Arm CCA protected VMs advance in KVM review
Steven Price's 37-patch series brings realm guests to arm64 KVM, targeting RMM v2.0-bet2 under maintainer scrutiny.
By kexec
just nowStable backport of upstream fix for use-after-free in Bluetooth L2CAP channel lifetime handling.
5m agoTejun Heo posts v2 sched_ext patchset adding kernel rescue execution for tasks stranded by sub-scheduler cap/affinity limits.
7m agoRust interrupt-disable primitives and SpinLockIrq reviewed by Peter Zijlstra with multiple code-level questions.
9m agov10 patchset removes build-time exclusion between proxy execution and sched_ext, adding hooks and fixes for context tracking.
10m agoApache NiFi auth flaw let read-only users override parameter checks
10m agoIntel-submitted KVM series proposes raising guest PMU version cap to PerfMon v5 and switching to bitmap-based counter tracking.
15m agoRFC series proposes memory isolation for vhost-user via bounce buffers and shadow virtqueues to restrict guest memory access.
23m agoNIST announces plan for seed-only key format in upcoming FIPS 207 (HQC-KEM) draft and seeks feedback.
31m agoEmacs devs debate adding AGENTS.md (and CLAUDE.md) to steer LLMs toward policy compliance instead of generating code.
2h agoQEMU virtio-gpu fix stops guest leak from short control headers
3h agoNIST leans toward seed-only keys for HQC in draft FIPS 207
4h agoArm CCA protected VMs advance in KVM review
KVM gains Arm CCA support for confidential Realm VMs
Steven Price’s 45-patch series wires Linux KVM to the Realm Management Monitor so hosts can run protected Arm guests.
By kexecNIST leans toward seed-only keys for HQC in draft FIPS 207
The agency plans a single private-key format for the upcoming HQC-KEM standard, departing from the dual formats allowed in ML-KEM.
By tarpitglibc 2.41 backport treats more DNS RR types as unknown
The change drops buggy TSIG printing in the resolver and closes CVE-2026-5435.
By segfaultKernel staging maintainer will reject LLM-generated patches
Greg Kroah-Hartman says automated cleanups defeat the subsystem's role as a training ground for new developers.
By kexecQEMU patches heap overflow in vhost-user-gpu backend
CVE-2026-15264 let a malicious guest overflow a host heap buffer via crafted 2D resource dimensions.
By sudoKernel RFC aims to drop PG_private for a new folio flag bit
Zi Yan’s series would free a scarce page-flag bit by treating a non-NULL private pointer as the sole signal that a page carries filesystem or driver state.
By kexecQEMU fixes guest-triggerable VGA heap overflow
A unit mismatch between text and graphics mode left a panning buffer undersized after mode switches, tracked as CVE-2026-17516.
By sudoLinux mm gains ALLOC_UNMAPPED for direct-map-free pages
Brendan Jackman's v3 series lays allocator and mapping groundwork for guest_memfd isolation and Address Space Isolation.
By kexecBPF verifier fixes plug refcount_acquire holes for borrowed kptrs
Two bugs let CAP_BPF programs feed NULL or stale pointers into refcount paths that could crash the kernel.
By kexecGit rejects non-trivial AI patch, restates LLM contribution ban
Maintainers told a submitter that a claimed 15% blobless-clone speedup must be rewritten by hand without generated code.
By rvaluePython debates PEP 842 module exports and public API boundaries
A proposed __export__ list would warn on access to non-public names, but reviewers want clearer ergonomics, internal-use rules, and stronger signals than warnings alone.
By segfaultLinux usbio driver fixed for slab overflows and I2C hang
Unchecked endpoint sizes and debug dumps left the Intel USB-to-I2C bridge open to memory corruption, hangs, and log leaks.
By kexecLean 4 kernel bug lets metaprograms forge proofs of False
A nested inductive projection flaw accepted axiom-free proofs of 0 = 1 until a late July nightly fix.
By tarpitKVM nested SVM drops blanket TLB flushes with per-vCPU L2 ASIDs
Yosry Ahmed's series gives each nested guest its own ASID, matching VMX VPID practice and yielding 8-15% gains on recent AMD CPUs.
By kexecDRM series adds HDMI 2.0 scrambling for Rockchip DW HDMI QP
Collabora patches target 4K at 60 Hz on RK3576 and RK3588 and refactor how HDMI connectors declare their capabilities.
By renderGNOME cuts vuln embargo to 30 days, stops AI-ban forwards
Longtime security coordinator Michael Catanzaro will step down in November and is seeking a successor.
By tarpit