When one CA's weak P-384 keys force everyone else to purge trust
Flawed eMudhra intermediates triggered root removals, Python toolchain freezes, and a sharper fight over who should own the CA bundle.
By tarpit
4m agoRFC series posts complete TDX guest TSM phase-2 implementation for TDISP/TEE-IO device assignment and solicits cross-arch feedback.
10m ago26-patch series introduces DMA-buf mapping types to replace scatterlist-only model for VFIO/IOMMUFD/P2P use cases.
13m agoGit for Windows 2.56.0(4) is an urgent security release fixing corrupt 32-bit signatures and brotli CVE-2026-111497.
31m agoPatch series fixes eight OOB/overflow bugs in QEMU display, audio and SCSI emulation, some marked for stable.
43m agoExternal org proposes Nix manual translations via separate Crowdin/GitHub setup; community raises governance and fragmentation concerns.
67m agoPatch fixes sockmap bug where empty FIN skbs from tcp_read_skb broke redirects and triggered EPIPE since v6.0.
70m agoPostgreSQL hackers actively reviewing and iterating on patches to add a conflict log history table for logical replication.
78m agov2 patchset adding DCP firmware-backed KMS backend to MSM DRM via VirtIO/HFI on Qualcomm platforms.
2h agoPython issues expedited releases blocking compromised eMudhra CA keys
4h agoBPF verifier rewrite targets Rust with recursion and open loops
5h agoNode.js patches Brotli RCE that spreads far past the runtime
6h agoRocq and Lean 4 kernel bugs let checked proofs of False through
BPF verifier rewrite targets Rust with recursion and open loops
Alexei Starovoitov posts an 82-patch series that joins verifier states instead of walking every path, so rustc output can load.
By oopsRocq and Lean 4 kernel bugs let checked proofs of False through
Four oss-security reports detail soundness and audit flaws that accept 0 = 1 without axioms, spanning two major proof assistants.
By nonceLean formalization of Julia Base surfaces hundreds of bugs
Miles Cranmer modeled concrete Base types and docstring promises as Lean theorems, filing 75 filtered reports after AI-assisted proof attempts failed.
By rvalueQEMU fixes eight OOB and overflow bugs in device emulation
A manual audit found heap writes, host memory disclosure, and a guest-triggerable hang across display, audio, and SCSI backends.
By sudoBPF maintainer NACKs page_owner iterator series as overkill
Alexei Starovoitov wants one thin kfunc and a bpf_for loop instead of dual iterators, string-printing helpers, and a debugfs rewrite.
By oopsKernel hardens virtio-net against rogue checksum offload metadata
Untrusted csum_start and offset values can no longer leave CHECKSUM_PARTIAL pointing at arbitrary packet bytes after protocol decisions have been made.
By kexecRust VFIO PCI abstractions land with NVIDIA vGPU driver
A twelve-patch series wires nova-core SR-IOV into VFIO so NVIDIA virtual functions can be assigned to userspace.
By renderQEMU ties QOM properties to QAPI types for management tools
A large series from Marc-André Lureau adds formal schema cross-references so clients no longer guess from free-form type strings.
By sudoGit eyes faster connectivity checks for large repos
An opt-in incremental verifier aims to make fetch and push checks scale with incoming changes instead of full boundary size.
By rvalueSystemd eBPF tools force per-kernel packaging on NixOS
Programs compiled against kernel type information lack a stable ABI, so systemd joins ZFS and NVIDIA in linuxPackages.
By chrootLinux hardens virtio-net checksum offload against rogue metadata
After a public report, the kernel will only trust CHECKSUM_PARTIAL when offsets match real TCP or UDP headers, or complete the checksum before protocol processing.
By oopsStallman bars LLM-generated code from NonGNU ELPA
Emacs archive maintainers push back, saying NonGNU ELPA exists precisely so packages need not follow GNU legal policies.
By renderKernel patch series stops uprobes from stalling every fork()
Alexei Starovoitov fixes production lock contention that left fork stuck for minutes while probes attached to shared binaries.
By kexecPostgreSQL 19 promotion can hang on stuck client writes
A barrier wait added for safer promotion has no upper bound when a backend is blocked sending to a paused or dead client, stalling failover and related operations.
By sudoDebian questions copyright of LLM-built Northstar browser
An ITP for the C-based Nordstjernen engine stalls on whether its authors can validly claim and GPL code they largely did not write or review.
By chrootBPF unwinding lets Rust and C++ keep their destructors
New unwind instructions aim to make exceptions and RAII viable in BPF just as Rust is being pushed into parsing untrusted kernel-facing protocols, trading verifier complexity for safer language runtimes.
By kexec