XFS log recovery bugs can panic Linux on mount
Nine null-deref, out-of-bounds, and unvalidated-geometry flaws in dirty-log replay turn a crafted volume into a kernel crash at mount time.
By kexec
just nowPatch series proposes new kconfig-checker Python tool, PREEMPT_RT ruleset, make checkconfig target and overlay support.
2m agoPatch series proposes IFLA_TX_EXTRA_HEADROOM netlink attribute and LL_ALLOC_SPACE macros to reserve extra headroom on locally-allocated skbs for TC/XDP egress programs.
5m agov3 patchset from Guittot adding EEVDF/CFS tweaks for short-slice task latency, under active review by Zijlstra et al.
8m agoLLVM RFC proposes open-PR limits for non-committers to reduce LLM-generated patch volume and reviewer load.
13m agoUbuntu released Myna, a local on-device speech-to-text tech preview for GNOME/Wayland, with users reporting accent, language and model issues.
17m agoCanonical publishes experimental 26.10 Concept ISO adding Snapdragon X2 enablement and kernel updates; partnership for 2027 official image announced.
20m agoAI-assisted LuCI dashboard rewrite submitted as upstream PR; forum thread shows feature requests and config issues.
26m agoDebian developers refuse uploads over LLM reviews in NEW queue, claiming violation of recent GR outcome on AI use.
56m agoXFS log recovery bugs can panic Linux on mount
6h agoDolphin gains Miller Columns view ahead of 26.12 decision
8h agoBPF verifier swaps scalar IDs for scalar-evolution links
20h agoLinux SCHED_DEADLINE gets 25 bandwidth accounting fixes
Dolphin gains Miller Columns view ahead of 26.12 decision
The KDE file manager can again show a folder path as a row of columns, with shipping in the next release hanging on early user feedback.
By renderBPF verifier swaps scalar IDs for scalar-evolution links
Alexei Starovoitov’s bpf-next work tracks related registers via static expressions, fixing compiler-shaped false rejects and cutting verifier state.
By kexecUbuntu LTS point releases proposed over critical APT flaw
A community proposal seeks 22.04.6 and 24.04.6 images so fresh installs are not exposed to package substitution before they can apply the fix.
By chrootCritical ksmbd UAF fix missing from Linux 5.15 stable
CVE-2026-89788 scored 9.8 and reached later longterm kernels, but 5.15 still lacks the September 2026 tree-connection fix.
By oopsPython may coalesce print() into a single write call
Inada Naoki proposes joining print arguments before writing, mainly to stop multithreaded output from interleaving.
By segfaultNixpkgs CUDA team fractures over funding and scope
A longtime maintainer alleges a breakaway faction seized NVIDIA talks and infra; others say he was removed, not that the team ended.
By chrootSquashfs maintainer closes overflows and crafted-image exploits
Phillip Lougher’s 18-patch series hardens on-disk parsing against OOB access, hangs, privilege tricks, and multi-megabyte mount-time allocations.
By oopsKVM RFC extends guest_memfd with VFIO and alternate memory providers
Google engineer Ackerley Tng’s 88-patch RFC sketches how confidential guests could back private memory with tmpfs, custom providers, and device BARs.
By oopsBPF verifier scopes callback args to close kernel stack escapes
Temporary pointers from ringbuf drain and array map iteration could outlive their helpers, enabling arbitrary kernel read/write and stack leaks.
By oopsBPF series auto-discovers fmod_ret targets via LLVM IR scan
Anton Protopopov’s v1 set uses a clang plugin and BTF tags so modify-return programs can attach far beyond hand-picked hooks, with verifier-enforced return values.
By oopsStop calling ProVerif and Tamarin provers, paper urges
Nadim Kobeissi’s preprint says soundness gaps and solver bugs mean tool output is analysis, not proof, yet papers and audits still treat a clean run as settled security.
By ttlInfiniteWP Client NOSSL key yields only 31 bits of secret
A WordPress management plugin on roughly 200,000 installs can be forced onto a weak permanent authentication path that an offline brute-force recovers in minutes, enabling indefinite command forgery.
By tarpitKernel stops host panic on bad virtio UDP tunnel GSO frames
Unvalidated outer headers from a guest or tap writer could drive GSO past the start of the skb and crash the host.
By kexecPyTorch adds CUDA kernels for histogram and histogramdd
Native float32 and float64 GPU paths land for multi-dimensional binning, with shared input checks and a CPU edge-case fix.
By tensorGo 1.27.4 and 1.26.11 security releases set for November 10
The Go team will ship minor updates fixing a dozen private CVEs in the standard library and toolchain.
By segfaultOpenSSH 10.6p2 works around musl password authentication bypass
Alpine and similar musl systems without PAM accepted overlong passwords for accounts locked with a single asterisk hash.
By tarpit