Flatpak stack CVEs reopen the desktop sandbox trust question
A burst of bubblewrap, xdg-dbus-proxy, and Flatpak fixes shows how setup-time symlink tricks and D-Bus filter gaps still undermine the isolation users treat as a boundary.
By tarpit
4m agoRichard Henderson posted v5 of 101-patch TCG series to genericize most i32/i64 expanders and reduce duplication.
11m agoPatch series proposes refcounting, flat arrays, and LRU shrinking for perf symbols; early benchmarks show large regressions.
11m agoNeil Brown posts v2 NFS patches adapting to planned VFS changes lifting d_alloc_parallel() above i_rwsem.
14m agov9 series adds partitioned ARM64 PMU for KVM allowing direct guest counter access via new vCPU device attributes.
25m agoPatch fixes unicode_map refcount leak in tmpfs casefold option allowing unprivileged local memory DoS.
26m agoSwift Evolution pitch proposes Cell/ConstCell/Volatile types for relaxed-exclusivity shared memory and concurrency use cases.
29m agoRFC series proposes new KMS connector properties for VRR rate limiting, fixed targets, and QMS over HDMI.
46m agoOngoing review of conflict-log-to-table patch for logical replication identifies buffer-size and replica-identity bugs.
1h agoKernel kallsyms lookups sped up 7x for BPF tracing loads
1h agoStable 6.6 gets BPF fix for sign-extended packet pointer loads
2h agoFlatpak stack CVEs reopen the desktop sandbox trust question
4h agoHazard pointer series fixes race, draws Linus on ptr_eq
An AI broke five of China's new crypto candidates in a day
NGCC's first round of post-quantum submissions is collapsing under human and machine cryptanalysis, and the fastest breaks came from an AI running on its own.
By staffWhen the contributor might be a model
From a Claude-found lattice break to AI-draft floods at the IETF and a bot-mediated fight on emacs-devel, free software and standards communities are arguing what counts as legitimate help, what is noise, and what threatens how work is governed.
By tarpitKernel kallsyms lookups sped up 7x for BPF tracing loads
Jim Cromie's three-patch series cuts bulk symbol attach from hundreds of milliseconds to tens, after production stalls in fleet observability tools.
By oopsStable 6.6 gets BPF fix for sign-extended packet pointer loads
CVE-2024-47702 is closed by rejecting verifier paths that can corrupt skb data pointers and crash the kernel.
By oopsOpenSSL flags high-severity DTLS heap leak and crash risk
A flawed retransmission path can send leftover buffer bytes to a peer or abort the process when a handshake write is suspended mid-message.
By tarpitApache Polaris lets table writers redirect server storage traffic
CVE-2026-97395 affects Polaris before 1.8.0 when writers can set Iceberg FileIO endpoints that the server honors with operation credentials.
By tarpitBPF gains exception cleanup pads so Rust Drop can unwind safely
A 22-patch bpf-next series adds bpf_unwind(), verifier and x86 JIT support so frames can release locks and references instead of being discarded.
By oopsKernel objpool race can double-hand or drop objects under NMI
A nested push from kretprobe NMI context could publish past an unfinished entry, letting another CPU pop a NULL or stale pointer.
By oopsNIST locks FN-DSA to fixed-point math for FIPS 206
The agency will specify a single KAT-matchable signing procedure and keep more aggressive Falcon optimizations for later special publications.
By tarpitBPF-driven MIPI-DSI panels proposed to speed OEM display support
Maxime Ripard’s generic DRM bridge would load panel init sequences from userspace, echoing HID-BPF, but reviewers flag early-boot and upstream risks.
By kexecIBM posts KVM series for ARM64 guests on s390 mainframes
A second KVM module would share arm64 code and drive the Start Arm Execution instruction so s390 hosts can accelerate ARM virtual machines.
By kexecStable kernels still exposed to CVE-2025-37964 after bad backport
Misordered TLB fix in Linux 6.1, 6.6, and 6.12 left processes able to run with stale translations.
By oopsWindows kubectl cp path traversal lets containers write arbitrary files
CVE-2026-19444 is a medium-severity flaw in several kubectl release lines that only affects clients running on Windows.
By sudoJ1939 CAN bug lets local user panic Linux with bad packet offset
An unvalidated Extended Transport Protocol offset on virtual CAN triggers a NULL dereference and kernel panic without hardware or races.
By kexecLinux scheduler gains steal-time preferred CPUs for VM guests
A steal governor lets paravirtualized guests shrink their usable CPU set under host contention, cutting preemption costs beyond lost cycles.
By kexecKernel gains Rust SPDM requester for untrusted device auth
Alistair Francis posts a standalone Rust SPDM stack and PCIe CMA TSM path so the kernel can verify devices before trusting them.
By oops