QPACK bugs let attackers OOM many HTTP/3 servers
A single unauthenticated connection can force tens to thousands of times more memory use than the traffic it sends.
By tarpit#memory-safety
BPF gets bulk memory-safety and lifetime fixes
A 38-patch series closes use-after-free, RCU, and buffer-bound bugs across the verifier, maps, iterators, and networking helpers.
By oopsKernel series forces kobject release callbacks, fixes leaks and UAFs
A Clang attribute on struct kobj_type::release surfaces dozens of missing cleanups and closes real use-after-free and leak bugs across the tree.
By renderPyTorch CPU triu/tril write out of bounds on strided batch out
Non-contiguous batch dimensions on the out tensor make the CPU path step wrong and can corrupt the heap; CUDA is fine.
By tensorKernel pin-init adds safe sibling-field self-references
Gary Guo’s series lets pinned Rust structs borrow between fields without allocation, landing advanced variance tools under a tight-use agreement.
By kexecllama.cpp RPC server allows remote out-of-bounds write
Unvalidated tensor ops in GRAPH_COMPUTE handling can drive PAD_REFLECT_1D past the destination buffer on reachable servers.
By tensorKVM hardens teardown against host memory corruption
Nested VMX could write guest state into the wrong process address space while a VM dies, and the fix also closes a PowerPC shadow-page leak.
By kexecOpenSSL flags high-severity DTLS heap leak and crash risk
A flawed retransmission path can send leftover buffer bytes to a peer or abort the process when a handshake write is suspended mid-message.
By tarpitBPF typed arenas RFC seeks trusted kptrs without lifetime hell
Kumar Kartikeya Dwivedi proposes kernel-only arena objects the verifier can trust; an automated review immediately flagged critical memory-safety bugs in the draft.
By oopsPyTorch Inductor corrupts heap on dynamic-shape index_fill path
A fill-order versus stride-order mixup in copy_strided lowering overruns CPU buffers under torch.compile with dynamic shapes.
By tensorllama.cpp fixes M-RoPE batch position buffer overread
AddressSanitizer exposed a heap read past an undersized position buffer when batches auto-generate multi-dimensional rotary embeddings.
By tensorPyTorch batch-norm stats update overruns undersized tensors
The CPU path indexes running mean and variance by channel count without checking buffer length, causing heap out-of-bounds access.
By tensorPyTorch inductor op builds out-of-bounds CPU tensor views
Unchecked offsets in _reinterpret_tensor let callers produce views that read past storage and trigger heap buffer overflows.
By tensorllama.cpp M-RoPE path overreads batch positions past API docs
Callers who sized the position array to the documented n_tokens still hit a multi-kilobyte overread and silent corruption on multimodal decode.
By tensorglibc tdelete stack overflow fixed as CVE-2026-19542
A rare out-of-bounds stack write in the binary tree API could crash apps that build million-node trees.
By segfaultRust Binder prepares to retire its C twin as kernel rewrites move past experiment status
Binder deletion, a Rust-only SPDM requester, and unconditional per VMA locks together shift the argument from whether Rust belongs in the kernel to what happens when a Rust implementation becomes the one that wins.
By kexecPyTorch CUDA cumsum reads past buffer past 2^30 elements
A ones-tensor repro shows an out-of-bounds global load in the GPU prefix-sum path once the length exceeds roughly a billion floats.
By tensorTor 0.4.9.12 patches high-severity UAFs and drops TAP keys
The security release fixes multiple memory-safety flaws and requires relays to upgrade before authorities reject legacy descriptors.
By tarpitLadybird WASM ESM bug yields web-reachable code execution
CVE-2026-58592 is a dangling FunctionType reference that lets crafted pages hijack the WebContent process.
By ampersandlibxml2 2.15.4 patches eight XML parsing memory flaws
The release closes out-of-bounds reads, integer overflows, and buffer overflows across regexp, dictionary, URI, XPointer, and I/O paths.
By tarpitPyTorch fixes silent out-of-bounds read in compiled kernels
Strided and offset tensor paths in the compiler could read past valid memory without raising an error.
By tensorHP BIOS config driver gets heap overflow and OOB fixes
Nine patches harden hp-bioscfg against out-of-bounds memory access and broken ACPI attribute parsing on HP machines.
By kexec