LWN.net

Security updates have been issued by AlmaLinux (libpng, libsolv, libtasn1, libxml2, libxslt, python3.14, tigervnc, and vim), Debian (cloud-init, postgresql-13, and yelp), Mageia (nats-server), Oracle (.NET 10.0, .NET 8.0, .NET 9.0, bind9.18, cockpit, compat-openssl11, dnsmasq, dovecot, evince, expat, flatpak, freerdp, gimp, golang, grafana, grafana-pcp, httpd, jmc, jq, kernel, libsndfile, libsoup, libtiff, mod_http2, mysql:8.0, nginx, nginx:1.24, openexr, php:8.2, poppler, pyOpenSSL, python-markdown, redis:7, samba, thunderbird, tigervnc, unbound, and vim), Red Hat (libpng, libpng12, and libpng15), SUSE (apptainer, bind, crun, freeipmi, ghc-crypton-x509-store, ghc-crypton-x509-system, google-guest-agent, google-osconfig-agent, GraphicsMagick, gstreamer-plugins-bad, hamlib, iproute2, java-1_8_0-openjdk, kubevirt1, libarchive, libheif, libpng15, mbedtls, mbedtls-2, openssl-1_1, python-biopython, python-PyJWT, tar, webkit2gtk3, and xen), and Ubuntu (ffmpeg, libdbi-perl, and perl).

Inside this week's LWN.net Weekly Edition:

Compromised accounts are one of the most common ways that attackerscan sneak malware into the open-source supply chain. One way toreduce account compromise is for projects to require two-factorauthentication (2FA) or multi-factor authentication (MFA), but that iseasier said than done. However, Fedora is currently discussing putting2FA requirements in place soon, following an an alleged accountcompromise that led to an AI agent causing a number of problemsfor the project. After some discussion, Fedora will begin by requiringpackagers in the "provenpackager"group to enable 2FA within the next three months or so.

BPF arenas are areas of memory (potentially shared with user space)where programs have free reign to build theirown data structures, unburdened by the verifier's bounds checks. Many of thosedata structures are potentially usable in multiple programs. Emil Tsalapatisbrought his work on libarena, a library containing generic utilities for use inBPF arenas, to the 2026Linux Storage, Filesystem, Memory-Management, and BPFSummit. Although the library is already available as part of the kernel, itis still in its early stages and he has more work planned.

The Power Managementand Scheduling in the Linux Kernel Summit, which still goes by thehistorical acronym OSPM, was held in Cambridge, UK, in mid-April. As hasbecome traditional, the presenters at that event have since writtensummaries of their sessions, and this work has kindly been made availableto LWN for publication. The second day's sessions covered a wide range oftopics, including device frequency scaling, using time-slice duration forCPU selection, scheduling domains on multi-cluster Arm systems, the LAVDscheduler, and more.

Security updates have been issued by AlmaLinux (corosync, firefox, kernel, kernel-rt, libpq, memcached, postgresql, postgresql16, postgresql:13, postgresql:16, python-urllib3, python3.14-urllib3, redis:6, skopeo, and vim), Debian (beets, gst-plugins-bad1.0, imagemagick, libmatio, python-urllib3, and u-boot), Fedora (chromium, coturn, frr, grout, materialx, perl-Crypt-DSA, and yt-dlp), Mageia (opensc, perl-Archive-Tar, and podofo), Oracle (fence-agents, libpq, mysql:8.4, and postgresql:16), Red Hat (firefox, libpng, libpng12, libpng15, libreoffice, nginx:1.24, thunderbird, tigervnc, xorg-x11-server, and xorg-x11-server-Xwayland), Slackware (libarchive), SUSE (amazon-ssm-agent, ansible-core, apache2, bind, bitcoin-qt6, containerized-data-importer, curl, distribution, docker-stable, dovecot24, dracut, editorconfig-core-c, exiv2, firefox, freeipmi, freerdp, ghc-aws, ghc-crypton-asn1-encoding, ghc-crypton-asn1-parse, ghc-crypton-asn1-types, ghc-crypton-pem, glib-networking, go1.25, go1.26, google-guest-agent, graphite2, hamlib, helm, himmelblau, ignition, ImageMagick, kernel, ldns, libarchive, libcaca, libheif, libinput, libjxl, libsolv, libzypp, zypper, LibVNCServer, libxslt, libyang, mcphost, mozjs128, ncurses, nginx, opensc, openssl-3, openvswitch, papers, perl-HTML-Parser, perl-HTTP-Daemon, perl-Protocol-HTTP2, podman, postgresql14, postgresql15, postgresql16, postgresql17, python-aiohttp, python-ecdsa, python-paramiko, python-PyJWT, python-starlette, rekor, sqlite3, strongswan, tiff, tomcat, tomcat10, tomcat11, unbound, webkit2gtk3, xwayland, and zypper, libzypp, libsolv), and Ubuntu (libcap2, libnfs, libvncserver, libxml2, and mysql-8.0).

