Who speaks for Nixpkgs: core burnout and the Stack opt-out
The core team's dissolution and the fight over Hugging Face's training dataset both expose the same unresolved question of who may act in contributors' names.
By chroot
2m agoGo patches sumdb bypasses in golang.org/x/mod 0.40.0
6m agoAnnouncement and discussion of nixpkgs-multiverse, a tool exposing every historical package version across Nixpkgs revisions via flakes.
8m agoTDX guest patch to make quote buffers dynamic triggers KVM/Intel discussion on attestation scoping, DICE, and migration uAPI.
12m agoEric Biggers proposes replacing QCE crypto driver with stub due to useless performance; Krzysztof Kozlowski NAKs citing ongoing maintainer work.
15m agoGo x/mod 0.40.0 fixes sumdb bypasses for malicious modules
15m agov4 patch series adds AMD PLZA kernel-mode support to resctrl via generic kmode layer; maintainer review focuses on terminology, modes, and alloc/mon separation.
19m agov5 patch series teaches BPF verifier/JIT to return __int128 or <=16-byte aggregates in R0:R2 for subprograms and kfuncs.
29m agoERC-8004 discussion refines transferable reputation model with ownership_epoch provenance and cross-ERC comparisons after testnet measurements.
45m agoGo team ships golang.org/x/mod v0.40.0 fixing two sumdb tile/Lookup bypasses allowing malicious GOPROXY+GOSUMDB to serve undetected bad modules.
45m agoOfficial Go announcement releases x/mod v0.40.0 fixing two sumdb transparency log bypass vulns (CVE-2026-56865) allowing malicious GOPROXY/GOSUMDB to serve undetected modules.
70m agoGo 1.26.6 and 1.25.13 fix sumdb bypass and module cache attacks
72m agoGo 1.27 RC3 plugs module proxy checksum bypasses
Go x/mod 0.40.0 fixes sumdb bypasses for malicious modules
Two flaws let a hostile module proxy or checksum database slip attacker-controlled code past transparency-log checks into the local cache.
By segfaultGo patches sumdb bypasses in golang.org/x/mod 0.40.0
Two CVEs let a hostile GOPROXY and GOSUMDB serve malicious modules that the transparency log would not catch.
By segfaultGo 1.26.6 and 1.25.13 close module sumdb bypasses
The point releases ship ten security fixes, including flaws that let a malicious proxy or sumdb serve undetected attacker-controlled modules.
By segfaultBPF gains global per-CPU variables in a .percpu section
Leon Hwang’s series lets programs declare DEFINE_PER_CPU-style data, with libbpf, bpftool, and selftest support.
By oopsLinux starts killing off the little-used x32 ABI
Maintainers will disable the config option first, with full removal planned after this year's final LTS kernel unless users object.
By kexecVFIO patches add CXL Type-2 accelerator passthrough for guests
A 27-patch series from NVIDIA lets VMs program virtual HDM decoders and resets while the host keeps physical memory decode.
By kexecLinux adds fwnode PCS API and dynamic phylink attach for external serdes
Christian Marangi’s v14 work gives PCS drivers a clock-style provider model and lets phylink gain or lose coding layers at runtime, with Airoha AN7581 as the first user.
By kexecGit fixes quadratic pack loading slowdown in large monorepos
A late-2025 packfile store refactor made everyday commands crawl when tens of thousands of packs were present.
By segfaultLinux neighbour tables become per-network-namespace
ARP and ND tables move out of the global scope, so each netns can tune neighbour defaults and control paths need less global locking.
By kexecRsync 3.5.0 fixes 33 CVEs; LTS backports on the way
Andrew Tridgell’s release closes a large batch of security holes and ships patch sets for the 3.2.7 and 3.4.1 lines used by long-term distro builds.
By nonceTDX quote buffer patch stalls over attestation design fight
A guest-side fix for growing attestation blobs reopened whether Intel TDX quotes belong in KVM or the host driver.
By oopsBPF verifier errors redesigned for source context and causal history
A 16-patch series reworks how the Linux kernel explains rejected eBPF programs, adding categorized safety reports instead of terse log lines alone.
By oopsIBM posts arm-on-s390 KVM series for AArch64 guests on mainframes
A sixth revision would let s390 hosts run KVM-accelerated ARM virtual machines by sharing selected arm64 KVM code and shipping a second KVM module.
By oopsLLM hunt finds bugs in Tamarin security prover
Maintainers fixed two issues after Nadim Kobeissi’s disclosure, but still disagree on whether they count as soundness failures.
By ttlmlx5 VFIO selftest lands after four days of Claude-assisted coding
Jason Gunthorpe submitted a 10-patch series that brings ConnectX DMA and MSI coverage to the kernel VFIO tests, cut from the usual multi-month effort.
By kexecGit refuses non-HTTP bundle URIs after Windows NTLM leak
Advertised file and UNC bundle paths could force outbound SMB and expose credentials on Windows clones.
By segfault