PEPs 843, 844, and 805 push the free-threaded redesign into re-export syntax, public/private builtins, and runtime object-state checks, with Guido in the threads and ecosystem compatibility still unsettled.
By rvalueThe mail transfer agent closes four flaws dating to 2014, with no workaround short of upgrading.
By nonceHAWK’s withdrawal after an AI-assisted lattice break and fresh holdout claims against Classic McEliece force a hard look at security margins while NIST timelines keep moving.
By nonceNhat Pham's v5 series lets zswap and zero pages claim swap entries without pre-allocating physical slots, and retunes memcg swap charging to match.
By kexecWill Deacon's cleanup series removes dead CONFIG_CPU_BIG_ENDIAN code after the option was marked BROKEN.
By oopsIan Rogers moves filtering into BPF maps so a single session can no longer drop raw_syscalls events system-wide, and the exclusive test tags that hid the problem can go.
By kexecFilters meant to calm socket placement were stranding hot pages on CXL, and Meta patches separate the two jobs.
By kexecA broad patch set enables boolean control over retained logits and exposes last hidden states for the model family.
By tensorDirtyAH6, TUNderflow, PPPoEject, and DiagSpill turn unprivileged access into root on systems with common networking features; fixes are in stable trees.
By nonceResearchers describe an unreported format-string bug in certificate import with debugging on, and urge tracking for an already-shipped RSASSA-PSS overflow.
By nonceCoordinate-descent autotune can pick an R0_BLOCK smaller than workspace allocation assumes, overrunning the buffer under torch.compile.
By tensorOverloaded THP availability checks no longer wipe out multi-size transparent huge pages on CPUs without PMD leaves.
By oopsA 15-patch net-next series enables NIC acceleration for TLS 1.3, including KeyUpdate, starting with Mellanox ConnectX-6 Dx and newer.
By oopsA bpf-next series reuses the existing bpf_link cgroup model so groups of BPF programs can share attach, ordering, and query semantics, with TCP sock ops as the first consumer.
By kexecCVE-2026-8674 can crash name-resolving processes when a search list entry is roughly 200 characters or longer, including via DHCP or VPN-supplied resolv.conf data.
By segfaultLorenzo Stoakes’s v3 patches claim up to 36% faster full allmodconfig builds, roughly 70% faster incrementals, and about 90% faster no-op rebuilds.
By oopsRFC would trade strict PI handoff for lock stealing and proxy execution; maintainers call it premature and flag lockup risks.
By kexec