Alexis Lothore has been working to add support for the kernel's memory-accesschecker,KASAN, to just-in-time-compiled BPF code. He spoke about that work atthe 2026Linux Storage, Filesystem, Memory-Management, and BPF Summit.KASAN support is needed, he said, to help catch bugs in the BPF just-in-time (JIT)compiler. KASAN is a great tool for catching memory-management problems in thekernel, but only in code that can be monitored by it.

The Tor Project has announcedthat it is planning to actively stop supporting Tor 0.4.8 and earlierC Tor versions soon.

Security updates have been issued by Debian (ffmpeg), Fedora (erlang, ffmpeg, prometheus, python-scrapy, python3-docs, python3.14, thorvg, tigervnc, and vips), Mageia (mumble and sslh), Oracle (389-ds:1.4, dracut, firefox, hplip, kernel, openssh, postgresql:15, redis:6, and uek-kernel), Red Hat (delve, gvisor-tap-vsock, nginx, nginx:1.24, nginx:1.26, osbuild-composer, podman, rhc, skopeo, and yggdrasil), SUSE (containerized-data-importer, graphite2, kernel, libarchive, openssh, openssh-askpass-gnome, openvswitch, openvswitch3, postfix, python-lxml, python-nltk, python-python-multipart, python-urllib3, rmt-server, terraform-provider-local, terraform-provider-null, and util-linux), and Ubuntu (google-guest-agent, haproxy, libxml2, linux-azure, linux-intel-iotg-5.15, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle-5.15, mysql-8.0, mysql-8.4, and nginx).

The GIMP project reports thatGNOME contributor "balooii" has worked to package GIMP0.54.1-released in 1996-as a Flatpak that will build andrun on modern 64-bit Linux systems. This is a Motif-basedversion, and the same version that was usedby Larry Ewing to create Tux.While not likely to be useful for serious graphics work today, itshould be interesting for users who would like to see what a30-year-old version of GIMP was capable of.

Probably the biggest change for Python over the last five years or so isthe advent of the "free-threaded" version of the language, which removes theglobal interpreter lock (GIL) and allows multiple threads to run inparallel in the interpreter. At PyConUS 2026, held in Long Beach, California in mid-May, longtime CPythoncore developer (and current steering council member) Thomas Wouters gave atalk about the feature. He looked at the motivation behind the GIL-removalefforts, some history,the current status of the free-threaded interpreter, and provided aprediction on where it all leads.

Brian Tarricone has announcedthe first preview release of xfwl4, a Wayland compositor for the Xfce desktop environment.

The Power Managementand Scheduling in the Linux Kernel Summit, which still goes by thehistorical acronym OSPM, was held in Cambridge, UK, in mid-April. As hasbecome traditional, the presenters at that event have since writtensummaries of their sessions, and this work has kindly been made availableto LWN for publication. The first day's sessions covered a wide range oftopics, including idle-state selection, user-space schedulers withsched_ext, lock-holder preemption, and much more.

