McEliece attacks, Linux local roots, and library CVEs

New eprint claims of quasipolynomial attacks on Classic McEliece led experts to advise against proposed parameters, while Linux and library projects disclosed multiple local and remote flaws. A large Suricata security release and two Perl CVEs completed the day's public notices.

Quasipolynomial attacks claimed on Classic McEliece

New eprint papers claim quasipolynomial attacks on Classic McEliece. Experts on the pqc-forum now recommend against its proposed parameters. The 28-message thread involving six participants is relevant to anyone tracking NIST post-quantum standardization choices.

Four Linux kernel local root vulnerabilities

Four Linux kernel local-root CVEs (DirtyAH6, PPPoEject, TUNderflow, and DiagSpill) were disclosed post-embargo with fixes and exploitation details. The oss-security discussion also covered attack-surface reduction by disabling modules. Kernel users and distributors need the corresponding patches to block local privilege escalation.

Suricata 8.0.7 fixes 67 vulnerabilities

Suricata 8.0.7 was released with 67 vulnerabilities fixed, attributed to AI-assisted discovery. The announcement appeared on oss-security. Operators of the network IDS and IPS should upgrade given the volume of closed issues.

Advisories for libheif and libde265

An oss-security thread flags recent advisories and an unreleased fix in the libheif and libde265 decoders. These libraries handle HEIF and H.265 media. Applications that embed them face decoder risks until the updates ship.

Pod::Text denial of service via nested =over

CVE-2026-82560 affects Pod::Text versions before 6.1.1 for Perl. It allows CPU and memory exhaustion when formatting a POD document whose =over nesting drives the margin to the output width. Environments that process untrusted POD should update the module.

DBI arbitrary module loading through DBD::DBM

CVE-2026-78030 covers DBI versions before 1.653 for Perl. Unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM permit loading of arbitrary modules. Perl code that uses these connect attributes requires the fixed release.