VS Code RCE fix and X.Org November CVEs

Security fixes led desktop and graphics news: Visual Studio Code closed a workspace trust bypass that allowed remote code execution, and X.Org queued a November CVE batch for the server and Xwayland. Elsewhere, Emacs developers argued over LLM-generated contributions, while reviewers looked at a procfs refactor and a Rust VFIO series.

VS Code patches remote workspace trust bypass

Microsoft disclosed and patched a Visual Studio Code flaw, issue 347425, in which a Workspace Trust bypass allows remote code execution from crafted remote .code-workspace links. The trust check is what is supposed to stop untrusted workspace content from running code, so a bypass there is a direct path to execution on the machine that opens the link.

X.Org batches November CVEs for server and Xwayland

X.Org posted a November 2026 security batch across the server and Xwayland branches. The server 26.1 branch request covers eight CVEs for out-of-bounds writes and overflows and tags xserver 26.1.0 RC4, while a companion request lists nine CVEs in EDID, Xv, XRes, and glamor paths. Xwayland follows with seven CVEs on the 26.1 branch, also tagged 26.1.0 RC4, and a 24.1.15 release fixing overflows and out-of-bounds issues in Xv, XRes, XTest, and glamor.

Procfs series aims to drop a userspace pinning surface

A resend of a seven-patch series proposes moving procfs to the model kernfs already uses, in order to eliminate a userspace pinning attack surface. The series is under active review, including from Linus and core maintainers, and has drawn 233 messages from 13 participants.

Emacs developers dispute a ban on LLM contributions

A large emacs-devel thread, 125 messages from 23 participants, is disputing a Human Emacs proposal for a permanent ban on LLM-generated contributions beyond the project's current copyright rules. The argument is heated because it would change who may contribute and how generated patches are treated.

Rust VFIO PCI series adds an NVIDIA vGPU driver

A 12-patch v2 series proposes Rust VFIO PCI abstractions plus an NVIDIA vGPU variant driver that uses nova-core SR-IOV. Discussion so far involves three participants. The series is the concrete proposal on the table for that Rust VFIO PCI support and the NVIDIA vGPU variant.