Security updates have been issued by AlmaLinux (389-ds:1.4, kernel, and kernel-rt), Debian (gst-libav1.0, gst-plugins-good1.0, imagemagick, kernel, libconfig-inifiles-perl, libgd-perl, libhttp-daemon-perl, mediawiki, pillow, and squid), Fedora (389-ds-base, alertmanager, ansible-core, buildah, chromium, erlang-cowboy, erlang-cowlib, erlang-gun, freerdp, kubernetes1.33, kubernetes1.34, kubernetes1.35, mingw-SDL2_image, ongres-scram, ongres-stringprep, openssl, perl-Config-IniFiles, perl-Crypt-PBKDF2, podman, postgresql-jdbc, python3.13, strongswan, webkitgtk, xdg-desktop-portal, and yt-dlp), Red Hat (osbuild-composer), SUSE (alloy, amazon-ssm-agent, ansible-core, apache-sshd, jpgpj, azure-storage-azcopy, chromedriver, containerized-data-importer, firefox, glibc, graphite2, inspektor-gadget, kubevirt, lemon, openvswitch, python-starlette, python311, python311-joserfc, python313, and tinyproxy), and Ubuntu (netatalk).

Systemd v261 has been released with a long list of changes, including a newcloud "Instance Metadata Service" (IMDS) subsystem, "boot secret"functionality for use on systems that lack a physical TPM, as well assupport for the kernel's Live Update Orchestration (LUO) / KexecHandover (KHO) systems when they are present and enabled. See therelease notes for the full list of changes.

BPF programs can be used to extend many aspects the Linux kernel, butBPF programs must run to completion in the same context that they began.Kumar Kartikeya Dwivedi is working on changing that byallowing BPF programs to be expressed as coroutines. He spoke about his work atthe 2026Linux Storage, Filesystem, Memory-Management and BPF Summit. Whilestill experimental, the change promises to make long-running BPF taskssignificantly easier to write.

The Arch User Repository (AUR) hasbeen subjected to a sustained attack recently. The attacker, or attackers, havespun up a series of new accounts then used them to adopt orphanedpackages and push malicious updates that would install malware on users' systems.It is unclear how many users were compromised in the attack, but the maintainerswere playing Whac-A-Mole for several days to respond to each newly compromisedpackage. The project has turnedoff the AUR's new-user registration, for now, but it is unclear what its long-term response will be or if the AUR can be secured without major changes toits existing collaboration model.

Security updates have been issued by AlmaLinux (dracut), Debian (chromium, firefox-esr, and thunderbird), Fedora (chromium, firefox, nss, ocserv, ongres-scram, ongres-stringprep, perl-Archive-Tar, perl-GD, perl-HTTP-Daemon, perl-Net-Statsd, restic, singularity-ce, util-linux, and vorbis-tools), Mageia (gstreamer1.0-*, libupnp, luajit, opensc, and ruby-rack), SUSE (curl, dnsmasq, ffmpeg-4, frr, google-osconfig-agent, java-1_8_0-ibm, kernel, krb5, kubernetes-old, ldns, liburiparser1, openvswitch, rootlesskit, strongswan, traefik, and trivy), and Ubuntu (ldns, libheif, libnet-cidr-lite-perl, lxd, tomcat11, and vim).

Greg Kroah-Hartman has announced the release of the 7.1.1, 7.0.13, 6.18.36, 6.12.94, 6.6.143, 6.1.176, 5.15.210, and 5.10.259 stable kernels. As usual, eachcontains important fixes. Users are advised to upgrade.

The Software FreedomConservancy (SFC) has announcedthe release of its recommendationsfor using LLM-backed generative AI systems for FOSScontributions. The recommendations were created by the SFC andvolunteers from the free-software community.

The 7.2 merge window started with the 7.1kernel release on June14. As of this writing, just over 7,000non-merge changesets have been pulled into the mainline for the next kernelrelease. Many of the core subsystems have been pulled at this point,meaning that most of the changes that can be expected in 7.2 have now comeinto focus.

