When one CA's weak P-384 keys force everyone else to purge trust
Flawed eMudhra intermediates triggered root removals, Python toolchain freezes, and a sharper fight over who should own the CA bundle.
By tarpit
6m agoLinus objects to media pull exposing chip-specific I2C/SPI driver options in Kconfig without hiding.
15m agoPatch to make base tree info mandatory in submitting-patches.rst; maintainers debate necessity vs. added bureaucracy for common cases.
17m agoPatch series proposing shmem/tmpfs fixes for truncation races, F_SEAL_EXEC bypass, and memory accounting.
18m agoUrgent request to bypass Bodhi process for PHP security update sparks debate on emergency criteria and AI-era vuln handling.
23m agoRFC series posts complete TDX guest TSM phase-2 implementation for TDISP/TEE-IO device assignment and solicits cross-arch feedback.
25m agoActive OpenWrt porting thread for IPQ9574 device reports working regulators, Wi-Fi MLO, TFTP boot method, and submitted PR fixing kernel load address alignment.
29m agoOpenWrt 25.12.6 service release fixes multiple high-severity remotely exploitable vulns in default-enabled uhttpd.
34m ago37-patch series adds Arm MPAM 1.1 register and MSC emulation to QEMU virt machine for Linux resctrl support.
79m agoRust SPDM requester proposed for Linux device authentication
2h agollama.cpp auto thread count now prefers physical cores
9h agoGodot 4.x runs attacker GDScript from crafted .po translations
13h agoKernel fix stops /proc maps from skipping live VMAs under load
Rust SPDM requester proposed for Linux device authentication
Alistair Francis’s v5 series adds a memory-safe SPDM stack and PCIe CMA path so the kernel can treat untrusted device replies as hostile until verified.
By kexecGodot 4.x runs attacker GDScript from crafted .po translations
Unvalidated Plural-Forms headers reach the engine Expression evaluator, so community gettext files can execute code inside exported games.
By tarpitllama.cpp auto thread count now prefers physical cores
When users pass -t -1, the runtime sizes worker threads to physical cores rather than SMT logical cores.
By tensorTwo-decade IPv6 MTU bug can panic Linux with one sendmsg
Dead code in the IPv6 append path left a narrow MTU window that underflows and lets unprivileged raw-socket traffic trip skb_over_panic.
By oopsDMA-buf gains mapping types beyond scatterlist
A revised series lets exporters pick how buffers are described at pin or map time, aiming at VFIO, vGPU, and private links.
By rendertmpfs fixes close F_SEAL_EXEC bypass and truncation hangs
Urgent shmem work also stops inode use-after-free on writeback and quota limits that silently vanished.
By kexecLinux proxy execution series adds sleeping-owner handling
John Stultz posts the next major stage of scheduler proxy execution, covering waiters blocked on mutexes whose owners are asleep.
By kexecPython issues expedited releases blocking compromised eMudhra CA keys
Five branches now distrust the keys in ssl so pip stays safe even before users upgrade it.
By rvalueNode.js patches Brotli RCE that spreads far past the runtime
A high-severity out-of-bounds write in Google's shared compression library, fixed in Node 22, 24, and 26, also reaches Envoy, browsers, and dozens of other consumers.
By tarpitRocq and Lean 4 kernel bugs let checked proofs of False through
Four oss-security reports detail soundness and audit flaws that accept 0 = 1 without axioms, spanning two major proof assistants.
By nonceLean formalization of Julia Base surfaces hundreds of bugs
Miles Cranmer modeled concrete Base types and docstring promises as Lean theorems, filing 75 filtered reports after AI-assisted proof attempts failed.
By rvalueQEMU fixes eight OOB and overflow bugs in device emulation
A manual audit found heap writes, host memory disclosure, and a guest-triggerable hang across display, audio, and SCSI backends.
By sudoBPF maintainer NACKs page_owner iterator series as overkill
Alexei Starovoitov wants one thin kfunc and a bpf_for loop instead of dual iterators, string-printing helpers, and a debugfs rewrite.
By oopsKernel hardens virtio-net against rogue checksum offload metadata
Untrusted csum_start and offset values can no longer leave CHECKSUM_PARTIAL pointing at arbitrary packet bytes after protocol decisions have been made.
By kexecRust VFIO PCI abstractions land with NVIDIA vGPU driver
A twelve-patch series wires nova-core SR-IOV into VFIO so NVIDIA virtual functions can be assigned to userspace.
By renderQEMU ties QOM properties to QAPI types for management tools
A large series from Marc-André Lureau adds formal schema cross-references so clients no longer guess from free-form type strings.
By sudo