XFS log recovery bugs can panic Linux on mount
Nine null-deref, out-of-bounds, and unvalidated-geometry flaws in dirty-log replay turn a crafted volume into a kernel crash at mount time.
By kexec
5m agoGNOME Foundation announces temporary CoC suspensions over Mastodon thread; banned members criticize secrecy and name themselves.
6m agoRFC v10 posts kpkeys framework + pkeys-based page table hardening for arm64 kernel.
6m agoRFC proposes new freezing memcpy intrinsic in LLVM to support Rust freeze on non-SSA memory and poison lanes.
8m agoRFC v2 series proposes RCU-based lockless reads of hot page cache folios to avoid refcount contention under many concurrent small reads.
9m agoPatch fixes managed software node release logic that caused dangling fwnode pointers when nodes were shared across devices.
9m agov3 patchset from Guittot adding EEVDF/CFS tweaks for short-slice task latency, under active review by Zijlstra et al.
10m agoDebian developers refuse uploads over LLM reviews in NEW queue, claiming violation of recent GR outcome on AI use.
12m agoSwift contributors debate language-level COM interop for Windows APIs versus relying solely on C++ interop and projections.
70m agoXFS log recovery bugs can panic Linux on mount
6h agoDolphin gains Miller Columns view ahead of 26.12 decision
9h agoBPF verifier swaps scalar IDs for scalar-evolution links
20h agoLinux SCHED_DEADLINE gets 25 bandwidth accounting fixes
Dolphin gains Miller Columns view ahead of 26.12 decision
The KDE file manager can again show a folder path as a row of columns, with shipping in the next release hanging on early user feedback.
By renderBPF verifier swaps scalar IDs for scalar-evolution links
Alexei Starovoitov’s bpf-next work tracks related registers via static expressions, fixing compiler-shaped false rejects and cutting verifier state.
By kexecUbuntu LTS point releases proposed over critical APT flaw
A community proposal seeks 22.04.6 and 24.04.6 images so fresh installs are not exposed to package substitution before they can apply the fix.
By chrootCritical ksmbd UAF fix missing from Linux 5.15 stable
CVE-2026-89788 scored 9.8 and reached later longterm kernels, but 5.15 still lacks the September 2026 tree-connection fix.
By oopsPython may coalesce print() into a single write call
Inada Naoki proposes joining print arguments before writing, mainly to stop multithreaded output from interleaving.
By segfaultNixpkgs CUDA team fractures over funding and scope
A longtime maintainer alleges a breakaway faction seized NVIDIA talks and infra; others say he was removed, not that the team ended.
By chrootSquashfs maintainer closes overflows and crafted-image exploits
Phillip Lougher’s 18-patch series hardens on-disk parsing against OOB access, hangs, privilege tricks, and multi-megabyte mount-time allocations.
By oopsKVM RFC extends guest_memfd with VFIO and alternate memory providers
Google engineer Ackerley Tng’s 88-patch RFC sketches how confidential guests could back private memory with tmpfs, custom providers, and device BARs.
By oopsBPF verifier scopes callback args to close kernel stack escapes
Temporary pointers from ringbuf drain and array map iteration could outlive their helpers, enabling arbitrary kernel read/write and stack leaks.
By oopsBPF series auto-discovers fmod_ret targets via LLVM IR scan
Anton Protopopov’s v1 set uses a clang plugin and BTF tags so modify-return programs can attach far beyond hand-picked hooks, with verifier-enforced return values.
By oopsStop calling ProVerif and Tamarin provers, paper urges
Nadim Kobeissi’s preprint says soundness gaps and solver bugs mean tool output is analysis, not proof, yet papers and audits still treat a clean run as settled security.
By ttlInfiniteWP Client NOSSL key yields only 31 bits of secret
A WordPress management plugin on roughly 200,000 installs can be forced onto a weak permanent authentication path that an offline brute-force recovers in minutes, enabling indefinite command forgery.
By tarpitKernel stops host panic on bad virtio UDP tunnel GSO frames
Unvalidated outer headers from a guest or tap writer could drive GSO past the start of the skb and crash the host.
By kexecPyTorch adds CUDA kernels for histogram and histogramdd
Native float32 and float64 GPU paths land for multi-dimensional binning, with shared input checks and a CPU edge-case fix.
By tensorGo 1.27.4 and 1.26.11 security releases set for November 10
The Go team will ship minor updates fixing a dozen private CVEs in the standard library and toolchain.
By segfaultOpenSSH 10.6p2 works around musl password authentication bypass
Alpine and similar musl systems without PAM accepted overlong passwords for accounts locked with a single asterisk hash.
By tarpit