Security and cryptography digest for 2026-08-22

Post-quantum cryptography threads led the day, with analysis of a claimed quasipolynomial attack on Classic McEliece and debate over fixed-point FN-DSA. Local privilege and command-execution issues also appeared in Emacs TRAMP, Linux kernel OVS, and a niche Perl module.

Claimed quasipolynomial attack on Classic McEliece

A paper discussed on the pqc-forum claims a quasipolynomial distinguisher and decryption method against Classic McEliece. Team analysis concludes the attack remains slower than standard methods. Readers following NIST PQC candidates should treat the practical impact as limited for now.

Emacs TRAMP zero-click local command execution

An oss-security report describes local shell command injection in Emacs via TRAMP. Unsanitized user fields in remote file names enable the issue, and a fix is attached. Users who open remote paths in Emacs should apply the patch.

OVSwrap Linux kernel local root (CVE-2026-64531)

Post-embargo disclosure on oss-security covers a local-root vulnerability in the Linux kernel OVS path, assigned CVE-2026-64531. Follow-up notes delay in the Ubuntu advisory. Administrators running Open vSwitch should track and apply available updates.

Fixed-point FN-DSA standardization debate

An extended pqc-forum thread argues for steering FN-DSA standardization toward fixed-point arithmetic only. Participants cite floating-point side-channel risks and differing needs between TLS and embedded deployments. Implementers should watch the outcome when choosing arithmetic approaches.

Perl Tie::Hash::Regex uncaught exception (CVE-2026-77781)

A routine oss-security notice assigns CVE-2026-77781 to Tie::Hash::Regex versions before 2.0.0, which throw on unparseable lookup keys. The flaw is confined to this niche module. Perl users of the package can move to 2.0.0 for the fix.