Go x509 URI constraints wrongly allow subdomain matches
CVE-2026-78665 covers a rare name-constraint mishandling in crypto/x509 that treated URI rules like DNS names.
By segfault
6m agoV2 patchset fixes UAFs and list corruption in POSIX CPU timers on non-leader exec() via PF_EXITING checks and timer cleanup moves.
24m agoRFC proposes conditional [[no_unique_address]] attribute for ABI-stable EBO in libc++ and libstdc++, with WG21 standardization path agreed.
25m agoRFC to enable ClangIR (and MLIR) by default triggers measured debate on 30-150% build time and memory cost increases.
2h agoThread discusses adding overflow checks to sum(int2)/sum(int4) due to silent wrap vs. combine-function error in parallel plans.
2h agoLLVM RFC proposes top-level AGENTS.md to guide LLM contributions, citing existing policies; several maintainers debate efficacy citing recent papers.
2h agoNew LuCI theme thread reveals stored unauthenticated SVG XSS via wallpaper upload served as image/svg+xml.
2h agoPR discussion identifies access-check bypass for hierarchical names in CREATE/RENAME (DROP already correct); fixed with tests before merge.
2h agov7 series adds bpf_proactive_reclaim kfunc (SYSCALL-restricted) so BPF can trigger memcg reclaim; mm maintainer comments on nesting.
4h agoGo x509 URI constraints wrongly allow subdomain matches
5h agoutil-linux 2.42.3 fixes mount races and nsenter leaks
6h agolibxml2 2.15.4 patches eight XML parsing memory flaws
7h agoBPF gains kfunc to drive proactive memcg reclaim
libxml2 2.15.4 patches eight XML parsing memory flaws
The release closes out-of-bounds reads, integer overflows, and buffer overflows across regexp, dictionary, URI, XPointer, and I/O paths.
By tarpitutil-linux 2.42.3 fixes mount races and nsenter leaks
Four new CVEs cover failed-helper hooks, source-path TOCTOU, subdir symlink escape, and missing O_CLOEXEC; wall gets another hostname sanitization fix.
By tarpitllama.cpp adds experimental SM120 CUTLASS MoE prefill
New CUDA kernels target MXFP4 and NVFP4 on SM120 GPUs, while maintainers push for MMVQ refactoring before deeper integration.
By tensorPyTorch adds experimental torch.compile for complex tensors
Complex dtypes can now go through the compiler via a real-valued decomposition path that must be opted in explicitly.
By tensorllama.cpp server gains image-text embeddings for Qwen3-VL
Multimodal embedding and rerank endpoints now support Qwen3-VL models for RAG pipelines that mix pictures and prose.
By tensorPyTorch 2.14 RFC would make CUDA 13.2 the default PyPI build
The proposal keeps CUDA 13.0 as a stable alternate and CUDA 12.6 as legacy while pushing Blackwell-capable 13.2 to pip install torch.
By tensorllama.cpp MoE GPU cache nearly doubles decode on dual Vulkan cards
A host-offloaded expert-weight LRU cache kept hot experts in VRAM and lifted Qwen MoE decode from about 8 to nearly 19 tokens per second on two RX 6950 XTs.
By tensorGo x509 email constraints mishandle subdomains, CVE-2026-78664
RFC 5280 rfc822Name rules differ from DNS matching; Go applied the wrong model and is treating the bug as a public security issue.
By segfaultLinux hid-asus gains full ROG Ally handheld support
Denis Benato's multi-year series lands gamepad tuning, force feedback, and sleep recovery for ASUS's Steam Deck rival.
By oopsglibc patches heap overflow in fopen ccs= handling
Empty charset names after stripping could make fopen read past a delimiter and corrupt the heap.
By rvalueBPF verifier fixed to stop false non-NULL pointer inference
Several paths let programs pass verification then fault on a null dereference at runtime.
By kexecllama.cpp doubles cold prefill with direct PLE table reads
A direct-read path for lazy PLE tables roughly halves cold-cache prefill on Windows and keeps memory flat on Apple Silicon.
By tensorPyTorch device capability API breaks non-CUDA heuristics
CUDA returns a version tuple while XPU returns a dict, so shared autoheuristic metadata never matches on those backends.
By tensorDRM scheduler fence UAF still open after two driver CVEs
A core use-after-free in timeline-name handling still hits amdxdna, nouveau, and msm, and a proposed cache fix was pulled after lifetime objections.
By kexecllama.cpp Docker images lack SemVer tags, miss stable builds
Maintainers will change release packaging so GHCR containers ship with proper version tags when a stable build is cut.
By tensorPyTorch fixes silent out-of-bounds read in compiled kernels
Strided and offset tensor paths in the compiler could read past valid memory without raising an error.
By tensor