LWN.net

Fedora contributor Simon de Vlieger has published a blogpost with a walkthrough of how the project turns source code andpackages into the final release that users install on their systems.

Daniel Borkmann led a session at the 2026Linux Filesystem, Memory-Management,and BPF Summit about the progress that has been made with netkit, the subsystemthat allows virtual machines (VMs) running on Linux to perform networking efficiently.When that did not fill the full time, he went on to discuss his idea forusing BPF to live-patch user-space applications. While netkit is makingprogress, and can now support zero-copy receipt of packets into a VM in anetwork namespace, the idea of using BPF for patching user-space programsremains entirely speculative.

The Open HomeFoundation, which governs the Home Assistanthome-automation project, has announcedthe "public preview" of its DeviceDatabase:

Security updates have been issued by AlmaLinux (glibc, java-21-openjdk, kernel, and libpq), Debian (imagemagick, spice-vdagent, and webkit2gtk), Fedora (cryptlib, dotnet8.0, dotnet9.0, firefox, python-black, python-lsp-black, and python-pytokens), Mageia (apache, cifs-utils, dnsmasq, lrzip, and socat), Oracle (.NET 10.0, .NET 9.0, 389-ds-base, cups, edk2, fence-agents, firefox, freeipmi, freerdp, git-lfs, glib2, gnutls, golang, gstreamer1-plugins-bad-free, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, hplip, libinput, libvirt, libxml2, memcached, nginx, openexr, perl-DBI, perl-XML-LibXML, php, php8.4, plexus-utils, postgresql16, python3.12, python3.14, sssd, tomcat, tomcat9, unbound, vim, xorg-x11-server-Xwayland, yggdrasil, and yggdrasil-worker-package-manager), Red Hat (container-tools:rhel8, git-lfs, go-toolset:rhel8, golang, golang-github-openprinting-ipp-usb, grafana, grafana-pcp, host-metering, java-1.8.0-openjdk, java-11-openjdk with Extended Lifecycle Support, java-17-openjdk, java-21-openjdk, oci-seccomp-bpf-hook, rhc, rhc-worker-playbook, skopeo, xorg-x11-server, xorg-x11-server-Xwayland, and yggdrasil), Slackware (mozilla-thunderbird), SUSE (afterburn, alloy, apache-sshd, apache2, avahi, chromium, clamav, curl, dhcpcd, dnsmasq, docker-compose, ffmpeg-7, firefox-esr, gawk, glibc, gnutls, go1.26-openssl, google-osconfig-agent, gpg2, haproxy, ImageMagick, imagemagick, jline3, jq, kernel, libgcrypt, libgnt, meson, pidgin, nmap, nodejs24, pacemaker, patch, perl-HTML-Parser, perl-libwww-perl, perl-List-SomeUtils-XS, python-aiohttp, python-WebOb, qemu, rust-keylime, SVT-AV1, libyuv0, libaom3, trivy, ucode-intel, and wireshark), and Ubuntu (libhttp-date-perl, libxpm, linux-azure, linux-azure-fde, pam, and rsyslog).

I have just received the shocking news that Dan Williams, a longtime,high-profile kernel developer, has passed away. I knew him primarilythrough his long service on the Linux Foundation Technical Advisory Board;he was always a strong, thoughtful, and intelligent presence. Dan will bedeeply missed.There is a supporteffort underway for Dan's family as they come to terms with this loss.

One of the ideas raised at the 2026 LinuxStorage, Filesystem, Memory Management, and BPF Summit (LSFMM+BPF) wasthe creation of anoperations structure for the swap subsystem. Like many parts of thekernel, the swap layer evolved over time, with pieces being added asneeded; the end result of this evolution is rarely what one would expecthad the subsystem been designed today. The interface between the swaplayer and the devices it uses is just one example. It appears that oneresult of the swap subsystem's evolution - the lack of an abstraction layerto interface with underlying storage - will soon be addressed, but in adifferent way than was initially envisioned.