Version4.6 of the Mastodon fediverse platform has been released.

How can cloud providers efficiently supply durable virtual block devices? RemoteDirect Memory Access (RDMA) provides a way for servers in a cluster to sharechunks of memory, but there still needs to be a protocol that operates on top ofRDMA to provide the guarantees expected of a block device. The kernel's RDMA transportlibrary (RTRS) provides a way to send messages via RDMA. Ipresented about twonew components built on top of RTRS at the 2026LinuxStorage, Filesystem, Memory Management and BPF Summit: Reliable Multicastover RTRS (RMR) and Block device over RMR (BRMR). These modules, which Iam working on with Jia Li, could be a way for cloud providers toexpose durable block devices with as little overhead as possible. To accomplishthat, however, we need some discussion and feedback from the community beforesending the modules upstream.

Security updates have been issued by AlmaLinux (dracut, podman, postfix, rsync, xorg-x11-server, and xorg-x11-server-Xwayland), Debian (atril, firefox-esr, and nginx), Mageia (libcap, perl, and python-pillow), Oracle (firefox, gstreamer-plugins-base and gstreamer-plugins-good, httpd:2.4, kernel, libpng12, libpng15, libxml2, libxslt, opencryptoki, openssl, postfix, rsync, webkit2gtk3, xorg-x11-server, and xorg-x11-server-Xwayland), Slackware (bind, libidn, mozilla, and openssl), SUSE (alloy, docker, elemental-system-agent, glibc, grafana, helm, LibVNCServer, openssh8.4, perl-GD, perl-HTTP-Daemon, python-WebOb-doc, python311-google-adk, rustup, traefik2, wireshark, and xwayland), and Ubuntu (dolibarr, golang-go.crypto, graphite2, gst-plugins-bad1.0, kitty, libconfig-inifiles-perl, libnginx-mod-js, and webpy).

Inside this week's LWN.net Weekly Edition:

The resultsare in for Fedora's F44 election cycle for seats on the FedoraCouncil, Fedora EngineeringSteering Committee, FedoraMindshare Committee, and EPELSteering Committee.Miro Hronok and Aleksandra Fedorova have wonseats on the council. Neal Gompa, Fabio Valentini, Michel Lind,Maxwell G, and Simon de Vlieger have been elected to FESCo. SamyakJain, Akashdeep Dhar, Luis Bazan, and Mat Holmes have all been electedto the Mindshare Committee. The four candidates for the EPELcommittee, Carl George, Diego Hererra, Jonathan Wright, and TroyDawson were all automatically elected as there were an equal number ofcandidates and seats open. Congratulations to all the winners.

The Python Software Foundation blog has a postwith a summary of the security-related content at PyCon US 2026 with links toslides from important sessions. The recordings will be published tothe PyCon US channel onYouTube, and the post will be updated with links to those videos asthey are made available.

Jan Kara has been workingon cleaning up how bufferheads are used by some kernel filesystems. In a shortfilesystem-track session at the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit, he gave an update onthat work and where it is headed. Topics included generic infrastructureto track buffer heads for metadata, a buffer-head cleanup for the Amigafilesystem, and some planned locking fixes.

Version2.0 of the FairScan document-scanning app for Android has beenreleased. The headline feature for this release is the addition ofoptical-character-recognition (OCR) support using Tesseract to produce PDFswith searchable text from scans. FairScan developer Pierre-YvesNicolas has written a detailedblog about adding the feature and explaining why it had not been addedpreviously.

