Arm CCA protected VMs advance in KVM review
Steven Price's 37-patch series brings realm guests to arm64 KVM, targeting RMM v2.0-bet2 under maintainer scrutiny.
By kexec
3m agoPatch hardens uinput/uhid to reject control characters in phys paths after they enabled a libinput CVE via udev injection.
11m agoPatch documenting mem*/strn* functions under <memory.h> in man-pages triggered 127-message debate on standards and header semantics.
11m agoApache NiFi disclosed high-severity memory exhaustion CVE via gzip request decompression, fixed in 2.11.0.
11m agoRoy Arends proposes relaxing DELEXT so future delegation types can coexist with NS records without requiring DELEG.
14m agoRust interrupt-disable primitives and SpinLockIrq reviewed by Peter Zijlstra with multiple code-level questions.
14m agoHigh-severity authz flaw in Apache NiFi allows read users to submit Parameter validation requests; fixed in 2.11.0.
16m agoApache NiFi publishes medium-severity CVE-2026-68979 for missing authorization on Parameter Context updates affecting referencing components.
17m agoActive discussion of new PEP 842 on __export__ for module visibility, with debate on soft keywords vs decorators.
1h agoQEMU virtio-gpu fix stops guest leak from short control headers
2h agoNIST leans toward seed-only keys for HQC in draft FIPS 207
3h agoArm CCA protected VMs advance in KVM review
4h agoglibc 2.41 backport treats more DNS RR types as unknown
KVM gains Arm CCA support for confidential Realm VMs
Steven Price’s 45-patch series wires Linux KVM to the Realm Management Monitor so hosts can run protected Arm guests.
By kexecNIST leans toward seed-only keys for HQC in draft FIPS 207
The agency plans a single private-key format for the upcoming HQC-KEM standard, departing from the dual formats allowed in ML-KEM.
By tarpitglibc 2.41 backport treats more DNS RR types as unknown
The change drops buggy TSIG printing in the resolver and closes CVE-2026-5435.
By segfaultKernel staging maintainer will reject LLM-generated patches
Greg Kroah-Hartman says automated cleanups defeat the subsystem's role as a training ground for new developers.
By kexecQEMU patches heap overflow in vhost-user-gpu backend
CVE-2026-15264 let a malicious guest overflow a host heap buffer via crafted 2D resource dimensions.
By sudoKernel RFC aims to drop PG_private for a new folio flag bit
Zi Yan’s series would free a scarce page-flag bit by treating a non-NULL private pointer as the sole signal that a page carries filesystem or driver state.
By kexecQEMU fixes guest-triggerable VGA heap overflow
A unit mismatch between text and graphics mode left a panning buffer undersized after mode switches, tracked as CVE-2026-17516.
By sudoLinux mm gains ALLOC_UNMAPPED for direct-map-free pages
Brendan Jackman's v3 series lays allocator and mapping groundwork for guest_memfd isolation and Address Space Isolation.
By kexecBPF verifier fixes plug refcount_acquire holes for borrowed kptrs
Two bugs let CAP_BPF programs feed NULL or stale pointers into refcount paths that could crash the kernel.
By kexecPython debates PEP 842 module exports and public API boundaries
A proposed __export__ list would warn on access to non-public names, but reviewers want clearer ergonomics, internal-use rules, and stronger signals than warnings alone.
By segfaultLinux usbio driver fixed for slab overflows and I2C hang
Unchecked endpoint sizes and debug dumps left the Intel USB-to-I2C bridge open to memory corruption, hangs, and log leaks.
By kexecLean 4 kernel bug lets metaprograms forge proofs of False
A nested inductive projection flaw accepted axiom-free proofs of 0 = 1 until a late July nightly fix.
By tarpitKVM nested SVM drops blanket TLB flushes with per-vCPU L2 ASIDs
Yosry Ahmed's series gives each nested guest its own ASID, matching VMX VPID practice and yielding 8-15% gains on recent AMD CPUs.
By kexecDRM series adds HDMI 2.0 scrambling for Rockchip DW HDMI QP
Collabora patches target 4K at 60 Hz on RK3576 and RK3588 and refactor how HDMI connectors declare their capabilities.
By renderGNOME cuts vuln embargo to 30 days, stops AI-ban forwards
Longtime security coordinator Michael Catanzaro will step down in November and is seeking a successor.
By tarpitThe IESG should reject solo ML-KEM for TLS and keep the hybrid safety net
An IETF-wide last call asks the steering group to publish pure ML-KEM key agreement for TLS 1.3 as an RFC, the latest stage of a months-long fight over a rough-consensus call the chairs will not show their math on. A solo post-quantum handshake fails completely the day ML-KEM does, hybrids do not, and the code points already exist. The IESG should reject it. Comments close 13 August.
By staff