Desktop and graphics: GLib CVE, DRM cleanups, Rust VFIO

GLib closed a Windows command-line parsing hole, kernel DRM lists carried large atomic and Rust driver series, and desktop projects debated materials, editor policy, and image viewers.

GLib fixes GWin32AppInfo command-line CVE

A GNOME GLib merge request expands field codes within each argument in GWin32AppInfo, addressing CVE-2026-102038. The change replaces flawed shell-quoting and backslash rewriting with proper Windows command-line parsing. Developers shipping GLib-based applications on Windows should treat the update as a security fix.

Kernel series requires explicit kobj_type release

A nine-patch series on dri-devel adds a __must_init attribute and requires kobj_type::release on all initializers. The work targets latent use-after-free bugs across several subsystems. Reviewers are treating it as a hardening step for object lifetime rules in the kernel.

Rust VFIO PCI and NVIDIA vGPU driver reach v2

A twelve-patch v2 series on dri-devel adds Rust VFIO PCI abstractions and an NVIDIA vGPU variant driver using nova-core SR-IOV. Discussion remains focused among a small set of participants. Authors of GPU virtualization and Rust drivers will care once the abstractions stabilize.

Blender ships OpenPBR nodes for feedback

The Blender team has shipped an OpenPBR shader node build for Cycles and EEVEE and is soliciting feedback on SSS radius and thin-film units. Devtalk discussion covers unit choices and material behavior. Lookdev and renderer developers tracking open material standards now have a concrete build to test.

Emacs list debates LLM code policy and fork talk

On emacs-devel, users threaten a fork over LLM-related code policy, arguing community harm beyond copyright. A maintainer questions the unspecified harms. The heated exchange matters for anyone who depends on Emacs governance and contribution norms.

DRM panels gain optional atomic state access

A 35-patch series lets DRM panels use atomic state by routing through an embedded drm_bridge, remaining opt-in for drivers. The work is under review on dri-devel. Panel and display pipeline maintainers gain a path to fuller atomic integration without forced driver churn.

Connectors convert to atomic_create_state across drivers

A 59-patch v2 series converts connector reset hooks to atomic_create_state across DRM drivers and removes the reset hook. Discussion on dri-devel is extensive. The cleanup reduces dual-path state handling for connector drivers.

KDE weighs Photos as Gwenview replacement

KDE discuss threads propose replacing the long-standing Gwenview image viewer with a new Photos or Koko app. Participants offer feature and naming feedback. Desktop users and packagers should watch whether the project consolidates on a single viewer.