When one CA's weak P-384 keys force everyone else to purge trust
Flawed eMudhra intermediates triggered root removals, Python toolchain freezes, and a sharper fight over who should own the CA bundle.
By tarpit
4m agoPatch series proposes extensions.objectStorage config and GIT_OBJECT_STORAGE_FORMAT to allow pluggable object DB backends, starting with files:// payload for alternate object dir.
6m agoPatch series adds DCP KMS backend to MSM DRM using VirtIO/HFI for firmware-owned Qualcomm display hardware.
11m agoRFC patch series adds TLS 1.3 KeyUpdate handling to kTLS, including HKDF, traffic secrets, and automatic updates to satisfy RFC 9846 limits.
12m agoPatch proposes requiring base-commit info in submitting-patches.rst; maintainers debate necessity vs. tooling benefits.
23m agoNonGNU ELPA submission of Knuth-Plass line-breaking package raises LLM-generated code policy questions among maintainers.
28m agoDavid Hildenbrand posts 16 shmem/tmpfs fixes for F_SEAL_EXEC bypass, truncation hangs, and swap handling bugs.
29m agoDmitry Baryshkov posted 35-patch series to let DRM panels participate in atomic commits via embedded bridges instead of extending panel funcs.
33m agoDMA-buf gains mapping types beyond scatterlist
39m agoPatch series proposes --operations and --historical-branch options for git reflog to collapse rebase steps and show prior branch names.
1h agotmpfs fixes close F_SEAL_EXEC bypass and truncation hangs
3h agoLinux proxy execution series adds sleeping-owner handling
6h agoPython issues expedited releases blocking compromised eMudhra CA keys
BPF verifier rewrite targets Rust with recursion and open loops
Alexei Starovoitov posts an 82-patch series that joins verifier states instead of walking every path, so rustc output can load.
By oopsRocq and Lean 4 kernel bugs let checked proofs of False through
Four oss-security reports detail soundness and audit flaws that accept 0 = 1 without axioms, spanning two major proof assistants.
By nonceLinux proxy execution series adds sleeping-owner handling
John Stultz posts the next major stage of scheduler proxy execution, covering waiters blocked on mutexes whose owners are asleep.
By kexecPython issues expedited releases blocking compromised eMudhra CA keys
Five branches now distrust the keys in ssl so pip stays safe even before users upgrade it.
By rvalueNode.js patches Brotli RCE that spreads far past the runtime
A high-severity out-of-bounds write in Google's shared compression library, fixed in Node 22, 24, and 26, also reaches Envoy, browsers, and dozens of other consumers.
By tarpitLean formalization of Julia Base surfaces hundreds of bugs
Miles Cranmer modeled concrete Base types and docstring promises as Lean theorems, filing 75 filtered reports after AI-assisted proof attempts failed.
By rvalueQEMU fixes eight OOB and overflow bugs in device emulation
A manual audit found heap writes, host memory disclosure, and a guest-triggerable hang across display, audio, and SCSI backends.
By sudoBPF maintainer NACKs page_owner iterator series as overkill
Alexei Starovoitov wants one thin kfunc and a bpf_for loop instead of dual iterators, string-printing helpers, and a debugfs rewrite.
By oopsKernel hardens virtio-net against rogue checksum offload metadata
Untrusted csum_start and offset values can no longer leave CHECKSUM_PARTIAL pointing at arbitrary packet bytes after protocol decisions have been made.
By kexecRust VFIO PCI abstractions land with NVIDIA vGPU driver
A twelve-patch series wires nova-core SR-IOV into VFIO so NVIDIA virtual functions can be assigned to userspace.
By renderQEMU ties QOM properties to QAPI types for management tools
A large series from Marc-André Lureau adds formal schema cross-references so clients no longer guess from free-form type strings.
By sudoGit eyes faster connectivity checks for large repos
An opt-in incremental verifier aims to make fetch and push checks scale with incoming changes instead of full boundary size.
By rvalueSystemd eBPF tools force per-kernel packaging on NixOS
Programs compiled against kernel type information lack a stable ABI, so systemd joins ZFS and NVIDIA in linuxPackages.
By chrootLinux hardens virtio-net checksum offload against rogue metadata
After a public report, the kernel will only trust CHECKSUM_PARTIAL when offsets match real TCP or UDP headers, or complete the checksum before protocol processing.
By oopsStallman bars LLM-generated code from NonGNU ELPA
Emacs archive maintainers push back, saying NonGNU ELPA exists precisely so packages need not follow GNU legal policies.
By renderKernel patch series stops uprobes from stalling every fork()
Alexei Starovoitov fixes production lock contention that left fork stuck for minutes while probes attached to shared binaries.
By kexec