HTTP WG moves to fence off status 402 as x402 spreads
Outside payment projects have assigned their own meaning to the long-reserved code; Mark Nottingham has floated a draft to limit collisions.
By staff
6m agoSEAT WG debating whether Identity Crisis and intra-handshake.fail papers define suitable threat model/properties for attested TLS, with formal ProVerif analysis disputes.
46m agoSwift evolution pitch for @called(once) attribute to model at-most-once function execution, with discussion on non-escaping closures and DI.
56m agoELPA submission for LLM-assisted Sapling client draws RMS into debate on rejecting LLM-generated code and suitable headers.
58m agoBug report and fix discussion for row filter in logical replication turning unchanged toasted columns into NULL on subscriber.
69m agoWG adoption call for LSR power-group draft draws technical questions on oscillation, TLV usage, and path computation vs sleep management.
77m agoQEMU patch series implements LVZ guest support for LoongArch TCG, enabling nested virtualization.
1h agov4 patch series relaxes BPF verifier to permit arena pointers inside by-value struct returns from global functions and kfuncs; merged to bpf-next.
1h agoHugh Dickins posted 25-patch series reworking per-cpu folio batches to reduce lru_add_drain calls and LRU lock contention.
7h agoLinux gains initial USB4 support on Apple M1, M2, and M3
10h agoHTTP WG moves to fence off status 402 as x402 spreads
26h agoLinux makes per-VMA locks unconditional on all configs
28h agoQEMU RFC revives Raspberry Pi Pico and RP2040 machine model
Linux gains initial USB4 support on Apple M1, M2, and M3
A mainline patch series brings first Thunderbolt host-router bring-up to Apple Silicon, limited for now to XDomain links and USB3 tunnels.
By oopsLinux makes per-VMA locks unconditional on all configs
The change lets binder and TCP drop mmap_lock fallbacks, and Andrew Morton has queued the series for testing.
By oopsGit race with geometric repack hides objects from live readers
Elijah Newren fixes multi-pack-index lookups that treat present objects as missing when a concurrent repack retires their owning pack, plus a replay crash and mktree --batch bugs.
By rvalueKernel clamps qdisc quantum paths that let admins soft-lock hosts
Eight traffic-control schedulers still allowed tiny quanta after setup, reopening a deficit-loop DoS under the qdisc lock.
By kexecFour U-Boot filesystem overflows risk pre-boot code execution
Integer overflows in ZFS, SquashFS, EXT4, and a shell move command can under-allocate heap buffers through U-Boot 2026.01-rc4.
By tarpitVault Secrets Operator leaks privileged token to tenants
CVE-2026-8715 in versions 1.3.0–1.4.1 lets a namespaced user force the operator to exfiltrate its ServiceAccount token, a short hop from cluster-admin.
By tarpitKernel fix breaks vmalloc livelock under memory pressure
A circular lock dependency in the vmap purge path could stall the whole system when reclaim and purge work collided.
By kexecglibc plugs heap overflow in fopen ccs= charset handling
CVE-2026-18374 let a crafted mode string overrun a small heap buffer when a charset token stripped to empty.
By segfaultDRM scheduler fix closes unprivileged GPU fence UAF read
A core lifetime bug let userspace read freed scheduler memory via exported fences in amdxdna, nouveau, and msm.
By kexecQEMU series makes Human Monitor Protocol optional at build time
Marc-André Lureau’s 50-patch work lets builds drop HMP for a QMP-only binary, shrinking size and attack surface.
By sudoKernel trusted-keys path hardens TPM1 seal and HMAC checks
Forged TPM 1.x replies could overflow a fixed-size blob buffer or skip response authentication entirely.
By kexecLinux kernel panics on GSO fragments after IP reassembly
CVE-2026-80590 lets an unprivileged user trigger a BUG_ON in skb_segment via tap or virtio paths that keep GSO metadata on defragmented packets.
By kexecBubblewrap 0.12.0 stops symlink writes outside the sandbox
The fix closes a setup-time traversal that could let a malicious app image plant files on the host via Flatpak and similar tools.
By nonceBurnout and thin governance strain packaging and language cores
Nixpkgs’ core team exit, a Fedora fight over a silent default video player, and Julia’s post-maintainer and AI-PR stresses show volunteer models cracking under the same load.
By chroottmpfs casefold option leaked Unicode maps, enabling local DoS
Unprivileged users could exhaust kernel memory by repeatedly setting the casefold mount option on tmpfs.
By kexecRMS: GNU ELPA must reject LLM-generated packages
A Magit-style Sapling client for Emacs triggers a policy fight over AI code and package maintenance.
By render