Kernel RFC fixes inode reclaim hang on ext2, FAT and kin
A metadata writeback flag introduced in Linux 7.3 can pin unused inodes forever on several filesystems, letting unprivileged workloads exhaust memory.
By kexec#dos
Apache Kafka patches JWT bypass, secret reads, and pre-auth memory DoS
Four advisories cover forged OAuth tokens, unauthorized file and env disclosure, Connect secret leakage, and heap exhaustion on flexible request headers.
By tarpitTwo-decade IPv6 MTU bug can panic Linux with one sendmsg
Dead code in the IPv6 append path left a narrow MTU window that underflows and lets unprivileged raw-socket traffic trip skb_over_panic.
By oopsSwift Crypto 5.0.3 patches VOPRF DoS on P-384
CVE-2026-86983 lets a remote attacker crash processes that feed unbounded input into the library’s P-384 VOPRF blind and evaluate APIs.
By segfaultSwiftNIO 2.101.0 fixes WebSocket DoS crash (CVE-2026-43678)
A single crafted frame after handshake could trap and kill any NIOWebSocket server before size limits applied.
By rvalueGo patches HTTP/2 CPU spike from SETTINGS window updates
CVE-2026-78669 let a malicious peer burn CPU with many streams and repeated initial window size changes.
By segfaultllama.cpp Jinja templates allow exponential DoS via nested loops
Uncapped nested range loops in chat templates can pin llama-server before it finishes starting.
By tensorOpenSSL flags high-severity DTLS heap leak and crash risk
A flawed retransmission path can send leftover buffer bytes to a peer or abort the process when a handshake write is suspended mid-message.
By tarpitglibc DNS resolver aborts on long search domains
CVE-2026-8674 can crash name-resolving processes when a search list entry is roughly 200 characters or longer, including via DHCP or VPN-supplied resolv.conf data.
By segfaultISC patches 14 BIND 9 flaws, including remote crashes and DoS
Fixes span use-after-free bugs, DNSSEC validation errors, amplification paths, and unauthenticated crashes across recursive and authoritative roles.
By tarpitBPF verifier patches close gotox DoS and register-leak paths
Indirect-jump handling could stall loading for hours and, on a CFG mismatch, leave callee-saved registers under BPF control.
By kexecPostfix 3.11.7 closes SMTP smuggling and remote crash flaws
Stable and legacy releases fix medium-impact defects, some decades old, reported by Qualys and OpenAI Security.
By nonceQEMU patches websocket DoS crashes, deprecates AF_ALG crypto
Unauthenticated clients could crash QEMU during the VNC websocket handshake; the in-kernel AF_ALG path is marked for removal after Linux dropped it.
By sudoLinux qdiscs clamp quantum paths that let namespaces soft-lock the host
A follow-up series closes change-path and missed-qdisc holes that restored multi-billion-iteration deficit spins under the scheduler lock.
By oopsKernel clamps qdisc quantum paths that let admins soft-lock hosts
Eight traffic-control schedulers still allowed tiny quanta after setup, reopening a deficit-loop DoS under the qdisc lock.
By kexectmpfs casefold option leaked Unicode maps, enabling local DoS
Unprivileged users could exhaust kernel memory by repeatedly setting the casefold mount option on tmpfs.
By kexec