特朗普将于5月13日抵达北京，对中国作国事访问。14日上午双边会谈，下午参观天坛公园，晚宴。15日茶叙，午宴，离境。
在访华前，美国财长贝森特5月12日将访问日本，见高市早苗，然后5月13日在韩国首尔同何立峰团队会谈。
（新华社，南华早报）

Mythos finds a curl vulnerability

via daniel.haxx.se (author: Daniel Stenberg)

CVE-2024-YIKES：《关于一个病毒恰巧修了一个漏洞的那件事》

- 首先，这是一篇虚构文学！（目前还）不是实际发生的情况。
- 讲述了一个受供应链攻击影响的开源包如何在一系列偶然下被发现以至被修正的故事。
- 讽刺了软件工程领域不时会发生草台班子行为的现状。

nesbitt.io/~

seealso: HackerNews:48086082

#SupplyChain #Meme

🔴 Tanstack 系列包被骇。

- 约 42 个包的 84 个版本受到影响；Tanstack Query (@tanstack/react-query) 未受影响。 [1]
- 在 5/11 安装了受影响版本的设备可能也因此被骇。
- 恶意行为包括收集设备上的凭据，以及向设备用户维护的 npm 包加入恶意代码并重新打包发布等。
- 有用户称，恶意软件会在设备上持续运行，如果监测到其收集的 token 被 revoke，则会清空设备家目录。 [2]

tanstack.com/~

1. GHSA-g7cv-rxg3-hmpx
2. gh:TanStack/router#7383

#Tanstack

日本一名非二元性别申请人，要求将户籍中的称谓关系栏位变更不受男女区分限制的标示。大阪高等法院12日作出裁决，裁定现行强制区分男女的做法，与宪法第14条「法律之下人人平等」之精神相抵触。
https://news.web.nhk/newsweb/na/na-k10015119271000
https://www.nikkei.com/article/DGXZQOUF124W00S6A510C2000000/

nicole mikołajczyk 🔜 linux app summit ➡️ piwo ➡️ gpn (@mkljczk@fediverse.pl)

wdym utm_source=chatgpt.com? you needed chatgpt to link to a blog post?

https://pl.fediverse.pl/objects/00cd1c6d-c421-4672-9573-94a78cce191f

Sovereign Tech Fund invests over €1 million in KDE software development

Investment Amount: €1,285,200.00
Investment Year(s): 2026, 2027

https://kde.org/announcements/sovereign-tech-fund-invests-kde/

Linux 内核本地提权漏洞 Fragnesia 预警

网络安全团队 V12 近期披露了一个名为 Fragnesia 的 Linux 内核通用本地提权漏洞。该漏洞属于“Dirty Frag”类漏洞的新变体，主要利用 Linux XFRM 子系统中 ESP-in-TCP 模式的逻辑缺陷。攻击者通过构造特定 nonce 的 AES-GCM 密钥流，可实现对只读文件页面缓存的任意字节篡改。
实验证明，攻击者无需竞争条件即可将恶意代码注入 /usr/bin/su 等高权限程序的内存页，从而获取 root 权限。受影响范围涵盖 2026 年 5 月 13 日补丁发布前的多个内核版本。建议管理员及时更新内核或通过禁用 esp4/esp6 模块进行缓解，并在清理受影响机器时强制刷新页面缓存。

来源：V12Sec / POC

Fragnesia is a member of the Dirty Frag vulnerability class. This is a separate bug in the ESP/XFRM from dirtyfrag which has received its own patch. However, it is in the same surface and the mitigation is the same as for dirtyfrag.

It abuses a logic bug in the Linux XFRM ESP-in-TCP subsystem to achieve arbitrary byte writes into the kernel page cache of read-only files, without requiring any race condition.