Security updates have been issued by AlmaLinux (hplip, kernel, kernel-rt, libpng12, libpng15, libxml2, libxslt, mysql:8.0, mysql:8.4, opencryptoki, openssl, postfix, postgresql:15, rsync, and webkit2gtk3), Debian (asterisk, atril, gsasl, and libreoffice), Fedora (ack, bird, chromium, firefox, ldns, librabbitmq, nextcloud, nss, openslide, perl-Protocol-HTTP2, tig, vorbis-tools, and xen), Mageia (coturn, log4cxx, and python-tornado), SUSE (389-ds, buildah, container-suseconnect, distribution, editorconfig-core-c, elemental-system-agent, glib-networking, google-guest-agent, google-osconfig-agent, kernel, libcaca, libXpm, opensc, openssl-3, openvswitch, perl-Crypt-PBKDF2, python-python-dotenv, python311-aiosmtplib, python311-zeroconf, runc, shim, and sqlite3), and Ubuntu (ca-certificates, keystone, librabbitmq, linux, linux-aws, linux-kvm, linux-aws-hwe, linux-azure, linux-gcp, linux-hwe, linux-oracle, linux-azure, linux-azure, linux-gcp, linux-hwe, linux-oracle, linux-azure-6.8, linux-oracle-5.15, nova, openimageio, qemu, and squid).

Part of running LWN is keeping a list of potentially interesting topicsthat may merit the effort to turn into articles. As an experiment, we arenow exposing that list to our subscribers at theProject Leader and Supporter levels. The hope is that this list willprovide useful insights into what is on our radar and which might be comingto LWN in the near future.

On June 15 at Fedora's Flock conference, held inPrague, Fedora Project Leader (FPL) Jef Spaleta delivered a short "State ofFedora" keynote that provided a bit of insight into the status of theproject. Topics included the overall growth for Fedora usage, ways to increasecontributions, and an alarming decline in the number of active packagers workingon the project.

Version152.0 of the Firefox web browser has been released. Notablechanges in this release include a brand-new look for the FirefoxSettings interface, the ability to disable tracker blocking in privatebrowsing tabs, a feature to mute browser sound from the address bar,experimental support for the JPEGXL image format, and more.

Version6.7 of KDE's Plasma desktop has been released. Notable changes inthis release include per-screen virtual desktops, faster desktopswitching, introduction of the Uniontheming system as a tech preview, as well as many other improvements and bugfixes. The release is dedicated to Eric Laffoon, a longtime KDEsupporter, who passed away in May.See the KDEwiki for a full list of new features, and the Changelogfor a list of all commits in this release.

Security updates have been issued by AlmaLinux (mod_http2, postfix, and webkit2gtk3), Debian (bird2, libgd-perl, and libreoffice), Fedora (7zip, ack, hugo, and perl-Mojo-JWT), Mageia (atril, evince, xreader, emacs, lcms2, libgcrypt, libinput, libsndfile, putty, and sudo), Red Hat (openssl and osbuild-composer), SUSE (cheat, chromedriver, containerized-data-importer, cyrus-imapd, freeipmi, graphicsmagick, java-11-openj9, java-17-openj9, kitty, kubevirt, kubevirt-1.6, libcaca, libopenssl-3-devel, librav1e0_8, neonmodem, opensc, openssh, openssl-1_0_0, openssl-1_1, openssl-3, perl-HTTP-Daemon, perl-XML-LibXML, python-python-dotenv, python311-paramiko, python311-PyJWT, python311-starlette, python311-tornado6, qemu, restic, and trivy), and Ubuntu (adsys, cups, fastnetmon, freerdp2, freerdp3, mesa, nginx, rsync, ruby2.3, ruby2.5, and tmux).

Linus Torvalds releasedthe 7.1 kernel as expected on June14. This development cyclebrought in a lot of new features - and a lot of new developers as well.The time has come for our traditional look at where the changes in 7.1 camefrom, with a digression into how our community may be changing in general.

Daniel Stenberg has announcedthat curl will not be accepting vulnerability reports from July1through August3, unless the submitter has a paid supportcontract. He is calling it the "curl summer of bliss".

