Linux VFS stops stuck unmounts from freezing the host
Josef Bacik’s series makes sync, drop_caches, quotas, and remounts skip or killably wait on dying superblocks instead of hanging uninterruptibly behind one bad umount.
By oops#containers
Kernfs patch ends multi-minute cgroupfs stalls under OOM
Meta moves inode allocation off the shared kernfs lock after fleet hangs that blocked oomd and init while memory-max containers reclaimed.
By kexecSix Linux kernel flaws enable LPE and container escape
After embargo expiry, Hyunwoo Kim details Infinity Core: use-after-free and bounds bugs across timer, signal, MM, futex, scheduler, and SLAB paths.
By tarpitSPARC64 gains Linux seccomp filter support
The architecture was one of the last without the BPF sandboxing Docker, systemd, and Flatpak rely on.
By kexecWindows kubectl cp path traversal lets containers write arbitrary files
CVE-2026-19444 is a medium-severity flaw in several kubectl release lines that only affects clients running on Windows.
By sudoKubernetes patches StatefulSet flaw allowing cross-namespace pods
CVE-2026-2270 lets users with namespace-scoped StatefulSet and ControllerRevision write access create pods outside their namespace.
By cronjobllama.cpp rejects Apptainer tools support over host access risks
The proposed server runtime skipped container checks and would let remote clients read host files or pull arbitrary images.
By tensorllama.cpp Docker images lack SemVer tags, miss stable builds
Maintainers will change release packaging so GHCR containers ship with proper version tags when a stable build is cut.
By tensorBubblewrap 0.12.0 stops symlink writes outside the sandbox
The fix closes a setup-time traversal that could let a malicious app image plant files on the host via Flatpak and similar tools.
By nonceOpenZFS on Linux full-disclosed for zpool and userns escapes
Researcher Erica Windisch publicized flaws she says let unprivileged users manipulate pools and break out of user namespaces, after notifying CERT.
By tarpitLinux SCTP bug lets local users hit root and escape containers
A use-after-free in Dynamic Address Reconfiguration, CVE-2026-64564, has been fixed after more than a decade in the tree.
By tarpit