ParticleDB's Jepsen report, Lenovo's fingerprint USB stick, Karpathy's HackerTube and the Linux TCP bug CVE-2026-98432: four developer stories in one Daily Diff

What this video covers

• Jepsen, the database testing lab run by Kyle Kingsbury, published its analysis of ParticleDB on October 31, 2026. ParticleDB is a Rust database from Orkes aimed at AI agents; Orkes funded the work. Jepsen tested versions 1.1.4 through 1.1.18.11.rc-22 on a single node and presents 96 issues, most of which needed one server, one client and no faults. Examples in the report: a WHERE 4 = 5 clause returned rows with primary key 5, WHERE TRUE matched nothing, and an UPDATE could leave multiple rows with the same primary key.
• The ParticleDB home page advertised 'Full ACID. 159K TPS.' and a TLA+ proof, but Jepsen says no TLA+ specification was available during the collaboration, and the text under 'Full ACID' said snapshot isolation. In 1.1.18.11.rc-22, the last version Jepsen tested, the default occ transaction mode still lost committed writes during normal operation, and the strictest serializable mode allowed Lost Update after process kills. Orkes says version 1.1.19-rc.13 resolves all remaining issues; Jepsen has not evaluated it and recommends that users halt further deployment of ParticleDB and migrate to other databases.
• Security researcher Xusheng Li found that the Lenovo ThinkPlus FU100 fingerprint USB stick, marketed as hardware encrypted with AES-256, contained a plain SD card whose data was not encrypted; the fingerprint reader only switched the USB connection on. He reported it on August 2, 2025, and Lenovo's first fix was a layer of epoxy over the SD card. Lenovo rated its advisory high, and a later fix for the FU100 and related drives requires calling a service line in China, then a replacement or on-site firmware upgrade, per Tom's Hardware.
• In a follow-up reported by Tom's Hardware, Li used OpenAI's Codex with his employer's reverse engineering tool against other makers' USB protection software; Netac's took about seven minutes because it had a fixed key built in and wrote the password to diagnostic logs, and another vendor's drive had two hidden accounts that Li calls backdoors. For data on a USB stick, encrypt files with software you control before they reach the device.
• On October 31, 2026 Andrej Karpathy described HackerTube, a YouTube-style site at hackertube.org built with his coding agent in about two hours. The agent downloaded Hacker News comments, filtered spam and kept about 40,000 that recommend a YouTube video, yielding 6,454 videos from 2007 to 2026 across 150 topics. The site shows the frame at the 50 percent mark instead of the uploaded thumbnail. Karpathy lists his manual steps as a Google Cloud API key, a server and a domain.
• CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP handshake, scored CVSS 9.8, reachable by a remote peer without login. Eric Dumazet's fix replaced two plain kfree calls with kfree_rcu in a commit dated October 1; stable kernels with the fix shipped on October 11 and 15, and the bug goes back to Linux 4.4. Red Hat raised its rating from Important to Critical on October 30. Ubuntu and Red Hat Enterprise Linux listed no fixed kernel on Saturday evening, October 31. Install your distribution's fixed kernel and reboot, including container hosts, because containers share the host kernel.
• Anthropic says Claude wrote a working exploit for Linux servers with a multipath TCP listener, and that in its proof of concept it takes 48 minutes to leak a kernel pointer and five more minutes to run a shell command; the exploit is not published. The Go Security Team notes that Go programs enable multipath TCP listeners by default since Go 1.24 and warns that systems without that listener may be vulnerable to similar attacks. Red Hat and AlmaLinux publish a firewall rule that drops IPv4 TCP packets with IP options, which Red Hat says reduces exposure and does not fully prevent exploitation.

Transcript

Cold open: how does a where clause say four equals five?

0:00 A database that advertises Full ACID is supposed to keep what you write. Jepsen tested one and found ninety six issues, including a where clause that said four equals five and still returned rows. In this video, four stories. What did Jepsen find in a database that claimed Full ACID? What was inside a fingerprint USB stick sold as encrypted? What did Andrej Karpathy build in one morning? And what do you patch for a Linux networking bug?

0:26 One of those bugs comes with a stopwatch. I will read it to you at the end. It's Sunday, November first, and this is The Daily Diff. Jepsen is Kyle Kingsbury's testing lab. It runs a database through real workloads and failures and checks whether the guarantees on the website hold. Think of an inspector who actually opens the fridge.

Story one: what did Jepsen find in ParticleDB?

0:44 Story one. On Saturday Jepsen published its report on ParticleDB, a Rust database from Orkes aimed at AI agents. Orkes paid for the work. The home page said Full ACID, one hundred fifty nine thousand transactions per second. Jepsen tested ParticleDB from its first one point one build to a late release candidate. The site called it formally proven, with a TLA plus proof. Jepsen says no TLA plus specification was available during the work.

1:10 Under the Full ACID line, the same page said snapshot isolation, which is not fully isolated. The bugs were not subtle. Most needed one server, one client and no failures injected. A where clause that said four equals five returned rows. A where clause that said true matched nothing. Updates left two rows with the same primary key. The last release Jepsen tested, release candidate twenty two,

1:36 was much safer. Even so, the default transaction mode lost committed writes during normal operation. The strictest mode still allowed lost updates after a process kill. Orkes says its next release fixes all of this. Jepsen has not tested it. So in that last release a database that promised Full ACID could lose a write it had already committed. The speed, I assume, was excellent.

