Git RFC proposes external hunk providers for smarter diffs
A long-running process protocol would let tools like Difftastic decide which lines changed while Git keeps formatting, blame, and log -L.
By segfault
8m agoDraft proposes replacing TLS 1.3 HKDF-HMAC-SHA-2 key schedule with single Keccak permutation schedule for efficiency when ML-KEM/Dilithium or SHA-3 already present.
50m agoDeveloper proposes Penny Noise variants for Blender nodes; core devs discuss integration, node architecture, and AI-assisted code.
53m agoPatch drops off-CPU crypto from AF_ALG; users discuss impact on CAAM hardware keys and possible allow-listing.
1h agoGit RFC proposes external hunk providers for smarter diffs
2h agoRFC v5 series proposes diff.<driver>.process long-running protocol so external tools can supply hunks while Git retains formatting, blame, and log -L.
2h agoOpenWrt 24.10.8 service release fixes remotely triggerable vulnerabilities in default network services.
3h agoQEMU mailing list discusses second commit for CVE-2026-48002 VNC OOB write after partial fix reached stable releases.
4h agov3 Landlock patchset adds LSM hooks and UAPI for restricting namespace creation/use and capabilities.
5h agoPatch fixes unsigned-int truncation in vm->nr_pages << PAGE_SHIFT for >=4 GiB vmalloc areas on 64-bit.
14h agoQEMU fixes virtio-gpu use-after-free on blob detach
19h agoRust weighs official LTS toolchain funded by Foundation contracts
28h agosched_ext and proxy execution no longer mutually exclusive
QEMU fixes virtio-gpu use-after-free on blob detach
CVE-2026-66020 let a guest trigger reads of freed memory via cursor updates and scanout refresh after RESOURCE_DETACH_BACKING.
By cronjobRust weighs official LTS toolchain funded by Foundation contracts
A pre-RFC explores multi-year support windows, paid customer backing, and knock-on effects for crate MSRV policies.
By rvalueQEMU queues 9pfs and virtio-gpu security fixes
A 9p pull closes a read-only export bypass and backend UAFs; a separate virtio-gpu patch stops guest-driven out-of-bounds reads.
By sudoSeccomp gains non-cooperative pin redirect to close TOCTOU
A kernel series lets sandbox supervisors feed immutable syscall arguments into uncooperative targets without a trusted setup window.
By oopsQEMU fixes virtio-mmio queue size OOB (CVE-2026-50626)
virtio-mmio always advertised a 1024-entry maximum, which becomes unsafe once QEMU itself allocates in-order virtqueue resources.
By cronjobKernel roundup: ptdump use-after-free fix, taskstats cpumask bug, RISC-V IOMMU MSI, and QCE removal fight
A memory-safety race in page-table dumping leads the week’s traffic, alongside a long-lived taskstats truncation, RISC-V IOMMU progress, and a push to delete a BROKEN Qualcomm crypto driver.
By kexecLLVM plans dynamic vector shuffle intrinsic
An RFC for runtime-mask shuffles draws support from Rust, C++26, and SVE and RISC-V backends after years of workarounds.
By segfaultQEMU fixes DoS via zero-length packed virtio descriptors
A guest userspace driver could abort the hypervisor by feeding empty indirect tables into packed virtqueues.
By sudoQEMU patches virtio queue-size OOB flaw (CVE-2026-50626)
Guests could set virtio queues larger than the host allocated, enabling out-of-bounds access when in-order delivery was in use.
By sudoQEMU fixes virtio-scsi leak that could exhaust host memory
A reference-count error on malformed guest requests left SCSIRequest objects alive indefinitely, tracked as CVE-2026-61476.
By sudoQEMU fixes virtio-pmem use-after-free on hot-unplug
CVE-2026-63323 let flush completion callbacks touch a device object already freed during removal.
By sudoKernel VLAN fix stops skb panics when toggling HW offload
Dynamic hard_header_len updates raced with lockless TX paths; macvlan-on-VLAN shows a related headroom gap.
By kexecQEMU fixes virtio feature masking flaw that enabled host OOB reads
Unmasked guest feature bits could turn on virtio-net RSC without the headers the receive path assumed, triggering CVE-2026-63321.
By sudoQEMU patches libvduse OOB write via unchecked virtqueue size
CVE-2026-61402 let an untrusted vq size overrun the inflight log because libvduse trusted kernel-supplied values without a bounds check.
By sudoSockmap cork path double-frees under concurrent TCP sendmsg
A KASAN-reported use-after-free in the BPF TCP send path freed a shared cork message twice when two threads raced across a lock drop.
By kexecQEMU plugs virtio-rng use-after-free on hot-unplug
CVE-2026-50624 let a late entropy callback touch freed host memory after the guest RNG device was removed.
By sudo