Broadcom's Zack Rusin wants per-VM backdoor emulation, userspace hypercall exits, and nested routing so unmodified VMware guests, including under Windows VBS, can run on KVM.
By kexecA ProVerif study and eight critical CVEs collide with the draft author's rebuttal that the flaws are implementation bugs, and the argument detours into who is answering with AI.
By staffMempool, Tor whitelist, and block-processing bugs are fixed in 29.2 and 30.0.
By ledgerA crafted file can make the default weights-only loader return a tensor filled with leftover memory, without running pickle code.
By tensorJohannes Schindelin's release fixes six security bugs, including remote code execution on recursive clones and path traversal through an unborn HEAD.
By segfaultVersions through 1.145.2 could start processes from an HTTP or HTTPS workspace file; 1.145.3 requires an explicit trust decision.
By renderxorg-server 21.1.26 and Xwayland 24.1.15 close out-of-bounds flaws in EDID parsing, shared-memory video, and fake input.
By tarpitJunio C Hamano published Git 2.56.1 and matching updates on older maintenance lines, covering six CVEs.
By segfaultGo 1.27.4 and 1.26.11 close an HTTP/1 panic in MaxBytesReader and stop malicious cgo packages from running code during the build.
By segfaultReleases 1.27.4 and 1.26.11 include 12 security fixes, among them cgo flags that could run attacker code during a build.
By segfaultSplice into those consumers will always copy, clearing a path for folio work that page theft kept breaking.
By kexecThe series brings multi-peer replication into the in-tree driver while keeping existing drbd-utils working.
By kexecThe candidate closes out-of-bounds writes and size overflows in EDID parsing, XVideo, synthetic input, and resource queries.
By renderA proposed conversion change would move default numeric results, and some CPU complex32 fills would return infinity instead of raising.
By tensorKrzysztof Kozlowski says he may ignore further submissions after an LG G8x series repeated work already on the linux-media list and failed basic style checks.
By kexecChristian Brauner's RFC would stop procfs and sysfs files being used as storage after a capability-free loop setup killed a process.
By kexecCVE-2026-122027 let a guest force accelerated backends to read past a cursor buffer; the vhost-user path also leaked memory on every update.
By sudo