The Codeberg forge has adopted a pair of new policies, promising not to usehosted projects to train LLMs and, more controversially, banning thehosting of LLM-generated software. The site's blog describesand justifies these policies.

Security updates have been issued by AlmaLinux (acl, dogtag-pki, dovecot, glibc, go-toolset:rhel8, golang-github-openprinting-ipp-usb, grafana, grafana-pcp, httpd:2.4, javapackages-tools:201801, libtiff, mariadb-connector-c, perl-HTTP-Daemon, pki-deps:10.6, and sssd), Debian (bind9, chromium, firefox-esr, and pdns-recursor), Fedora (chromium, collectl, fractal, kernel, libssh, llvm, nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts, perl-DBI, perl-YAML-Syck, and srt), SUSE (7zip, GraphicsMagick, ImageMagick, multipath-tools, perl-YAML, python-sqlparse, python3-sqlparse, python313-bleach, and sssd), and Ubuntu (apache2, commons-beanutils, exim4, gawk, giflib, gst-plugins-good1.0, krb5, libapache-mod-jk, libarchive, libgphoto2, libhtml-parser-perl, linux-aws, linux-aws-5.15, linux-aws-fips, linux-fips, linux-ibm, linux-nvidia, linux-fips, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-oracle, linux-ibm, linux-oracle, linux-ibm-5.15, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-nvidia-tegra, linux-nvidia-tegra-igx, linux-oem-6.17, linux-oracle-6.8, python-aiohttp, and tar).

Inside this week's LWN.net Weekly Edition:

One of the features that users often miss when moving from X11 to Wayland isthe ability to save and restore the position of windows between sessions. At GUADEC2026, held inACoruna, Spain, Adrian Vovk provided an overview of work that has goneinto providing a platform-wide save and restore framework for GNOME. After twofailed attempts at landing an API, he believes that the third try will be theone to succeed-though not in time for the upcoming GNOME51 releasedue in October.

Python Software Foundation security developer-in-residence SethLarson has announcedthat the Python Package Index (PyPI) will now reject new files thatare uploaded to releases older than 14 days. The restriction is toprevent the poisoning of old releases if publishing tokens orworkflows of PyPI projects are compromised.

Tracepoints in the kernel are useful for a variety of purposes: debugging,active monitoring, and performance measurements, among other things. Previously,any given BPF program could only be attached to a single tracepoint.Jiri Olsa has been working to change that, and led a discussion abouthis progress at the 2026Linux Storage, Filesystem, Memory-Management, and BPFSummit. That work has since beenmerged, and can be expected as part of the 7.2kernel.

Security updates have been issued by AlmaLinux (389-ds-base, c-ares, dovecot, freerdp, glib2, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, hplip, kernel, kernel-rt, nodejs:22, perl-XML-LibXML, webkit2gtk3, and yggdrasil), Debian (kernel, nss, roundcube, rtpengine, and xz-utils), Fedora (btrbk, kernel, mupdf, nuclei, perl-Crypt-OpenSSL-X509, rust-fern, rust-ifcfg-devname, rust-routinator, rust-rpki, and rust-syslog), Mageia (tig), Oracle (.NET 10.0, .NET 8.0, .NET 9.0, acl, dovecot, glib2, httpd, libtiff, pacemaker, perl-IO-Compress, plexus-utils, python3, and webkit2gtk3), Slackware (libssh and mozilla-firefox), SUSE (acl, avahi, aws-nitro-enclaves-cli, beets, chromium, firefox, go1.25-openssl, ImageMagick, iscsiuio, kernel, kubevirt1.8-container-disk, libgit2-1_9, libkrun, libsoup-3_0-0, nghttp2, opam, php7, python-aiohttp, python-tornado6, and vim), and Ubuntu (accountsservice, CUPS, imagemagick, jbig2dec, openssh, and snapd).

