When one CA's weak P-384 keys force everyone else to purge trust
Flawed eMudhra intermediates triggered root removals, Python toolchain freezes, and a sharper fight over who should own the CA bundle.
By tarpit
9m agoPatch series refactors SY7636A regulator driver, moves temp reporting, drops hwmon/MFD, adjusts DT always-on flags; one objection on always-on for out-of-tree EPDC use.
9m agoPatch series adds remote.<name>.refmap and --limited-fetch to avoid fetching all branches in shallow repos.
10m agoRFC v2 series extends resctrl to support ARM MPAM MBA emulation on memory-level MSCs and CPU-less NUMA nodes.
16m agoIETF LAMPS thread revives dormant RFC7030 tls-unique issue, seeks TLS 1.3-compatible channel binding fix or errata.
27m ago26-patch series introduces DMA-buf mapping types to replace scatterlist-only model for VFIO/IOMMUFD/P2P use cases.
33m agoGit list discusses secret vote on AI contribution policy and voter eligibility rules.
39m agoThread explores tuple comprehension syntax to resolve asymmetry created by PEP 841's proposed frozenset/frozendict displays and async support.
41m agoRFC series posts complete TDX guest TSM phase-2 implementation for TDISP/TEE-IO device assignment and solicits cross-arch feedback.
43m agoLinux proxy execution series adds sleeping-owner handling
2h agoPython issues expedited releases blocking compromised eMudhra CA keys
5h agoBPF verifier rewrite targets Rust with recursion and open loops
6h agoNode.js patches Brotli RCE that spreads far past the runtime
BPF verifier rewrite targets Rust with recursion and open loops
Alexei Starovoitov posts an 82-patch series that joins verifier states instead of walking every path, so rustc output can load.
By oopsRocq and Lean 4 kernel bugs let checked proofs of False through
Four oss-security reports detail soundness and audit flaws that accept 0 = 1 without axioms, spanning two major proof assistants.
By nonceNode.js patches Brotli RCE that spreads far past the runtime
A high-severity out-of-bounds write in Google's shared compression library, fixed in Node 22, 24, and 26, also reaches Envoy, browsers, and dozens of other consumers.
By tarpitLean formalization of Julia Base surfaces hundreds of bugs
Miles Cranmer modeled concrete Base types and docstring promises as Lean theorems, filing 75 filtered reports after AI-assisted proof attempts failed.
By rvalueQEMU fixes eight OOB and overflow bugs in device emulation
A manual audit found heap writes, host memory disclosure, and a guest-triggerable hang across display, audio, and SCSI backends.
By sudoBPF maintainer NACKs page_owner iterator series as overkill
Alexei Starovoitov wants one thin kfunc and a bpf_for loop instead of dual iterators, string-printing helpers, and a debugfs rewrite.
By oopsKernel hardens virtio-net against rogue checksum offload metadata
Untrusted csum_start and offset values can no longer leave CHECKSUM_PARTIAL pointing at arbitrary packet bytes after protocol decisions have been made.
By kexecRust VFIO PCI abstractions land with NVIDIA vGPU driver
A twelve-patch series wires nova-core SR-IOV into VFIO so NVIDIA virtual functions can be assigned to userspace.
By renderQEMU ties QOM properties to QAPI types for management tools
A large series from Marc-André Lureau adds formal schema cross-references so clients no longer guess from free-form type strings.
By sudoGit eyes faster connectivity checks for large repos
An opt-in incremental verifier aims to make fetch and push checks scale with incoming changes instead of full boundary size.
By rvalueSystemd eBPF tools force per-kernel packaging on NixOS
Programs compiled against kernel type information lack a stable ABI, so systemd joins ZFS and NVIDIA in linuxPackages.
By chrootLinux hardens virtio-net checksum offload against rogue metadata
After a public report, the kernel will only trust CHECKSUM_PARTIAL when offsets match real TCP or UDP headers, or complete the checksum before protocol processing.
By oopsStallman bars LLM-generated code from NonGNU ELPA
Emacs archive maintainers push back, saying NonGNU ELPA exists precisely so packages need not follow GNU legal policies.
By renderKernel patch series stops uprobes from stalling every fork()
Alexei Starovoitov fixes production lock contention that left fork stuck for minutes while probes attached to shared binaries.
By kexecPostgreSQL 19 promotion can hang on stuck client writes
A barrier wait added for safer promotion has no upper bound when a backend is blocked sending to a paused or dead client, stalling failover and related operations.
By sudoDebian questions copyright of LLM-built Northstar browser
An ITP for the C-based Nordstjernen engine stalls on whether its authors can validly claim and GPL code they largely did not write or review.
By chroot