Linux Kernel & FOSS CVE Threat Radar

As some interesting food for thought and weekend forum discussions, this week at the Linux Plumbers Conference in Prague, Qualcomm engineer Khem Raj questioned the relevance of.

The Traffic Light Protocol (TLP)[1], which is now in its second incarnation, is a wonderful standard that enables one to easily communicate whether information may be shared further (and if so, how far)..

The Stable channel is being updated to OS version 16805.33.0 (Browser version 154.0.8037.151) for most ChromeOS devices.

On Wednesday I spent a day fishing, on a small boat out of Gloucester, MA.

While many developers are struggling to keep up with the flood of vulnerability reports, others are still focused on preventing those reports from happening in the first place.

Several security issues were discovered in the Linux kernel.

It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers.

It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference.

A security advisory reported by SANS Internet Storm Center exposes critical vulnerability vectors.

greSQL JDBC team has released a security release for 2 CVE's CVE-2026-107314 and the GitHub Security Advisory GHSA-rhp9-mr79-r74h and CVE-2026-107315 and the GitHub Security Advisory GHSA-f64h-wr5q-3qf3 See the release notes for details

This essay was written with Seva Gunitsky, and originally appeared in Foreign Affairs .

Apple just released a system called “Reference Image.” It can verify the image is exactly as taken by an iPhone—new models only—without tying it to a specific iPhone or photographer.

Welcome to Dolphin 2609's accompanying Progress Report!

Summary In this episode of What’s in the SOSS’ “Big Thoughts, Open Sources,” host CRob sits down with Vincent Danen, Vice President of Product Security at Red Hat, for a deep dive into the evolving landscape of open source vulnerability disclosure.

Project Zero often works with software vendors to remediate the vulnerabilities we report and provide broader guidance on making software more secure.

Version: 6.18.55 (longterm) Released: 2026-10-03 Source: linux-6.18.55.tar.xz PGP Signature: linux-6.18.55.tar.sign Patch: full ( incremental ) ChangeLog: ChangeLog-6.18.55

"Wuthering Heights" by Emily Brontë - good writing, but the protagonists are quite something.

September brings a commitment to sustainable package registries, practical Cyber Resilience Act (CRA) guidance, new community security work, and three conversations on AI, regulation, and dependency risk.

Security This release addresses CVE-2026-94603 , where a podman run on a checkpoint image (any image with the io.podman.annotations.checkpoint.runtime.name annotation) could disable all sandboxing, including sandboxing specified by the user, when the container was created.

With the rise of AI in the security space, our team created the GitHub Security Lab Taskflow Agent as a way for security researchers to easily automate, package, and share the AI prompts and workflows that they find effective for their work.

This is a development prerelease from the 1.19.x series.

This is a development prerelease from the 1.19.x series.

Threshold signature schemes, a form of multi-party computation (MPC) that lets a set of parties sign together without any one of them holding the key, are increasingly deployed inside trusted execution environments (TEEs).

Born out of academia and raised in corporate IT departments, the Security Assertion Markup Language (SAML) authentication protocol continues to be a staple in these organizations.

This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804 , that I and 14 others reported.

We’re happy to announce the release of GIMP 3.2.6 !

Summary Bump React DevTools from 7.0.1 to 8.0.0 (packages + extension manifests only; no publish).

Many security bugs are race conditions, where multi-threaded execution has to occur with the right interleaving for a negative effect to appear.

Wine-Wayland Changes Updated the Wine bleeding-edge base twice and imported/rebased the latest EM11 Wine-Wayland series: 3e5f91e ( 3e5f91e ), 0c63e18 ( 0c63e18 ), 061e2df (.

Check the changelog here . Warning This release fixes critical security vulnerabilities affecting both the client and server. We advise everyone to upgrade immediately .

A standard patch release backporting some fixes from main on top of 0.56.2.

At GitHub Security Lab, we spend a lot of our week talking to maintainers.

Thanks to the work of the Security Developer-in-Residence Seth Larson, the Python Security Response Team (PSRT) now has an approved public governance document (PEP 811).

This is a patch release which lowers the GLIBC requirements of the release artifacts published to GitHub.

The Pixel 8 hardware (Tensor G3) supports the ARM Memory Tagging Extension (MTE), and software support is available both in Android userspace and the Linux kernel.

As part of the continuing work to replace 1-element arrays in the Linux kernel, it’s very handy to show that a source change has had no executable code difference.