The technique extends the page-cache write bug class that includes Dirty Pipe: when a TCP socket transitions to espintcp ULP mode after data has already been spliced from a file into the receive queue, the kernel processes the queued file pages as ESP ciphertext. The AES-GCM keystream byte at counter block position 2, byte 0 is XORed directly into the cached file page. By selecting the IV nonce to produce a desired keystream byte, any target byte in the file can be set to any value — one byte per trigger invocation.

The exploit builds a 256-entry lookup table mapping each possible keystream byte to its corresponding nonce, then iterates over a payload, firing the splice/ULP race for each byte that needs changing. It writes a small position-independent ELF stub (setresuid/setresgid/execve /bin/sh) over the first 192 bytes of /usr/bin/su in the page cache, then calls execve("/usr/bin/su") to obtain a root shell. The page cache modification is not backed to disk; the on-disk binary is untouched.

GitHub: https://github.com/v12-security/pocs

Subject: [PATCH net] net: skbuff: preserve shared-frag marker during coalescing

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 7dad68e3b..9c4e8d331 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -6200,6 +6200,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
          from_shinfo->frags,
          from_shinfo->nr_frags * sizeof(skb_frag_t));
   to_shinfo->nr_frags += from_shinfo->nr_frags;
+  if (from_shinfo->nr_frags)
+    to_shinfo->flags |= from_shinfo->flags & SKBFL_SHARED_FRAG;
 
   if (!skb_cloned(from))
     from_shinfo->nr_frags = 0;

https://lists.openwall.net/netdev/2026/05/13/79

修复补丁

https://lore.kernel.org/all/CANn89i+NMVb5EyfsLEfcBu=R+hrD2NPhrNSUwK3hHBWav68KhQ@mail.gmail.com/

目前尚未合并至 netdev/主线, 社区成员 Hyunwoo Kim <imv4bel@gmail.com> 提出该补丁未处理其他多处类似问题, 并额外提出一个补丁作为追加修复

https://lore.kernel.org/all/agRfuVOeMI5pbHhY@v4bel/

@POTUS
is officially wheels down in Beijing ahead of his historic Summit.

It's the first state visit of a sitting U.S. president to China since President Trump's last visit in 2017.
https://x.com/RapidResponse47/status/2054531743735017724

CVE-2026-46300

From: Linus Torvalds <torvalds-AT-linuxfoundation.org>
To: Willy Tarreau <w-AT-1wt.eu>
Subject: Re: [PATCH v2 2/3] Documentation: security-bugs: explain what is and is not a security bug
Date: Wed, 06 May 2026 08:46:07 -0700
Message-ID: <CAHk-=wi6z5BGUUT2p+=qrJg+obom8VnCo3MqB=7xp3Gw+UMMkg@mail.gmail.com>
Cc: greg-AT-kroah.com, leon-AT-kernel.org, security-AT-kernel.org, Jonathan Corbet <corbet-AT-lwn.net>, skhan-AT-linuxfoundation.org, workflows-AT-vger.kernel.org, linux-doc-AT-vger.kernel.org, linux-kernel-AT-vger.kernel.org, Greg KH <gregkh-AT-linuxfoundation.org>

I actually think we may want to go further than this.

I think we should simply make it a rule that "a 'security' bug that is found by AI is public".

Now, I may be influenced by that "my inbox is a disaster during the merge window" thing, but I do think this is pretty fundamental: if somebody finds a bug with more or less standard AI tools (ie we're not talking magical special hardware and nation-state level efforts), then that bug pretty much by definition IS NOT SECRET.

So why should be consider it special and have it be on the security list?

Yes, yes, I know - some people think that "security bugs are special". And I've been on the record before calling that opinion special - in the short bus sense.

Bugs are bugs. And not having them in public only makes them harder to deal with.

Do we want to make bugs with potential security impact harder to deal with? No. No, we really don't.

So I claim that the only reason for a security list is the non-public nature of the bug and the whole "responsible disclosure" argument.

