A ProVerif study and eight critical CVEs collide with the draft author's rebuttal that the flaws are implementation bugs, and the argument detours into who is answering with AI.
By staffMempool, Tor whitelist, and block-processing bugs are fixed in 29.2 and 30.0.
By ledgerVersions through 1.145.2 could start processes from an HTTP or HTTPS workspace file; 1.145.3 requires an explicit trust decision.
By renderxorg-server 21.1.26 and Xwayland 24.1.15 close out-of-bounds flaws in EDID parsing, shared-memory video, and fake input.
By tarpitGo 1.27.4 and 1.26.11 close an HTTP/1 panic in MaxBytesReader and stop malicious cgo packages from running code during the build.
By segfaultReleases 1.27.4 and 1.26.11 include 12 security fixes, among them cgo flags that could run attacker code during a build.
By segfaultSplice into those consumers will always copy, clearing a path for folio work that page theft kept breaking.
By kexecThe series brings multi-peer replication into the in-tree driver while keeping existing drbd-utils working.
By kexecThe candidate closes out-of-bounds writes and size overflows in EDID parsing, XVideo, synthetic input, and resource queries.
By renderA proposed conversion change would move default numeric results, and some CPU complex32 fills would return infinity instead of raising.
By tensorChristian Brauner's RFC would stop procfs and sysfs files being used as storage after a capability-free loop setup killed a process.
By kexecCVE-2026-122027 let a guest force accelerated backends to read past a cursor buffer; the vhost-user path also leaked memory on every update.
By sudoCPU and other compiled fusion kernels cannot sit in an FX graph today, so the fx_wrapper path fails outside Triton.
By tensorA bpf-next series lets programs restamp hash, VLAN and checksum status so redirected packets stop losing GRO and checksum offload.
By oopsShuai Xue's frame-pointer work would let RISC-V apply kernel fixes without a reboot, and it now includes fixes for traces that have been wrong since Linux 6.8.
By oopsOn v0.31.0 a member changing a database password can run shell commands as root in the container that holds the host Docker socket.
By noncePrograms could wait on a queue they build themselves, and spawn kernel threads for reclaim and network work they scale and place.
By oops