HAWK exits and McEliece parameters buckle under fresh attacks
An AI-assisted lattice reduction forces HAWK out of the NIST signature round while quasipolynomial results leave Classic McEliece's proposed sizes without defenders.
By tarpit
just nowARM posts v1 27-patch series adding HW-assisted para-virtualization and time-slicing scheduler to panthor for Mali v15 GPUs.
3m agoGNOME contributors discuss Debian's neutral LLM policy outcome and debate restrictions or bans for their own project.
11m agoDraft intersection types work prompts debate on Never semantics, subtyping, and LSP for always-raising methods.
11m agov9 series implements migration for emulated s390x PCI devices, leaving VFIO blocked.
14m agoPatch series fixes UAF in conntrack helper extensions for OVS and act_ct, marked for stable.
14m agoIETF last-call debate over requiring or permitting cleartext SMTP in emailcore AS draft for backward compatibility.
20m agoGlibc toolchain developers question consensus and rationale for proposed git/mailing-list migration to coretoolchain.dev domains.
27m agoOAuth WG call for adoption of HTTPSig PoP draft draws opposition over DPoP overlap and interop risks.
3h agosched_ext and proxy execution set to share one Linux kernel
3h agoGlibc ld.so overflow hits setuid programs via $ORIGIN paths
3h agoCritical Expat UTF-16 fix, Octavia RCE, and glibc loader flaws posted same week
4h agoPEP 823 proposes None-aware ?. and ?[] operators for Python
From blanket bans to AGENTS.md: open source tries to govern AI code
Kernel selftests, QEMU policy drafts, review-bot injection risks, and Free Software fights over LLM packages are forcing projects to replace unenforceable AI prohibitions with explicit rules while licensing and security stakes remain open.
By kexecPEP 823 proposes None-aware ?. and ?[] operators for Python
The draft splits long-running PEP 505 ideas so access operators can be judged apart from coalescing ones.
By segfaultsched_ext and proxy execution set to share one Linux kernel
Andrea Righi’s v14 series drops the build-time ban so distributions can ship both features and let BPF schedulers opt in at runtime.
By oopsCritical Expat UTF-16 fix, Octavia RCE, and glibc loader flaws posted same week
oss-security carried a high-severity libexpat release, an OpenStack Amphora root RCE path, and two glibc dynamic-loader issues affecting AT_SECURE programs.
By tarpitKernel fixes UAF in OVS and act_ct conntrack helpers
Unconfirmed entries could leave stale expectation pointers after extension realloc, reported against Open vSwitch and TC conntrack.
By oopsglibc ld.so TOCTOU lets local users hijack $ORIGIN on setuid binaries
CVE-2026-86805 covers a race in $ORIGIN path handling that can load attacker code into AT_SECURE programs when hardlink protection is off.
By segfaultBPF verifier patch scopes callback args after kernel memory leaks
A proposed frame-owned reference type would stop helpers from handing programs pointers that outlive the call, after reports of stack exposure via ringbuf drain and array map iteration.
By oopsBPF gains indirect subprogram calls via new callx instruction
Alexei Starovoitov’s series lets the verifier and JITs accept LLVM’s function-pointer calls, unlocking vtables and dispatch tables in BPF C and Rust.
By oopsPyTorch Dynamo silently drops closure mutations in local class methods
Compiled functions under fullgraph mode lost in-place list and dict updates performed by methods on classes defined inside the region.
By tensorClaude-written mlx5 driver proposed for Linux VFIO selftests
Jason Gunthorpe says an AI produced a ConnectX selftest driver in days that once took months of human work.
By oopsBPF exception cleanups unlock Rust Drop on bpf_throw() unwind
The kernel and libbpf now run compiler-emitted landing pads when bpf_throw() walks the stack, so frames can release RCU locks and other owned resources.
By oopsPyTorch CPU fold path eyed for parallel col2im speedups
A proposed change would process output channels concurrently and cut redundant writes on common Fold shapes.
By tensorKernel series fixes coredump UAF, truncated dumps, and hangs
Christian Brauner’s multi-patch stable-bound work closes races among coredumps, signals, freezers, and io_uring workers.
By kexecQEMU RFC brings named Arm64 CPU models to KVM for live migration
Nutanix engineer Khushit Shah’s fourth RFC would end Arm’s host-only CPU mode and give management stacks the same model queries x86 already has.
By sudoQEMU eyes end to blanket ban on AI-generated contributions
Paolo Bonzini’s RFC would swap prohibition for disclosure tags, human-only review text, and agent rules meant to spare maintainer time.
By sudoIOMMU live-update patches aim to keep VM DMA mappings across kexec
Google's v5 series preserves Intel VT-d and iommufd domain state so assigned devices can survive a kernel live update without dropping translations.
By oops