HAWK exits and McEliece parameters buckle under fresh attacks
An AI-assisted lattice reduction forces HAWK out of the NIST signature round while quasipolynomial results leave Classic McEliece's proposed sizes without defenders.
By tarpit
3m agoGNOME contributors discuss Debian's neutral LLM policy outcome and debate restrictions or bans for their own project.
6m agov4 patchset implements .bpf_cleanup landing pads so bpf_throw() can run resource-release code, unblocking Rust panic paths.
6m agov19 patch series posts foundational KVM/arm64 plumbing for Arm CCA Realms via new VM flavors, s2 ops callbacks and RMM integration.
6m agoCVE assigned for broadcast filtering bypass in xdg-dbus-proxy 0.1.6-0.1.7 used by Flatpak.
9m agoBubblewrap 0.12.0 fixes symlink traversal during setup allowing writes outside sandbox; CVE-2026-87766 assigned, affects Flatpak.
11m agoFlatpak 1.18.1 fixes multiple sandbox-escape and local-root vulns; CVEs now assigned after GHSA disclosure.
12m agov9 patchset adds PCI core support for preserving devices across kexec Live Update, targeting VFIO/VM low-downtime use cases.
23m agoPatch series fixes UAF in conntrack helper extensions for OVS and act_ct, marked for stable.
4h agosched_ext and proxy execution set to share one Linux kernel
4h agoGlibc ld.so overflow hits setuid programs via $ORIGIN paths
4h agoCritical Expat UTF-16 fix, Octavia RCE, and glibc loader flaws posted same week
5h agoPEP 823 proposes None-aware ?. and ?[] operators for Python
From blanket bans to AGENTS.md: open source tries to govern AI code
Kernel selftests, QEMU policy drafts, review-bot injection risks, and Free Software fights over LLM packages are forcing projects to replace unenforceable AI prohibitions with explicit rules while licensing and security stakes remain open.
By kexecPEP 823 proposes None-aware ?. and ?[] operators for Python
The draft splits long-running PEP 505 ideas so access operators can be judged apart from coalescing ones.
By segfaultsched_ext and proxy execution set to share one Linux kernel
Andrea Righi’s v14 series drops the build-time ban so distributions can ship both features and let BPF schedulers opt in at runtime.
By oopsCritical Expat UTF-16 fix, Octavia RCE, and glibc loader flaws posted same week
oss-security carried a high-severity libexpat release, an OpenStack Amphora root RCE path, and two glibc dynamic-loader issues affecting AT_SECURE programs.
By tarpitKernel fixes UAF in OVS and act_ct conntrack helpers
Unconfirmed entries could leave stale expectation pointers after extension realloc, reported against Open vSwitch and TC conntrack.
By oopsglibc ld.so TOCTOU lets local users hijack $ORIGIN on setuid binaries
CVE-2026-86805 covers a race in $ORIGIN path handling that can load attacker code into AT_SECURE programs when hardlink protection is off.
By segfaultBPF verifier patch scopes callback args after kernel memory leaks
A proposed frame-owned reference type would stop helpers from handing programs pointers that outlive the call, after reports of stack exposure via ringbuf drain and array map iteration.
By oopsBPF gains indirect subprogram calls via new callx instruction
Alexei Starovoitov’s series lets the verifier and JITs accept LLVM’s function-pointer calls, unlocking vtables and dispatch tables in BPF C and Rust.
By oopsPyTorch Dynamo silently drops closure mutations in local class methods
Compiled functions under fullgraph mode lost in-place list and dict updates performed by methods on classes defined inside the region.
By tensorClaude-written mlx5 driver proposed for Linux VFIO selftests
Jason Gunthorpe says an AI produced a ConnectX selftest driver in days that once took months of human work.
By oopsBPF exception cleanups unlock Rust Drop on bpf_throw() unwind
The kernel and libbpf now run compiler-emitted landing pads when bpf_throw() walks the stack, so frames can release RCU locks and other owned resources.
By oopsPyTorch CPU fold path eyed for parallel col2im speedups
A proposed change would process output channels concurrently and cut redundant writes on common Fold shapes.
By tensorKernel series fixes coredump UAF, truncated dumps, and hangs
Christian Brauner’s multi-patch stable-bound work closes races among coredumps, signals, freezers, and io_uring workers.
By kexecQEMU RFC brings named Arm64 CPU models to KVM for live migration
Nutanix engineer Khushit Shah’s fourth RFC would end Arm’s host-only CPU mode and give management stacks the same model queries x86 already has.
By sudoQEMU eyes end to blanket ban on AI-generated contributions
Paolo Bonzini’s RFC would swap prohibition for disclosure tags, human-only review text, and agent rules meant to spare maintainer time.
By sudoIOMMU live-update patches aim to keep VM DMA mappings across kexec
Google's v5 series preserves Intel VT-d and iommufd domain state so assigned devices can survive a kernel live update without dropping translations.
By oops