2:00 Jepsen's advice is plain. Halt further deployment of ParticleDB and migrate to another database as soon as possible. Orkes blames a spring refactor and says its own customers, on an older version, were likely unaffected. The stored procedure docs even invented an email address for Kyle Kingsbury. Story two. The Lenovo ThinkPlus FU one hundred is a fingerprint USB stick

Story two: what was inside the Lenovo fingerprint USB stick?

2:21 marketed as hardware encrypted with AES two fifty six. Security researcher Xusheng Li took one apart and found an ordinary SD card, with nothing on it encrypted. The fingerprint reader decided one thing, whether the stick connected to the computer. The files on the card never depended on it. Li reported the flaw to Lenovo in August twenty twenty five. The first fix was a layer of epoxy over the SD card. So the files were never encrypted.

2:47 Wait, it is just an SD card? Always has been. Lenovo rated its own advisory high. The later fix, for the FU one hundred and three related drives, means calling a service line in China, then either sending the drive back or getting an on-site firmware upgrade. Lenovo advises wiping the drive first. Last week Li pointed OpenAI's Codex, plus his employer's reverse engineering

3:09 tool, at other makers' USB protection software. Netac's took about seven minutes, because it had a fixed key built in and wrote the password to diagnostic logs. One drive had two hidden accounts that Li calls backdoors. If a drive's security is the hardware, check it yourself. Encrypt the files with software you control before they reach the stick, and treat the fingerprint as a convenience.

Story three: what did Karpathy build in one morning?

3:31 Story three, the light one. On Friday night Andrej Karpathy opened YouTube, saw what he called an enshittified wall of slop, and on Saturday morning told his coding agent to build a replacement from whatever Hacker News recommends. The agent downloaded the Hacker News comments, filtered out spam, and kept about forty thousand that recommend a YouTube video. That left six thousand four hundred fifty four videos, from two thousand seven to now, in a hundred fifty topics.

3:58 The site is hackertube dot org. It shows the frame from the halfway mark instead of the thumbnail the uploader chose, which stings a little. Karpathy says the whole build took about two hours. His only manual steps were a Google API key, a server and a domain. On October twelfth I told you Karpathy thinks access and tasks create a gap in how people understand these tools. Two hours of work is a decent data point.

4:21 Story four, the one to act on.

Story four: what do you patch for CVE-2026-98432?

4:23 CVE twenty twenty six, ninety eight four thirty two is a use-after-free in the Linux kernel's I P v four TCP handshake, scored nine point eight out of ten. A remote peer with no login can reach it. Eric Dumazet wrote the fix on October first. The fix reached stable kernels on October eleventh and fifteenth, and the bug goes back to Linux four point four. Red Hat raised its rating from important to critical on October thirtieth. On Saturday evening, Ubuntu and Red Hat Enterprise Linux still listed no fixed

4:52 kernel. Anthropic says Claude wrote a working exploit for servers with a multipath TCP listener, and Go programs have opened those by default since Go one point twenty four. The Go team warns that systems without that listener may be vulnerable to similar attacks, and says the best fix is a patched kernel. If your distribution has no fixed kernel yet, Red Hat and AlmaLinux publish a firewall rule that drops I P v four TCP packets carrying IP options. Red Hat says it reduces exposure and cannot fully prevent it.

5:23 After that, you wait. What to do today. Install your distribution's fixed kernel and reboot, on container hosts and Kubernetes nodes too, because containers share the host kernel. Debian, Suse and Amazon Linux already have fixes. If you cannot patch yet, start with hosts that run multipath TCP listeners. Now the stopwatch I promised.

Back to the stopwatch: how long did the exploit take?

5:44 In Anthropic's own proof of concept, it takes forty eight minutes to leak a kernel pointer, then five more minutes to run a shell command. Anthropic has not published the exploit. If you'd rather read this than hear me say it, the diff lands in your inbox every morning, free at the daily diff dot dev, link below.

Verdict: REVERT

6:02 So today's verdict is REVERT. I'd revert ParticleDB, because Jepsen's advice is to halt deployment, and I'd patch that kernel, because it comes with a stopwatch. And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.

Sources

1. Jepsen: ParticleDB 1.1.4 (Kyle Kingsbury, October 31, 2026)Jepsen
2. Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy caseTom's Hardware
3. Lenovo ThinkPlus Fingerprint USB Drive Sold as Encrypted Was a Plain SD Card InsideHackingPassion
4. HackerTubeAndrej Karpathy
5. CVE-2026-98432Ubuntu Security
6. RHSB-2026-016: Use-after-free - kernel IPv4 (CVE-2026-98432)Red Hat
7. ipv4: free inet_opt and ireq_opt after an RCU grace periodLinux kernel (Eric Dumazet)
8. Discovering and exploiting vulnerabilities in critical, real-world software with ClaudeAnthropic
9. Protecting against CVE-2026-98432 when using Go programsGo Security Team via oss-security
10. Linux's October 2026 TCP Use-After-Free: CVE-2026-98432Atlas