Security updates have been issued by AlmaLinux (.NET 9.0), Debian (apache2, chromium, jpeg-xl, librabbitmq, and openssl), Fedora (apptainer, bind9-next, chezmoi, chromium, collectd, composer, dnsdist, gh, python-django5, python-python-multipart, varnish, varnish-modules, vmod-querystring, vmod-uuid, weasyprint, and xorg-x11-server-Xwayland), Mageia (cups, expat, libpng, libssh, memcached, nghttp2, openimageio, packages, proftpd, and radare2), Oracle (.NET 10.0, .NET 8.0, .NET 9.0, and firefox), Red Hat (postfix and valkey), and SUSE (afl, alloy, ansible-core, apache-pdfbox, chromedriver, chromium, cpp-httplib-devel, dpkg, elemental-operator, elemental-toolkit, enc, erlang, ffmpeg-7, firewalld, git-bug, golang-github-prometheus-prometheus, grafana, GraphicsMagick, graphite2, kernel, kernel-devel, lcms2, ldns, libsoup, libyang, libzypp, logback, mariadb, NetworkManager, openssh, openvswitch, perl-GD, perl-XML-LibXML, polkit, postgresql-jdbc, postgresql18, python, python-django, python-M2Crypto-doc, python-Pygments, python-pygments, python-requests, python313-Django6, qemu, rpcbind, samba, strongswan, tmux, uriparser, and xdg-dbus-proxy).

Linus has released the 7.1 kernel."So it's only Sunday morning back home, but it's Sunday afternoon whereI am right now, so I'm doing the 7.1 release at the regular time -just not in the regular timezone."Significant changes in 7.1 includethe removal of support for some old 486-based architectures,some new clone() flags makingprocess management easier,BPF support for io_uring,zero-copy-I/O support for the ublk user-space blockdriver,initial (incomplete) sub-scheduler supportin sched_ext,more swapping improvements,a completely rewritten NTFSimplementation,and much more. See the LWN merge-window summaries (part1, part2) for details.

In a shortened session in the filesystem track at the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit, Amir Goldstein gave anupdate on the overlayfsunion filesystem. There are some new features over the last few yearsthat he wanted to mention, along with looking at the status of nestingoverlayfs layers. The composefs use casethat was discussed at the summit in 2023has led to some interesting changes to overlayfs.

Hundreds of orphaned packages hosted by the Arch User Repository (AUR) havebeen compromised by an attacker who has added a malicious npmpackage (atomic-lockfile) that can exfiltrate sensitivedata. The project is currently workingon cleaning up the mess. There is a list of affected packagesand post (possibly NSFW domain) by"sodiboo" with additional information. Arch Linux users (or users ofArch-based distributions) that use AUR packages may wish to see if theyhave installed any of the compromised updates.

Security updates have been issued by AlmaLinux (.NET 10.0, .NET 8.0, .NET 9.0, bind, expat, httpd:2.4, kernel, kernel-rt, mod_http2, openssl, poppler, redis, redis:7, samba, and unbound), Debian (ironic, kernel-wedge, libinput, linux-base, and neutron), Fedora (kernel, openssl, vaultwarden, and vaultwarden-web), Mageia (erlang-hex_core, erlang-rebar3, gnupg2, and sqlite3), Red Hat (buildah, podman, and skopeo), SUSE (flannel, gdk-pixbuf-loader-libheif, gnutls, google-cloud-sap-agent, grafana, graphite2, hplip, libIex-3_4-33, libzypp, nginx, openssh, perl-DBI, perl-Git-Repository, perl-Protocol-HTTP2, python-Pygments, python-simpleeval, python311-Django4, rclone, roundcubemail, strongswan, tomcat10, tomcat11, unbound, and webkit2gtk3), and Ubuntu (apache2, dotnet8, dotnet9, dotnet10, gst-plugins-base1.0, ironic, linux-azure-5.15, linux-azure-fips, lwip, mistral, and ubuntu-kylin-software-center).

Version6.0.0 of the Homebrewpackage-management system has been released. Notable changes in thisrelease include the introduction of tap trust to improvesupply-chain security, improvements in sandboxing on Linux, a numberof performance tweaks, and many other changes.See the changelogfor a full list. LWN covered Homebrew inNovember 2025.

