LWN.net

The6.14.3,6.13.12, and6.12.24 stable kernel updates have beenreleased; each contains another set of important fixes. Note that the6.13.x series ends with 6.13.12.

The New Stack looksat EU OS, an attempt to create a desktop system for the European publicsector.

The final session in the memory-management track of the 2025 Linux Storage,Filesystem, Memory-Management, and BPF Summit was a brief, last-minuteaddition run by Kalesh Singh. The kernel's readahead mechanism isgenerally good for performance; it ensures that data is present by the timean application gets around to asking for it. Sometimes, though, readaheadcan go a little too far.

Adding tracepoints to some kernel subsystems has been controversial-ordisallowed-due to concerns about the user-spaceABI that they might create. The virtual filesystem (VFS) layer haslong been one of the subsystems that has not allowed any tracepoints, butthat may be changing. At the 2025 Linux Storage, Filesystem, MemoryManagement, and BPF Summit (LSFMM+BPF), Ted Ts'o led a discussion aboutwhether the ABI concerns are outweighed by the utility of tracepoints forthe VFS.

Security updates have been issued by Debian (graphicsmagick and libapache2-mod-auth-openidc), Fedora (giflib, mod_auth_openidc, mysql8.0, perl, perl-Devel-Cover, perl-PAR-Packer, perl-String-Compare-ConstantTime, rust-openssl, rust-openssl-sys, trunk, and workrave), Mageia (chromium-browser-stable and rust), Oracle (java-1.8.0-openjdk, java-17-openjdk, java-21-openjdk, kernel, libreoffice, and webkit2gtk3), Red Hat (gvisor-tap-vsock), SUSE (containerd, docker, docker-stable, forgejo, GraphicsMagick, libmozjs-115-0, perl-32bit, poppler, subfinder, and thunderbird), and Ubuntu (erlang and ruby2.3, ruby2.5).

Version25.04 ("Plucky Puffin") of the Ubuntu Linux distribution has beenreleased. This release includes Linux 6.14, GNOME 48, APT 3.0, and introduces aArm64desktop ISO to install Ubuntu Desktop on Arm64 systems. This is aninterim release, with support through January2026. See the releasenotes for a detailed list of new features and changes.

Version14.5 of the TorBrowser has been released. Notable features in this releaseinclude the addition of Connection Assist for the Android version ofthe Tor Browser, and language support for Belarusian, Bulgarian, andPortuguese for all versions of the browser.

The kernel's memory controller works within the control-group mechanism toenforce memory-usage limits on groups of processes. This component hasoften had performance problems, so there is continual interest inoptimizing it. Shakeel Butt led a session during the memory-managementtrack of the 2025 Linux Storage, Filesystem, Memory-Management, and BPFSummit to look at the current state of the memory controller and what canbe done to reduce its overhead.

Security updates have been issued by Debian (chromium and libapache2-mod-auth-openidc), Oracle (expat, freetype, glibc, grub2, gvisor-tap-vsock, and kernel), Red Hat (grub2 and webkit2gtk3), and SUSE (apache2-mod_auth_openidc, cosign, gitoxide, govulncheck-vulndb, GraphicsMagick, haproxy, hauler, mozjs52, oci-cli, pam, perl-Data-Entropy, poppler, python-lxml-doc, python311-aiohttp, rekor, rubygem-rexml, and webkit2gtk3).

Inside this week's LWN.net Weekly Edition:

Debian's Advanced Package Tool (APT) is the suite of utilities that handle packagemanagement on Debian and Debian-derived operating systems. APT recently received amajor upgrade to 3.0 just in time for inclusion in Debian13("trixie"), which is planned for release sometime in 2025. The version bump iswarranted; the latest APT has user-interface improvements, switches to Sequoia to verify packagesignatures, and includes solver3-a new solver that is designed to improvehow it evaluates and resolves package dependencies.

GNOME contributor Michael Catanzaro has written a blogpost about a noteworthy vulnerability in GNOME's help browser, Yelp.

Allowing directories to be modified in parallel was the topic of JeffLayton's filesystem-track session at the 2025 Linux Storage, Filesystem,Memory Management, and BPF Summit (LSFMM+BPF). There are certain usecases, including for the NFS and Lustre filesystems, as mentioned in a patch setreferenced in the topicproposal, where contention in creating multiple files in a directory iscausing noticeable performance problems. In some testing, Layton has foundthat the inode read-write semaphore (i_rwsem) for the directory isserializing operations; he wanted to discuss alternatives.

