Nixpkgs core team exits as packaging megaprojects hit the burnout wall
A ten-month experiment in consensus leadership ends in attrition, while store rewrites and other distro policy fights expose the same unpaid-authority gap.
By chroot
2m agoNew individual draft proposes nine HQC-KEM named groups for TLS 1.3; early replies criticize excessive hybrids and combinatorial growth.
9m agoBrauner posts 8-patch series fixing UAFs in RCU pathwalks for ext4, afs, v9fs, tracefs, ntfs3 and generic casefold by ensuring RCU grace periods before freeing superblock data.
14m agoGnus UTF-8 email patches rejected over LLM-derived code; parallel implementation underway.
15m agoOngoing refinement of PEP 832 on .venv redirect files, focusing on symlink/relative path semantics.
31m agoLong-running Qualcommax NSS build thread sees new PR adding EEE support for 2.5G/10G ports after reports of link and traffic failures.
40m agov4 patch series makes branch rename use ref transactions so hooks observe both endpoints; thread discusses AI authorship and review engagement.
41m agoLLVM RFC proposes banning AI-generated PR descriptions and RFC text to curb low-quality submissions draining reviewer time.
49m agoActive OpenWrt porting thread for IPQ9574 device reports working regulators, Wi-Fi MLO, TFTP boot method, and submitted PR fixing kernel load address alignment.
61m agoCyrus SASL left with unfixed flaws and no active maintainers
65m agoKernel fix blocks UAF in lazyfree huge-page reclaim race
3h agoLinux netdev adds fwnode PCS provider API for external serdes
5h agoNixpkgs core team exits as packaging megaprojects hit the burnout wall
Linux netdev adds fwnode PCS provider API for external serdes
Christian Marangi’s series gives phylink a producer-consumer model for Physical Coding Sublayer devices and lands first support on Airoha AN7581.
By kexecCyrus SASL left with unfixed flaws and no active maintainers
Oracle engineer flags multiple open security issues after years without a release.
By tarpitLinux watch queue race lets unprivileged users panic the kernel
A fix makes sizing of key-notification pipes atomic so concurrent posters cannot hit a null buffer and crash the system.
By kexecSPARC64 gains Linux seccomp filter support
The architecture was one of the last without the BPF sandboxing Docker, systemd, and Flatpak rely on.
By kexecOpenStack Mistral flaws allow cross-project writes and host RCE
Four CVEs in the workflow service let authenticated users rewrite other projects' resources, extend private workflow shares, and run code on executor hosts.
By nonceBPF adds unwind landing pads for resource cleanup
Kernel support for compiler-emitted cleanup tables would let bpf_unwind() run Drop-style release instead of discarding frames.
By oopsPyTorch CUDA pool teardown can re-enter half-destroyed state
Review of pending allocator work also flags null returns that can produce CUDA tensors backed by address zero.
By tensorKernel pin-init adds safe sibling-field self-references
Gary Guo’s series lets pinned Rust structs borrow between fields without allocation, landing advanced variance tools under a tight-use agreement.
By kexecGo patches HTTP/2 CPU spike from SETTINGS window updates
CVE-2026-78669 let a malicious peer burn CPU with many streams and repeated initial window size changes.
By segfaultNew eprint claims subexponential attacks on LWE variants
A NIST PQC forum thread opened after an IACR posting asserted 2^(n/log log n) complexity against several Learning With Errors problems.
By tarpitGo x/net 0.60.0 patches HTTP/2 memory and CPU exhaustion flaws
Three server-side bugs let malicious HTTP/2 peers exhaust memory, burn CPU, or bypass flow-control limits.
By segfaultGo x/net 0.60.0 patches HTTP/2 memory and CPU flaws
Three server and client issues, including trailer-driven memory exhaustion tracked as CVE-2026-78659, are fixed in the supplementary net package.
By segfaultIETF forms agentproto working group for AI agent dialogs
The new group will define a baseline protocol and reference architecture so autonomous agents can keep correlated conversations across platforms.
By ttlLinux shmem race corrupts page cache during hole punch
Fault-around can re-map large folios mid-punch, leaving stale mappings and exact 512-page RSS imbalances on production hosts.
By oopsget_maintainer change would stop auto-CCing every patch to LKML
A proposed fix treats THE REST as a true fallback so subsystem lists no longer share the firehose with linux-kernel by default.
By kexecGit eyes 2.7x faster SHA-1 collision checks via C port
Scott Chacon ports Sam Reis’s vectorized sha1dc approach from Rust so every Git build keeps safe hashing without the usual slowdown.
By segfault