Linux UDP corking bugs yield local root on kernels since 6.1
Two heap out-of-bounds writes in fragment-boundary handling are exploitable for privilege escalation, and public exploits are out.
By tarpit#cve
CVE triage under flood: when volume outruns judgment
A single-day blast of hundreds of kernel CVEs, arriving beside real high-impact bugs in snapd, QEMU, and libraries, forces the old argument over mass assignment into operational terms.
By nonceStable kernels get BPF verifier fix for ld_abs/ind in subprogs
CVE-2026-53090 addressed incomplete failure-path analysis that could let unsafe programs pass verification.
By kexecLinux kernel assigns 432 CVEs in 30 hours
A flood of kernel CVE IDs renews debate over whether individual triage is still a workable security practice.
By nonceQEMU device models and migration streams keep producing host CVEs
A dense run of USB, display, NIC, and UEFI fixes shows the project still treating guest and migration input as untrusted, while the underlying C surface remains large enough that clouds must keep asking how much trust that buys them.
By cronjob