The BPF verifier is not magic; it cannot solve thehalting problem. Therefore,it has to err on the side of assuming that a program will run too long if itcannot prove that the program will not.The ultimate check on the size of a BPF program is theone-million-instruction limit - the verifier will refuse to process more thanone-million instructions, no matter what a BPF program does. Alexei Starovoitov gavea talk at the 2025 Linux Storage, Filesystem,Memory-Management, and BPF Summit about that limit,why correctly written BPF programs shouldn't hit it, and how to make the userexperience of large BPF programs better in the future.

Sergiu Gatlan reportsthat the US government has extended funding for the CommonVulnerabilities and Exposures (CVE) program, following yesterday's reports that fundingwould run out as of April16.

As a system runs, its memory becomes fragmented; it does not take longbefore the allocation of large, physically contiguous memory ranges becomesdifficult or impossible. The contiguous memoryallocator (CMA) is a kernel subsystem that attempts to address thisproblem, but it has never worked as well as some would like. Two sessionsin the memory-management track at the 2025 Linux Storage, Filesystem,Memory-Management, and BPF Summit looked at how CMA can be improved; thefirst looked at providing guaranteed allocations, while the secondaddressed some inefficiencies in CMA.

Security updates have been issued by AlmaLinux (gvisor-tap-vsock, kernel, and kernel-rt), Fedora (chromium, dnf, dotnet9.0, golang, lemonldap-ng, mariadb10.11, perl-Crypt-URandom-Token, perl-DBIx-Class-EncodedColumn, php-tcpdf, podman-tui, and trunk), Red Hat (java-17-openjdk and kernel), Slackware (mozilla), SUSE (apache2-mod_auth_openidc, cosign, etcd, expat, flannel, kernel, libsqlite3-0, libvarnishapi3, mozjs52, Multi-Linux Manager 4.3: Server, Multi-Linux Manager 5.0: Server, Proxy and Retail Server, pgadmin4, rekor, rsync, rubygem-bundler, and webkit2gtk3), and Ubuntu (7zip, Docker, and quickjs).

In the first filesystem-track session at the 2025 Linux Storage,Filesystem, Memory Management, and BPF Summit (LSFMM+BPF), virtualfilesystem (VFS) layer co-maintainer Christian Brauner had a few differenttopics he wanted to talk about. Issues on the agendaincluded iterating through anonymous mount namespaces, a needed featurefor ID-mapped mounts, the perennial unprivileged mounts topic, potentiallyusing hazard pointers for file reference counting, and Rust bindings. Hedid not expect to get through all of them in the 30 minutes allotted, butthe session did move along pretty quickly to at leastintroduce them to the assembled filesystem developers.

Security Week is one of several outlets reportingthat the funding for the CVE program at MITRE disappears as ofApril16.

Version25.0 ("Zetar") of the Arch-based Manjaro Linuxdistribution is now available. This release includes Linux kernel 6.12,GNOME48, KDE6.3, Xfce4.18, and more.

The Fedora Project has announcedthe release of Fedora Linux42, with "what's new" articles for FedoraWorkstationand FedoraKDEPlasmaDesktop. Thereis also a last-minute warning about the live media for the release:

Fedora Linux42 has been released with manyincremental improvements and updates. In this development cycle, the KDEPlasmaDesktophas finally gotten a promotion from a spin to anedition, the new web-baseduser interface for the Anaconda installer makes its debut, and theWayland-ification of Fedora continues apace. In all it is a solidrelease with lots of polish.

It is common, on NUMA systems, to try to allocate all memory on the localnode, since it will be the fastest. That is not the only possible policy,though; another is weighted interleaving,which seeks to distribute allocations across memory controllers to maximizethe bandwidth utilization on each. Configuring such policies can bechallenging, though. At the 2025 Linux Storage, Filesystem,Memory-Management, and BPF Summit, Joshua Hahn ran a session in thememory-management track about how that configuration might be automated.

Security updates have been issued by AlmaLinux (glibc), Red Hat (kernel and kernel-rt), Slackware (perl), SUSE (haproxy, kernel, and webkit2gtk3), and Ubuntu (cimg, perl, protobuf, and webkit2gtk).

Version3.0 of the Pintaimage editor has been released. The most notable change in thisrelease is that Pinta has been ported to GTK4.0 and libadwaita. Italso includes a number of improvements, new effects, and bug fixes.

BPF is, famously, not part of the kernel's promises of user-space stability. Newkernels can and do break existing BPF programs; the BPF developers try tofix unintentional regressions as they happen, but the whole thing can be something of a bumpyride for users trying to deploy BPF programs across multiple kernel versions.Shung-Hsi Yu and Daniel Xu had two different approaches to fixing the problemthat they presented at the 2025 Linux Storage, Filesystem,Memory-Management, and BPF Summit.

