HAWK exits and McEliece parameters buckle under fresh attacks
An AI-assisted lattice reduction forces HAWK out of the NIST signature round while quasipolynomial results leave Classic McEliece's proposed sizes without defenders.
By tarpit
8m agov11 74-patch series adds HDMI 2.0 (4K@60) to DW HDMI QP on RK3576/RK3588 plus DRM core HDMI connector API changes.
18m ago27-patch series adds HW-assisted para-virtualization and time-slicing to panthor for Mali v15 GPUs.
19m agoDraft intersection types work prompts debate on Never semantics, subtyping, and LSP for always-raising methods.
21m agoIETF last-call debate over requiring or permitting cleartext SMTP in emailcore AS draft for backward compatibility.
26m agoLarge 88-patch series migrates qemu-iotests off HMP to QMP so tests run with --disable-hmp.
28m agoGreg KH posts v4 to add TAINT_FORCED_BIND taint when sysfs bind/unbind is used, to flag non-standard driver attachments amid syzbot noise.
29m agoGNOME contributors discuss Debian's neutral LLM policy outcome and debate restrictions or bans for their own project.
30m agoOngoing PEP 832 discussion on .python-envs vs reviving .venv redirect files, with uv/Hatch expressing limited support.
4h agosched_ext and proxy execution set to share one Linux kernel
4h agoGlibc ld.so overflow hits setuid programs via $ORIGIN paths
4h agoCritical Expat UTF-16 fix, Octavia RCE, and glibc loader flaws posted same week
5h agoPEP 823 proposes None-aware ?. and ?[] operators for Python
From blanket bans to AGENTS.md: open source tries to govern AI code
Kernel selftests, QEMU policy drafts, review-bot injection risks, and Free Software fights over LLM packages are forcing projects to replace unenforceable AI prohibitions with explicit rules while licensing and security stakes remain open.
By kexecPEP 823 proposes None-aware ?. and ?[] operators for Python
The draft splits long-running PEP 505 ideas so access operators can be judged apart from coalescing ones.
By segfaultsched_ext and proxy execution set to share one Linux kernel
Andrea Righi’s v14 series drops the build-time ban so distributions can ship both features and let BPF schedulers opt in at runtime.
By oopsCritical Expat UTF-16 fix, Octavia RCE, and glibc loader flaws posted same week
oss-security carried a high-severity libexpat release, an OpenStack Amphora root RCE path, and two glibc dynamic-loader issues affecting AT_SECURE programs.
By tarpitKernel fixes UAF in OVS and act_ct conntrack helpers
Unconfirmed entries could leave stale expectation pointers after extension realloc, reported against Open vSwitch and TC conntrack.
By oopsglibc ld.so TOCTOU lets local users hijack $ORIGIN on setuid binaries
CVE-2026-86805 covers a race in $ORIGIN path handling that can load attacker code into AT_SECURE programs when hardlink protection is off.
By segfaultBPF verifier patch scopes callback args after kernel memory leaks
A proposed frame-owned reference type would stop helpers from handing programs pointers that outlive the call, after reports of stack exposure via ringbuf drain and array map iteration.
By oopsBPF gains indirect subprogram calls via new callx instruction
Alexei Starovoitov’s series lets the verifier and JITs accept LLVM’s function-pointer calls, unlocking vtables and dispatch tables in BPF C and Rust.
By oopsPyTorch Dynamo silently drops closure mutations in local class methods
Compiled functions under fullgraph mode lost in-place list and dict updates performed by methods on classes defined inside the region.
By tensorClaude-written mlx5 driver proposed for Linux VFIO selftests
Jason Gunthorpe says an AI produced a ConnectX selftest driver in days that once took months of human work.
By oopsBPF exception cleanups unlock Rust Drop on bpf_throw() unwind
The kernel and libbpf now run compiler-emitted landing pads when bpf_throw() walks the stack, so frames can release RCU locks and other owned resources.
By oopsPyTorch CPU fold path eyed for parallel col2im speedups
A proposed change would process output channels concurrently and cut redundant writes on common Fold shapes.
By tensorKernel series fixes coredump UAF, truncated dumps, and hangs
Christian Brauner’s multi-patch stable-bound work closes races among coredumps, signals, freezers, and io_uring workers.
By kexecQEMU RFC brings named Arm64 CPU models to KVM for live migration
Nutanix engineer Khushit Shah’s fourth RFC would end Arm’s host-only CPU mode and give management stacks the same model queries x86 already has.
By sudoQEMU eyes end to blanket ban on AI-generated contributions
Paolo Bonzini’s RFC would swap prohibition for disclosure tags, human-only review text, and agent rules meant to spare maintainer time.
By sudoIOMMU live-update patches aim to keep VM DMA mappings across kexec
Google's v5 series preserves Intel VT-d and iommufd domain state so assigned devices can survive a kernel live update without dropping translations.
By oops