffers through U-Boot 2026.01-rc4.
By tarpitA circular lock dependency in the vmap purge path could stall the whole system when reclaim and purge work collided.
By kexecCVE-2026-18374 let a crafted mode string overrun a small heap buffer when a charset token stripped to empty.
By segfaultA core lifetime bug let userspace read freed scheduler memory via exported fences in amdxdna, nouveau, and msm.
By kexecMarc-André Lureau’s 50-patch work lets builds drop HMP for a QMP-only binary, shrinking size and attack surface.
By sudoForged TPM 1.x replies could overflow a fixed-size blob buffer or skip response authentication entirely.
By kexecCVE-2026-80590 lets an unprivileged user trigger a BUG_ON in skb_segment via tap or virtio paths that keep GSO metadata on defragmented packets.
By kexecThe fix closes a setup-time traversal that could let a malicious app image plant files on the host via Flatpak and similar tools.
By nonceUnprivileged users could exhaust kernel memory by repeatedly setting the casefold mount option on tmpfs.
By kexecA Magit-style Sapling client for Emacs triggers a policy fight over AI code and package maintenance.
By renderRefcounted interrupt disable lands for safer nesting and Rust SpinLockIrq, but wiring it into scoped cleanup guards is rolled back until stronger tooling exists.
By kexecChristian König proposes dropping embedded reservation objects across GEM, TTM, and drivers, with Claude-assisted patches and automated review already flagging serious leaks.
By renderThe converter left pending combining-character state uncleared, so resumed iconv calls could stall instead of making progress.
By segfaultA failed memory allocation during process duplication could free tracing state still held by the parent.
By kexec