A memory-safety race in page-table dumping leads the week’s traffic, alongside a long-lived taskstats truncation, RISC-V IOMMU progress, and a push to delete a BROKEN Qualcomm crypto driver.
By kexecA one-line assembly amendment now treats an undefined category of software as presumptively toxic on a major free-software forge, after years of campaigning and a rationale page that returns 404.
By ledgerGuests could set virtio queues larger than the host allocated, enabling out-of-bounds access when in-order delivery was in use.
By sudoAn RFC for runtime-mask shuffles draws support from Rust, C++26, and SVE and RISC-V backends after years of workarounds.
By segfaultA guest userspace driver could abort the hypervisor by feeding empty indirect tables into packed virtqueues.
By sudoDynamic hard_header_len updates raced with lockless TX paths; macvlan-on-VLAN shows a related headroom gap.
By kexecUnmasked guest feature bits could turn on virtio-net RSC without the headers the receive path assumed, triggering CVE-2026-63321.
By sudoCVE-2026-61402 let an untrusted vq size overrun the inflight log because libvduse trusted kernel-supplied values without a bounds check.
By sudoA KASAN-reported use-after-free in the BPF TCP send path freed a shared cork message twice when two threads raced across a lock drop.
By kexecCVE-2026-50624 let a late entropy callback touch freed host memory after the guest RNG device was removed.
By sudoCVE-2026-66020 left a dangling pointer after RESOURCE_DETACH_BACKING, so UPDATE_CURSOR could memcpy from freed host memory.
By cronjobA missing check let a malicious guest inflate blob size past its backing buffer and force out-of-bounds host reads on scanout.
By cronjobA new page-table helper lets multi-size THP stay available on CPUs that cannot back traditional PMD leaves.
By oopsThe fix unsticks tiered-memory workloads but can slow KVM guests that relied on the old broken skip.
By oopsThe change targets a blocker for public initializers on macro-generated structs without waiting on new synthesis syntax.
By rvalueAn incomplete follow-up to CVE-2024-3446 left the network device open to the same class of attack under a new CVE.
By cronjobUnsanitized ntp_server values let project managers run arbitrary commands during ramdisk startup.
By tarpit