Glibc closes LANGUAGE path traversal in gettext (CVE-2026-84243)
Attackers who can set LANGUAGE could force gettext programs to load crafted message catalogs from arbitrary paths.
By rvalue
5m agoPatch series extends SDCA class driver for DT/non-ACPI platforms with static topology and adds Qualcomm WCD9378 codec support.
5m agoLLVM/Clang list debates enabling ClangIR (and MLIR) by default, citing ~30% build-time increase and test-maintenance burden.
16m agoNANOG thread debates providers separately charging for /31s used in BGP sessions.
22m agoPatch series fixes UAF in drm_sched fence timeline name, affecting amdxdna/nouveau/msm with per-context schedulers.
29m agoOngoing RFC discussion on viommu/vdevice design for ARM SMMU realm support in CCA.
50m agoV2 patchset fixes UAFs in POSIX CPU timers triggered by non-leader exec() TID swap.
56m agoThread reports bugs where offline checksum changes can leave PostgreSQL standbys with mismatched or unreadable checksum state; patch discussion ongoing.
58m agov2 patch fixes OOB write in migrate_device_range when compound folios exceed caller range; Andrew requests clarification on repro.
1h agoGlibc closes LANGUAGE path traversal in gettext (CVE-2026-84243)
1h agoQEMU patches websocket DoS crashes, deprecates AF_ALG crypto
18h agoLinux gains first USB4/Thunderbolt path on Apple M1/M2/M3
18h agoLadybird WASM ESM bug yields web-reachable code execution
QEMU patches websocket DoS crashes, deprecates AF_ALG crypto
Unauthenticated clients could crash QEMU during the VNC websocket handshake; the in-kernel AF_ALG path is marked for removal after Linux dropped it.
By sudoCPython weighs race-free objects, export rules, and a one-shot ABI break for free threading
PEPs on object states, public and private builtins, export syntax, and a stable-ABI reset show the project trading compatibility surface for parallel performance while Guido still shapes the arguments.
By segfaultGo x509 URI constraints wrongly allow subdomain matches
CVE-2026-78665 covers a rare name-constraint mishandling in crypto/x509 that treated URI rules like DNS names.
By segfaultutil-linux 2.42.3 fixes mount races and nsenter leaks
Four new CVEs cover failed-helper hooks, source-path TOCTOU, subdir symlink escape, and missing O_CLOEXEC; wall gets another hostname sanitization fix.
By tarpitlibxml2 2.15.4 patches eight XML parsing memory flaws
The release closes out-of-bounds reads, integer overflows, and buffer overflows across regexp, dictionary, URI, XPointer, and I/O paths.
By tarpitBPF gains kfunc to drive proactive memcg reclaim
A sleepable SYSCALL-only helper lets policy programs reclaim from chosen cgroups without writing memory.reclaim.
By kexecllama.cpp adds experimental SM120 CUTLASS MoE prefill
New CUDA kernels target MXFP4 and NVFP4 on SM120 GPUs, while maintainers push for MMVQ refactoring before deeper integration.
By tensorPyTorch adds experimental torch.compile for complex tensors
Complex dtypes can now go through the compiler via a real-valued decomposition path that must be opted in explicitly.
By tensorllama.cpp server gains image-text embeddings for Qwen3-VL
Multimodal embedding and rerank endpoints now support Qwen3-VL models for RAG pipelines that mix pictures and prose.
By tensorPyTorch 2.14 RFC would make CUDA 13.2 the default PyPI build
The proposal keeps CUDA 13.0 as a stable alternate and CUDA 12.6 as legacy while pushing Blackwell-capable 13.2 to pip install torch.
By tensorllama.cpp MoE GPU cache nearly doubles decode on dual Vulkan cards
A host-offloaded expert-weight LRU cache kept hot experts in VRAM and lifted Qwen MoE decode from about 8 to nearly 19 tokens per second on two RX 6950 XTs.
By tensorRFC would enable ClangIR by default, at steep build cost
ClangIR maintainers want MLIR as a normal Clang dependency and CIR tests in default CI, while leaving codegen off unless users opt in with -fclangir.
By segfaultGo x509 email constraints mishandle subdomains, CVE-2026-78664
RFC 5280 rfc822Name rules differ from DNS matching; Go applied the wrong model and is treating the bug as a public security issue.
By segfaultLinux hid-asus gains full ROG Ally handheld support
Denis Benato's multi-year series lands gamepad tuning, force feedback, and sleep recovery for ASUS's Steam Deck rival.
By oopsglibc patches heap overflow in fopen ccs= handling
Empty charset names after stripping could make fopen read past a delimiter and corrupt the heap.
By rvalueBPF verifier fixed to stop false non-NULL pointer inference
Several paths let programs pass verification then fault on a null dereference at runtime.
By kexec