Andrew Morton, the lead maintainer for the kernel's memory-managementsubsystem, tends to be quiet during the Linux Storage, Filesystem,Memory-Management, and BPF Summit, preferring to let the developers workthings out on their own. That changes, though, when he leads thetraditional development-process session in the memory-management track. Atthe 2025 gathering, this discussion covered a number of ways in which theprocess could be improved, but did not unearth any significant problems.

Security updates have been issued by Debian (glib2.0, jinja2, kernel, mediawiki, perl, subversion, twitter-bootstrap3, twitter-bootstrap4, and wpa), Fedora (c-ares, chromium, condor, corosync, cri-tools1.29, exim, firefox, matrix-synapse, nextcloud, openvpn, perl-Data-Entropy, suricata, upx, varnish, webkitgtk, yarnpkg, and zabbix), Mageia (giflib, gnupg2, graphicsmagick, and poppler), Oracle (delve and golang, go-toolset:ol8, grub2, and webkit2gtk3), Red Hat (kernel and kernel-rt), SUSE (chromium, fontforge-20230101, govulncheck-vulndb, kernel, liblzma5-32bit, pgadmin4, python311-Django, and python311-PyJWT), and Ubuntu (graphicsmagick).

Linus has released 6.15-rc2 for testing."Nothing particularly stands out to me, but it's early in the releaseyet, so let's see how it goes."

Knowing how frequently accessed a page of memory is (its "hotness") is akey input to many memory-management heuristics. Jonathan Cameron, in amemory-management track at the 2025 Linux Storage, Filesystem,Memory-Management, and BPF Summit, pointed out that the number of sourcesof that kind of data is growing over time. He wanted to explore thequestions of what commonality exists between data from those sources, andwhether it makes sense to aggregate them all somehow.

Eduard Zingerman presented a daring proposal that "makes sense if you thinkabout it a bit" at the 2025 Linux Storage, Filesystem,Memory-Management, and BPF Summit. He wants to inlineperformance-sensitive kernel functionsinto the BPF programs that call them. Hisprototype does not yet address all of the design problems inherent in that idea,but it did spark a lengthy discussion about the feasibility of his proposal.

Security updates have been issued by AlmaLinux (delve and golang and go-toolset:rhel8), Debian (webkit2gtk), Fedora (openvpn, thunderbird, uboot-tools, and zabbix), SUSE (expat, fontforge, govulncheck-vulndb, and kernel), and Ubuntu (haproxy and libsoup2.4, libsoup3).

Building on the discussion in the two previous sessions on untorn (oratomic) writes, for buffered I/O and for XFS using direct I/O, Ojaswin Mujooremotely led asession on support for the feature on ext4. That took place in the combined storage andfilesystem track at the2025 Linux Storage, Filesystem, Memory Management, and BPF Summit. Part ofthe support for the feature is already in the upstream kernel, with morecoming. But there are still some challenges that Mujoo wanted to discuss.

Over on the Red Hat Developer site, David Malcolm has an articleabout improvements in GCC 15, specifically focusing on the diagnosticinformation that the compiler emits. This includes ASCII art with a ""warning emoji to display the execution path when it detects a problem (likean infinite loop in one of his examples), better C++ template errors,machine-readable diagnostics using StaticAnalysis Results Interchange Format (SARIF), better messages regardingC23 compatibility since that is the default C version for GCC 15, and more.Since the changes are focused on messages, there is the inevitable color-scheme update as well:

ComputeExpress Link (CXL) memory is not like the ordinary RAM that one mightinstall into a computer; it can come and go at any time and is often notpresent when the kernel is booting. That complicates the management ofthis memory. During the memory-management track of the 2025 Linux Storage,Filesystem, Memory-Management, and BPF Summit, Gregory Price ran a sessionon the challenges posed by CXL and how they might be addressed.

Greg Kroah-Hartman has announced the release of eight stable kernels: 6.14.2, 6.13.11, 6.12.23, 6.6.87, 6.1.134, 5.15.180, 5.10.236, and 5.4.292. These all contain a largeassortment of important kernel fixes throughout the tree.

The Data AccessMONitor (DAMON) subsystem provides access to detailed memory-managementstatistics, along with a set of tools for implementing policies based onthose statistics. An update on DAMON by its primary author, SeongJae Park,has been a fixture of the Linux Storage, Filesystem, Memory-Management, andBPF Summit for some years. The 2025 Summit was no exception; Park led twosessions on recent and future DAMON developments, and how DAMON mightevolve to facilitate a more access-aware memory-management subsystem in thefuture.

