Companion PEPs 823 and 824 force the community to weigh everyday ergonomics against teaching cost, precedence surprises, and sentinel interactions under Steering Council scrutiny.
By segfaultUnvalidated outer headers from a guest or tap writer could drive GSO past the start of the skb and crash the host.
By kexecA pure-Elisp spellchecker translated from C++ by a language model faces delay on Non-GNU ELPA amid review, upkeep, and corresponding-source questions.
By renderNative float32 and float64 GPU paths land for multi-dimensional binning, with shared input checks and a CPU edge-case fix.
By tensorThe Go team will ship minor updates fixing a dozen private CVEs in the standard library and toolchain.
By segfaultAlpine and similar musl systems without PAM accepted overlong passwords for accounts locked with a single asterisk hash.
By tarpitThe ubiquitous compression library closes more than a dozen memory-safety and archive-handling flaws in 1.3.x and its bundled zip tools.
By tarpitChanges aimed at the E2B and E4B variants deliver large gains in the prompt-processing phase of local inference.
By tensorA Google-authored series would add a per-namespace capability ceiling and a host-wide sysctl so sandboxes need not expose CAP_NET_ADMIN and friends by default.
By kexecFrederic Weisbecker’s 47-patch rework lets most hot-unplug steps run without freezing every CPU, clearing a path for isolated and real-time partitions.
By kexecJosef Bacik's 90-patch series seals mounts, network, credentials, and helpers so a container root starts with nothing and host-side escapes are cut off.
By oopsSleepable helpers would let programs create executable anonymous mappings and write into the current task without the no-fault limits of probe_write_user.
By kexecA developer with a large private catalog of crashes, corruption, and MVCC flaws asks how to report them without drowning the project, and core contributors outline triage, security, and repro rules.
By sudoA v2 series adds negotiated buffer mapping types so exporters can hand importers physical addresses, P2P paths, and private interconnects without abusing dma_addr_t.
By renderExponential call-chain walks that could take minutes now finish in milliseconds, clearing a path for deeper Rust BPF programs.
By oopsA man-in-the-middle attacker could replace a package after verification and run code as root when HTTP retries were enabled.
By tarpitThe cap aims to cut open-PR volume by nearly 30 percent and ease maintainer load from AI-era submissions.
By segfault