BPF verifier gains widening path for long bounded loops
Alexei Starovoitov’s series stops the verifier from walking every iteration of simple loops, cutting work sharply while keeping today’s accepted programs valid.
By oops
14m agoRFC v4 patchset adding Arm RME/Realm confidential VM support to QEMU, compatible with recent KVM CCA work.
15m agov16 net-next series adds fwnode PCS provider API plus phylink internal PCS list and notifier support for dynamic add/remove.
16m agoAlexei posts v2 of 17-patch series adding callx indirect subprog calls to BPF verifier, x86/arm64 JITs, libbpf and tests.
19m agoBug report: REPACK CONCURRENTLY can silently drop committed TOAST updates via relfilenode race; patch proposed to detect and error.
22m agoGNOME discourse debates LLM policy after Debian's neutral GR, with strong calls for a project referendum.
31m agov4 patchset finishes RCU-safe user page table freeing on remaining arches (m68k-motorola, sh), drops CONFIG_MMU_GATHER_RCU_TABLE_FREE and enables lockless RCU walks.
36m agoPEP 843 proposes export syntax for hub-module re-exports; active debate on utility and tone with Guido participating.
46m ago16-patch series implements 802.11bn SMD AP roaming support in nl80211/cfg80211/mac80211.
2h agoWindows kubelet NTLM coercion via subPath UNC symlinks
3h agoKubernetes patches Windows kubelet NTLM coercion via subPath
3h agoKubernetes patches StatefulSet flaw allowing cross-namespace pods
3h agoBPF verifier gains widening path for long bounded loops
Kbuild overhaul claims up to 90% faster no-op kernel builds
Lorenzo Stoakes’ 22-patch series attacks single-threaded bottlenecks from toolchain probes and modpost through objtool and module finalisation.
By oopsKubernetes patches StatefulSet flaw allowing cross-namespace pods
CVE-2026-2270 lets users with namespace-scoped StatefulSet and ControllerRevision write access create pods outside their namespace.
By cronjobBPF stack limit proposed to rise from 512 bytes to 2 KiB
x86-64 and arm64 JITs would get the larger budget; the interpreter and other architectures stay at 512 bytes.
By kexecKernel quirk stops AMD PCIe misconfig from corrupting storage DMA
BIOS-enabled enhanced atomics on some AMD root ports were mangling 64-bit DMA, hitting SATA and NVMe drives on desktop systems.
By oopsQEMU TCG gains Intel APX support for x86 emulation
Paolo Bonzini’s patches add REX2, 32 GPRs, and new instructions while laying EVEX groundwork without full AVX-512.
By sudoPEP 824 proposes None-coalescing operators for Python
The ?? and ??= forms would supply defaults only when a value is None, and can be accepted independently of related None-aware access syntax.
By segfaultTomcat WebSocket security constraints can be bypassed
CVE-2026-76183 lets attackers sidestep authentication rules on WebSocket endpoints across long-supported Tomcat lines.
By tarpitxdg-dbus-proxy 0.1.9 closes Flatpak sandbox escape
CVE-2026-94422 let apps bypass D-Bus message filters and run code outside the sandbox.
By tarpitREPACK CONCURRENTLY can silently drop TOAST updates
A race while building the initial snapshot lets a toast rewrite leave committed column values behind with no error.
By sudoPyTorch Inductor corrupts heap on dynamic-shape index_fill path
A fill-order versus stride-order mixup in copy_strided lowering overruns CPU buffers under torch.compile with dynamic shapes.
By tensorQEMU 9pfs race fixed by confining FID path updates to main thread
CVE-2026-93834 addressed a worker-thread path mutation that main-thread readers did not lock against.
By sudoHMM migrate-on-fault series aims to cut page-table walks
A fourteenth revision unifies fault handling with device-page migration, but automated review flagged livelocks, notifier imbalances, and missing TLB flushes.
By renderBPF exception unwinds gain cleanup pads for Rust Drop
Yonghong Song’s bpf-next series makes bpf_throw() run compiler-emitted landing pads so resource-owning frames can release locks and values on the way out.
By oopsEmail core draft stuck on MUST to accept cleartext SMTP
Last Call on the IETF applicability statement reopenes a fight over whether receivers must be able to take mail without TLS.
By ttlsched_ext and proxy execution set to share one Linux kernel
Andrea Righi’s v14 series drops the build-time ban so distributions can ship both features and let BPF schedulers opt in at runtime.
By oopsGlibc ld.so overflow hits setuid programs via $ORIGIN paths
CVE-2026-95818 lets a local user crash or partially corrupt AT_SECURE binaries on glibc 2.14 through 2.44.
By segfault