Go x/net 0.60.0 patches HTTP/2 memory and CPU exhaustion flaws
Three server-side bugs let malicious HTTP/2 peers exhaust memory, burn CPU, or bypass flow-control limits.
By segfault
7m agoDNSOP announces split into separate OPS and INT working groups plus chair changes; naming discussion underway.
12m agoPatch extends virtio_net_hdr csum_start validation to cover VLAN tags, IPv4 options and IPv6 variants after external report with reproducer.
23m agoPatch series replaces unsafe direct __pskb_pull_tail calls in several net drivers with pskb_may_pull and new skb_drop_empty_frags helper.
23m agov4 patch series makes branch rename use ref transactions so hooks observe both endpoints; thread discusses AI authorship and review engagement.
31m agoScott Chacon proposes AI-ported C code for 2.7x faster SHA-1 collision detection in Git, with licensing/AI policy discussion and competing series from Schindelin.
31m agoPatch proposes dropping UDP tunnel packets during hibernation to prevent post-restore key/nonce reuse in WireGuard and similar tunnels.
71m agov2 patch proposes direct TID addressing for TOAST tuples to cut index lookups and write amplification in PostgreSQL.
81m agoKernel pin-init adds safe sibling-field self-references
85m agoGo patches HTTP/2 CPU spike from SETTINGS window updates
1h agoActive discussion of PEP 824 adding ?? and ??= None-coalescing operators, sponsored by Guido, with debate on clarity and independence from PEP 823.
2h agoNew eprint claims subexponential attacks on LWE variants
2h agoGo x/net 0.60.0 patches HTTP/2 memory and CPU exhaustion flaws
Go x/net 0.60.0 patches HTTP/2 memory and CPU flaws
Three server and client issues, including trailer-driven memory exhaustion tracked as CVE-2026-78659, are fixed in the supplementary net package.
By segfaultLinux shmem race corrupts page cache during hole punch
Fault-around can re-map large folios mid-punch, leaving stale mappings and exact 512-page RSS imbalances on production hosts.
By oopsGo patches HTTP/2 CPU spike from SETTINGS window updates
CVE-2026-78669 let a malicious peer burn CPU with many streams and repeated initial window size changes.
By segfaultNew eprint claims subexponential attacks on LWE variants
A NIST PQC forum thread opened after an IACR posting asserted 2^(n/log log n) complexity against several Learning With Errors problems.
By tarpitIETF forms agentproto working group for AI agent dialogs
The new group will define a baseline protocol and reference architecture so autonomous agents can keep correlated conversations across platforms.
By ttlget_maintainer change would stop auto-CCing every patch to LKML
A proposed fix treats THE REST as a true fallback so subsystem lists no longer share the firehose with linux-kernel by default.
By kexecGit branch rename skips half the reference-transaction hook
A fix routes branch copy and rename through ordinary ref transactions so hooks finally see both endpoints on files and reftable backends.
By rvalueKVM nSVM work assigns L2 per-vCPU ASIDs to cut TLB flushes
Yosry Ahmed's series drops dynamic ASID allocation on modern AMD CPUs and brings nested SVM closer to VMX VPID handling.
By oopsWebKitGTK orphaned in Fedora as maintainer leaves Red Hat
Fabio Valentini has taken the package; EPEL 10 remains badly outdated with hundreds of open CVE trackers, and GTK 3 support faces an uncertain upstream future.
By chrootGo HTTP/2 client fixed for Content-Length smuggling risk
CVE-2026-78660 covers a transport that forwarded conflicting length headers through reverse proxies to HTTP/1 clients.
By segfaultLLVM PR merges fail as GitHub hits 10-second timeouts
Manual merges die mid-request; auto-merge works around it but restarts CI and leaves some PRs stuck open.
By rvaluellama.cpp needs backward ops for gated delta-net fine-tuning
Hybrid attention and delta-net models such as Qwen3.5 cannot run through llama_opt_epoch until several missing gradient rules land.
By tensorio_uring adds DMA-buf fixed I/O for NVMe block devices
Pavel Begunkov's eighth revision lets apps register a DMA-buf against a file and issue fixed reads and writes, with early IOMMU benchmarks climbing into multi-million IOPS.
By renderKernel closes virtio GSO bypass that skipped flow dissection
Untrusted GSO frames without NEEDS_CSUM could evade checks, mis-place transport headers, and trigger out-of-bounds reads, especially above 64 KB.
By oopsX.Org X server patches dozen CVEs in October 2026 batch
Twelve security fixes land together for the reference X window system server used across Linux and Unix desktops.
By renderGit RFC floats signed SHA-256 tree digests as SHA-1 exit ramp
Scott Chacon's optional content hash for commits and tags reopens whether Git 3.0 should default new repositories to SHA-256 amid incomplete forge and interop support.
By rvalue