But that argument is complete and utter garbage in the face of some mostly automated AI discovery (now, that argument is mostly a fiction in the first place, but I am not going to argue with people who have vested interest in making their special patches "security bugs").

To recap - I think this "document the scope of security bugs" is good, but I think we should go even further, and just document the fact that anything found by regular AI tools should just always go to public lists and is simply not special.

Linus

⚡️习近平举行仪式欢迎美国总统特朗普访华

BlockBeats 消息，5 月 14 日，中国国家主席习近平在北京人民大会堂东门外广场举行仪式，欢迎美国总统特朗普访华。特朗普已乘车抵达欢迎仪式现场。

原文链接 https://m.theblockbeats.info/flash/345860

🔴 NGINX http_rewrite 模块漏洞；或会导致堆溢出甚至远程代码执行。

- 漏洞的起因是 nginx 尝试将 escape 过的 URL 写入未 escape 长度的内存。
- 在 ASLR 未被开启的情况下，可以导致远程代码执行。
- 修复已于 1.30.1/1.31.0 发布。

1. https://depthfirst.com/nginx-rift
2. my.f5.com/~

CVE: CVE-2026-42945
CVSS: 9.2 (F5 Networks)
Affect: [0.6.27, 1.30.0]
Fixed-At: 1.30.1, 1.31.0

#nginx

Tor 0.4.9.7

Changes in version 0.4.9.7 - 2026-05-06
This is a security release fixing several major bugfixes that were reported
in the past weeks. Huge thanks to everyone that reported these issues! We
strongly recommend upgrading as soon as possible.

o Major bugfixes (cell handling):
- Fix out-of-bounds read (OOB) when END, TRUNCATE and TRUNCATED cell
have no reason in their payload. TROVE-2026-011. Found by Found by
Brian Carpenter (geeknik). Fixes bug 41254; bugfix
on 0.1.1.1-alpha.

o Major bugfixes (conflux):
- Do not attempt or accept BEGIN_DIR via conflux legs. TROVE-2026-
008. Credit to Anas Cherni from Calif.io in collaboration with
Claude and Anthropic Research. Fixes bug 41243; bugfix
on 0.4.8.1-alpha.

o Major bugfixes (conflux, relay):
- Adjust conflux out-of-order queue accounting when clearing a
queue. TROVE-2026-010. Found by aptupdate. Fixes bug 41251; bugfix
on 0.4.8.1-alpha.

o Major bugfixes (pathbias):
- Fix a client-side crash caused by double-close of a circuit while
under circuit queue memory pressure. TROVE-2026-009. Found by
cypherpunks. Fixes bug 41237; bugfix on 0.3.3.6-rc.

o Major bugfixes (relay):
- Fix null pointer dereference when receiving a CERT cell out of
order. TROVE-2026-006. Found by Fwame. Fixes bug 41240; bugfix
on 0.2.4.4-alpha.

o Major bugfixes (relay, onion service):
- Fix off-by-one out-of-bounds read if a malformed BEGIN cell is
received. TROVE-2026-007. Found by Flanagan. Fixes bug 41245;
bugfix on 0.2.4.7-alpha.

o Minor features (fallbackdir):
- Regenerate fallback directories generated on May 06, 2026.

o Minor features (geoip data):
- Update the geoip files to match the IPFire Location Database, as
retrieved on 2026/05/06.


https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.7/ReleaseNotes#L5

武汉大学取消公众进校预约制度

5 月 13 日，武汉大学正式取消社会公众进校预约制度。公众凭本人身份证即可从珞珈门、弘毅门步行入校，工作日和节假日均开放，2023 年 7 月以来的预约入校模式结束。校方表示，希望借此进一步服务社会、促进校园资源共享。在保障教学秩序不受影响的前提下，有序开放校园也被视为公立高校的责任，并有助于减少高校与社会之间的隔阂。

澎湃新闻

🌸 在花频道 · 茶馆讨论 · 投稿通道