$ cat pytorch/week/2026-10-05.log
the week in review · Oct 5 – Oct 11, 2026
torch.compile dtype fix, two Arm CVEs patched
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Executorch closed CWE-125 in the Arm VGF decoder and CWE-22 in the Arm backend during the same week TorchTitan's RL losses turned out to be silently mis-scaled.
Arm backend: Fix for security bug reported by Metis, CWE-125 (#23363) pytorch/executorch
Metis reported that "Table decoder pointers are derived from header-provided offsets before the header is validated, so malformed VGF offsets can point outside the vgf_data buffer." The fix validates the header before pointer derivation; any deployment accepting untrusted VGF models should pick it up.
Arm backend: Fix Metis bug in backend.py, CWE-22 (#23485) pytorch/executorch
A second Metis report against the Arm backend, this one a path-traversal class bug in backend.py, closed the same week. Both landed in Executorch.
[primtorch] Fix mixed-dtype aten.normal decomposition (#194557) pytorch/pytorch
Under torch.compile, torch.normal(mean, std) returned the wrong dtype whenever mean and std were different floating dtypes, for example FP16 mean with FP32 std. The primtorch decomposition now matches the FP16 that eager and native ATen produce, so compiled and eager runs agree.
[rl] Apply the sampling temperature to generator and trainer logprobs pytorch/torchtitan
The RL recipes sampled tokens at a temperature T (alphabet_sort uses 0.8) but computed both vLLM's and the trainer's logprobs as log softmax(logits), so every policy-gradient update was scored against a distribution the tokens did not come from. If you trained with these recipes, the gradients were wrong in a way no loss curve would show.
[cudagraph] Support non-deferred gradient accumulation (#5050) pytorch/torchtitan
TorchTitan captures the whole forward/backward accumulation loop as one CUDA graph, but the wrapper rejected more than one outer accumulation group unless FSDP gradient reduction was deferred. Non-deferred gradient accumulation now works inside the graph.
Report every mapped segment in a per-pool memory snapshot (#199845) pytorch/pytorch
memory_snapshot dropped valid segments that followed an unmapped hole, which does not occur in normal growth but does in release_blocks. Per-pool snapshots now report every mapped segment.
[Feature] Apply load_memmap mode to memmap directories pytorch/tensordict
load_memmap(..., mode=...) applies to memmap directories, not just archives: "r" maps every file copy-on-write so in-place writes stay in memory, "r+" maps every file shared and raises PermissionError on a non-writable file. Note that the default mode changed.
[Vulkan] Keep reductions the reduce shaders cannot handle on CPU pytorch/executorch
The partitioner accepted empty dim lists and full sum/mean reductions over N-D inputs that the general reduce shader cannot handle, producing build failures or wrong reductions. Those cases stay on CPU. Texture storage folding batch into channels also breaks 4D reductions over dim 0, another case now routed away from the shader.
$ ls pytorch/week/ # the briefings behind this review
Keep up with PyTorch in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.