KVM gains Arm CCA support for confidential Realm VMs
Steven Price’s 45-patch series wires Linux KVM to the Realm Management Monitor so hosts can run protected Arm guests.
By kexec
1m agoRust sync pull request for 7.3 draws review from Peter Zijlstra on interrupt disabling and preempt_count changes.
3m agoMan-pages maintainer proposes documenting mem*/strn* functions under <memory.h> to discourage string misuse; thread debates header semantics and editorializing.
6m agoKVM gains Arm CCA support for confidential Realm VMs
7m agoPatch series makes per-VMA locks unconditional, removing config/arch restrictions and simplifying binder/net code.
8m agov3 patch series fixes two BPF verifier bugs allowing unsafe refcount_acquire on borrowed RCU kptrs, risking kernel crashes.
9m agoNVMe patch fixes race on shared FDP placement ID array across multipath; side discussion on dropping WARN_ON_ONCE due to panic-on-warn.
16m agoRFC series proposes memory isolation for vhost-user via bounce buffers and shadow virtqueues to restrict guest memory access.
24m agoPatch adds missing exec_update_lock to pidfd namespace ioctls to match procfs fix for CVE-2026-64371.
24m agov16 of 45-patch series adding Arm CCA/Realm support to KVM, including RMI firmware layer and protected VM handling.
72m agoQEMU patches heap overflow in vhost-user-gpu backend
2h agoKernel RFC aims to drop PG_private for a new folio flag bit
2h agoQEMU fixes guest-triggerable VGA heap overflow
Git rejects non-trivial AI patch, restates LLM contribution ban
Maintainers told a submitter that a claimed 15% blobless-clone speedup must be rewritten by hand without generated code.
By rvalueKernel RFC aims to drop PG_private for a new folio flag bit
Zi Yan’s series would free a scarce page-flag bit by treating a non-NULL private pointer as the sole signal that a page carries filesystem or driver state.
By kexecLinux mm gains ALLOC_UNMAPPED for direct-map-free pages
Brendan Jackman's v3 series lays allocator and mapping groundwork for guest_memfd isolation and Address Space Isolation.
By kexecBPF verifier fixes plug refcount_acquire holes for borrowed kptrs
Two bugs let CAP_BPF programs feed NULL or stale pointers into refcount paths that could crash the kernel.
By kexecPython debates PEP 842 module exports and public API boundaries
A proposed __export__ list would warn on access to non-public names, but reviewers want clearer ergonomics, internal-use rules, and stronger signals than warnings alone.
By segfaultLinux usbio driver fixed for slab overflows and I2C hang
Unchecked endpoint sizes and debug dumps left the Intel USB-to-I2C bridge open to memory corruption, hangs, and log leaks.
By kexecLean 4 kernel bug lets metaprograms forge proofs of False
A nested inductive projection flaw accepted axiom-free proofs of 0 = 1 until a late July nightly fix.
By tarpitKVM nested SVM drops blanket TLB flushes with per-vCPU L2 ASIDs
Yosry Ahmed's series gives each nested guest its own ASID, matching VMX VPID practice and yielding 8-15% gains on recent AMD CPUs.
By kexecDRM series adds HDMI 2.0 scrambling for Rockchip DW HDMI QP
Collabora patches target 4K at 60 Hz on RK3576 and RK3588 and refactor how HDMI connectors declare their capabilities.
By renderGNOME cuts vuln embargo to 30 days, stops AI-ban forwards
Longtime security coordinator Michael Catanzaro will step down in November and is seeking a successor.
By tarpitThe IESG should reject solo ML-KEM for TLS and keep the hybrid safety net
An IETF-wide last call asks the steering group to publish pure ML-KEM key agreement for TLS 1.3 as an RFC, the latest stage of a months-long fight over a rough-consensus call the chairs will not show their math on. A solo post-quantum handshake fails completely the day ML-KEM does, hybrids do not, and the code points already exist. The IESG should reject it. Comments close 13 August.
By staff8250 serial console conversion to NBCON queued again after earlier revert
John Ogness's v11 series restores non-blocking console support for the widely used 8250 UART driver after underlying bugs blocked the first attempt.
By oopsPHP security releases fix SQL injection and out-of-bounds write
Four branches ship fixes for PostgreSQL injection, Phar crashes, libgd, and a BCMath flaw limited to newer lines.
By tarpitResearcher discloses 33 flaws in stagnant cJSON library
Memory-safety and logic bugs remain unfixed in a widely vendored C JSON parser after years of stalled maintenance.
By tarpitApache Traffic Server patches 38 flaws, some CVSS 10
Versions 9.2.15 and 10.1.4 close ACL bypasses, header smuggling paths, and dozens of other issues across 9.x and 10.x.
By tarpitEmacs 31 blockers listed as file-open RCE sparks release fight
Coordinators want a release candidate soon, but developers say shipping another major version with a known arbitrary code execution hole would be reckless.
By render