Kernel LPEs, X.Org library fixes, Perl CSV CVEs

Public disclosures dominated the day, led by six Linux kernel core flaws enabling local privilege escalation and container escape, alongside coordinated X.Org client library patches and eight CVEs in a widely used Perl CSV module. A new isogeny-based post-quantum NIKE also drew technical discussion on the PQC forum.

Infinity Core: six Linux kernel LPEs and container escapes

A public disclosure on oss-security detailed six previously embargoed use-after-free and bounds-checking issues in core Linux kernel subsystems. The flaws enable local privilege escalation and container escape. Kernel maintainers and security teams should treat the report as high priority for patching and backport assessment.

X.Org security fixes across five client libraries

X.Org published a coordinated security advisory covering multiple CVEs in five X client libraries. The issues were fixed in a batch release intended for immediate uptake by distributors. Desktop and embedded stacks that ship X libraries need to verify package updates against the advisory.

Eight CVEs in Text::CSV_XS before 1.65

A single oss-security post disclosed eight CVEs affecting Text::CSV_XS versions earlier than 1.65. The bugs include use-after-free, information leaks, quadratic behavior, and parsing edge cases. Perl applications that parse untrusted CSV should upgrade promptly.

MIKE: isogeny-based post-quantum NIKE proposed

Researchers announced MIKE (Module Isogeny Key Exchange), a fast and compact post-quantum non-interactive key exchange built on isogenies, with C and Rust implementations and multiple parameter sets. Discussion on the NIST PQC forum examined performance and security claims. The work adds another concrete candidate in the isogeny-based NIKE space for implementers tracking post-quantum options.

Fake-recruiter trojan domain placed on clientHold

A follow-up on oss-security reported that the taikotalent.xyz fake-recruiter trojan domain was resolved via registrar clientHold on 2026-10-10. Solar Designer observed that the original report appeared AI-generated and lacked inline indicators of compromise. The thread closes the incident with confirmation of takedown rather than new technical detail.

oss-security list structure debate continues

Solar Designer replied to a proposal for a separate oss-security-vulnerability-reports list aimed at an anticipated AI-driven volume spike. He noted that overall volume remains stable while churn is rising, and suggested grouping related reports instead of splitting the list. The exchange keeps process questions open without immediate list changes.