The Linux kernel has long tried to use huge pages as a way to improveperformance, sometimes with more success than others. The size of hugepages has traditionally been imposed by the hardware, which typically onlyoffers a couple of relatively large options. In more recent times, though,the use of multi-size transparent huge pages (mTHPs), with more flexiblesizing implemented in software, has been growing. If all goes well, the7.2 development cycle will include the addition of a new feature,contributed by Nico Pache, to make the use of mTHPs even more transparent.

Security updates have been issued by AlmaLinux (.NET 10.0, .NET 8.0, .NET 9.0, podman, poppler, and postgresql-jdbc), Debian (chromium, jackson-core, libdbi-perl, and libinput), Fedora (httpd, rust, and xmlstarlet), Mageia (openssh, postfix, and roundcubemail), Oracle (frr, kernel, libyang, n, postgresql-jdbc, and unbound), Red Hat (.NET 10.0, .NET 8.0, .NET 9.0, redis, and redis:7), SUSE (agama-web-ui, cockpit, cosign, glibc, google-cloud-sap-agent, google-osconfig-agent, kanidm, kernel, kubernetes, kubernetes1.23, kubernetes1.24, kubernetes1.25, kubernetes1.27, kubernetes1.28, libpodofo-devel, libyang, NetworkManager-libreswan, openCryptoki, python311-pypdf, rclone, steampipe, wicked, and xen), and Ubuntu (exim4, libcrypt-saltedhash-perl, libhttp-daemon-perl, samba, and uriparser).

Inside this week's LWN.net Weekly Edition:

Seth Larson, the Python Software Foundation's securitydeveloper-in-residence, has writtenabout the difficulty in classifying insecure code completion inthe PyCharm IDE usingits FullLine code completion plugin. Larson discovered that the plugin,which uses a local "deep learning module" to offer code completions,suggests code that would lead to severe vulnerabilities. He was unsurewhether it warranted a CVE or not, however:

Agentic AI systems can be used to do a variety of thingsautonomously on behalf of a human user: open or manage bugs, generatecode, submit pull-requests, and (apparently) even complain aboutrejection. In May, a Fedora developer discovered that an allegedlyrogue agent had been pestering the project in a number of ways:reassigning bugs, fabricating unhelpful replies to bugs, and evenpersuading maintainers to merge questionable code into the Anacondainstaller. It also submitted a number of pull requests (PRs),some accepted, to several upstream projects. The Fedora accountassociated with the agent has had its group privileges revoked and themesses have been mopped up, but the motive behind the agent's actions is stilla mystery.

Version2026.05 of the Buildroot toolhas been released. Buildroot simplifies and automates the process ofbuilding embedded Linux systems using cross-compilation. Notablechanges in this release include support for Arm Neoverse cores,addition of XFS rootfs generation, as well as many package updates andbug fixes. See the CHANGESfile for the full list.

Security updates have been issued by AlmaLinux (poppler), Debian (dnsmasq, mistral, okular, openssl, poppler, and strongswan), Fedora (exim, firefox, pcs, putty, and xorg-x11-server), Mageia (freeciv, golang-x-net, jq, libssh, libxmp, libxpm, minetest, ruby-net-ssh, tor, and wireshark), SUSE (389-ds, ack, agama-web-ui, amazon-ssm-agent, avahi, dpkg, elemental-register, elemental-system-agent, elemental-toolkit, ggml-devel-9500, go1.25, go1.26, kernel, kubernetes1.23, kubernetes1.24, kubernetes1.26, libsoup, mariadb, netty, netty-tcnative, NetworkManager, nginx, perl-CryptX, perl-XML-LibXML, podofo, polkit, python-Django, python-requests, samba, strongswan, vim, and xen), and Ubuntu (cyborg, gdk-pixbuf, golang-golang-x-net-dev, nginx, node-lodash, openssl, openssl, openssl1.0, qemu, tomcat9, tomcat10, and vim).