Security updates have been issued by AlmaLinux (tomcat and webkit2gtk3), Debian (chromium), Fedora (ghostscript), Mageia (atop, docker-containerd, and xz), Red Hat (go-toolset:rhel8), SUSE (apache2-mod_auth_openidc, apparmor, etcd, expat, firefox, kernel, libmozjs-128-0, and libpoppler-cpp2), and Ubuntu (dino-im, linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-fips, linux-fips, linux-aws-fips, linux-azure-fips, linux-gcp-fips, opensc, and poppler).

Inside this week's LWN.net Weekly Edition:

Tom Schuster, Frederik Braun, and Christoph Kerschbaumer havepublished an articleon the Firefox Security team's Attack & Defenseblog that explains recent work to harden Firefox's frontend code.

In a combined storage and filesystem track session at the 2025 Linux Storage, Filesystem, Memory Management, and BPF Summit, JohnGarry continued the theme of "untorn" (or atomic) writes that started in the previous session. It was alsoan update on where things have gone for untorn writes since his session at last year's summit. Beyond that,he looked at some of the plans and challenges for the feature in the future.

Four candidates have stepped up to run in the 2025 Debian ProjectLeader (DPL) election. AndreasTille, who is in his first term as DPL, is running again. SruthiChandran, GianfrancoCostamagna, and Julian AndresKlode are the other candidates running for a chance to serve aterm as DPL. The campaigning phase ended on April5, and Debianmembers began voting on April6. Voting ends onApril19. This year, the campaign period has been lively andsometimes contentious, touching on problems with Debian teamdelegations and finances.

The 6.15 merge window saw the inclusion of a new type of lock for BPF programs:a resilient queued spinlock that Kumar Kartikeya Dwivedi has been working onfor some time. Eventually, he hopes to convert all of the spinlocks currentlyused in the BPF subsystem to his new lock.He gave a remote presentation about the design of the lock at the2025 Linux Storage, Filesystem,Memory-Management, and BPF summit.

Tiered-memory systems feature multiple types of memory with varyingperformance characteristics; on such systems, good performance depends onkeeping the most frequently used data in the fastest memory. Identifyingthat data and placing it properly is a challenge that has kept developersbusy for years. Bharata Rao, presenting remotely during amemory-management-track session at the 2025 Linux Storage, Filesystem,Memory-Management, and BPF Summit, led a discussion on a potential solution he has recentlyposted; Raghavendra KT was also named on thesession proposal. It seems likely, based on the discussion, thatdevelopers working in this area will not run out of problems anytime soon.

The kernelsamepage merging (KSM) subsystem works by finding pages in memory withthe same contents, then replacing the duplicated copies with a single,shared copy. KSM can improve memory utilization in a system, but has someproblems as well. In two memory-management-track sessions at the 2025Linux Storage, Filesystem, Memory-Management, and BPF Summit, MathieuDesnoyers and Sourav Panda proposed improvements to KSM tomake it work better for specific use cases.

OpenSSH10.0 has been released. Support for the DSA signature algorithm,which was disabled by default beginning in 2015, has beenremoved. Other notable changes include using the post-quantum algorithm mlkem768x25519-sha256for key agreement by default, support for systemd-style socketactivation in Portable OpenSSH, and moving code for userauthentication from the sshd-session binary to the newssh-auth binary:

Security updates have been issued by Debian (lemonldap-ng, libbssolv-perl, and phpmyadmin), Fedora (augeas, mariadb10.11, and thunderbird), Oracle (gimp, libxslt, python3.11, python3.12, tomcat, and xorg-x11-server), Red Hat (expat, grafana, opentelemetry-collector, and webkit2gtk3), SUSE (azure-cli-core, doomsday, kernel, and poppler), and Ubuntu (dotnet8, dotnet9, erlang, and poppler).

Version3.5.0 of OpenSSL has been released. This release adds support forserver-side QUIC (RFC 9000), anew configuration option (no-tls-deprecated-ec) that disablessupport for TLS groups deprecated in RFC 8422, and more.

Version1.4 of FreeDOS has beenreleased. This is the first stable release since 2022, andincludes improvements to the Fdisk hard-disk-management program, andreliability updates for the mTCP set of TCP/IP applications forDOS.

Joplin is an open-sourcenote-taking application designed to handle taking many kinds of notes,whether it is managing code snippets, writing documentation, jottingdown lecture notes, or drafting a novel. Joplin has Markdown support,a plugin system for extensibility, and accepts multimedia content,allowing users to attach images, videos, and audio files to theirnotes. It can provide synchronization of content across devices usingend-to-end encryption, or users can opt to stick to local storageonly. Joplin even offers a command-lineversion for terminal-based usage. Joplin3.2, the most recent feature release, brought long-awaitedmulti-window support, multi-column layouts, enhanced accessibility,and theme detection.