Version153.0 of the Firefox web browser has been released. Notablechanges in this release include a change to the defaultlocal-file-access permissions for extensions, enabling LANrestrictions by default for all users, a visual indicator when a website has access to the user's location, the ability to merge PDFs andadd images as pages within PDFs, as well as experimental support forthe JPEG XL image format.See thereleasenotes for developers for all changes that affect web developers,and securityadvisories for vulnerabilities fixed in this release.

Like many development communities, the kernel community has been strugglingto determine how large language models will be used in its developmentprocess. The news has been dominated recently by a strongly worded missivefrom Linus Torvalds on the subject, but the discussion has been rather morewide-ranging and nuanced than that. Topics that have been consideredrecently include the LLM attribution requirement, code-review tools,dependence on proprietary tools, and whether there is a place for concernsabout the ethics of LLMs.

Security updates have been issued by AlmaLinux (capstone, fence-agents, gimp, glib2, hplip, httpd, jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base, libtiff, maven:3.8, pacemaker, python3.14, and webkit2gtk3), Debian (samba), Fedora (c-ares, dnsx, freerdp, gpsd, libreswan, libseccomp, libtiff, mingw-python-idna, mingw-python-pip, openssh, python-pillow, wget1, and wireshark), Mageia (golang, graphicsmagick, haveged, libssh2, nginx, nilfs-utils, perl-CGI-Session, perl-Imager, perl-JavaScript-Minifier-XS, php, php8.4, php8.5, python-nltk, sqlite3, and xmlstarlet), Oracle (.NET 10.0, .NET 9.0, container-tools:ol8, firefox, giflib, glibc, go-fdo-client, go-fdo-server, golang-github-openprinting-ipp-usb, grafana, grafana-pcp, hplip, httpd, image-builder, kernel, libtiff, mod_http2, pacemaker, perl-DBI:1.641, perl-HTTP-Daemon, php:8.2, python-markdown, ruby4.0, systemd, and thunderbird), Red Hat (buildah, container-tools:rhel8, dracut, golang-github-openprinting-ipp-usb, libtiff, osbuild-composer, python-urllib3, python3.12-urllib3, python3.14-urllib3, and runc), SUSE (389-ds, chromedriver, gstreamer-plugins-bad, libreoffice, libsuricata8_0_6, podman, python311, and sssd), and Ubuntu (apache2, freerdp3, freetype, libde265, libxfont, linux, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-realtime, linux-realtime-6.8, linux, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-realtime, linux-xilinx-zynqmp, linux, linux-gcp, linux-gke, linux-realtime, linux-gcp-6.17, linux-realtime-6.17, linux-gcp-fips, linux-hwe-7.0, linux-nvidia-tegra-5.15, linux-oem-7.0, nginx, php8.1, php8.3, php8.5, rlottie, sqlite3, and wget).

The Fedora Project is known for,among other things, having a well-defined set of processes for just abouteverything. It has extensive packagingguidelines that deal with the complexities of creating RPMs to installsoftware, as well as processes for managing the legal questions thatarise around shipping software. Fedora also has a well-defined changeprocess for dealing with self-contained technical changes as well as majorchanges to the distribution, and other issues as they arise. At the moment,though, the project seems to be experiencing a sort of midlife crisis as itre-examines several of its change processes at once to determine if they arestill effective.

Michael Catanzaro, who has been managing GNOME security issue tracking sinceNovember 2020, has written a blog post that details some changes in how he willbe managing GNOME vulnerability reports from now on due to an increase inAI-generated security reports. He will be switching from a 90-day deadline fordisclosures to 30 days for issues reported on August1, or later. "Theshorter deadline would probably work better for GNOME even if not for theincrease in AI-generated issue reports."He also has indicated that he will be stepping away from the task of managingsecurity issue tracking entirely by December 1, 2026, which means that therewill be a gap to fill:

The famfs filesystem, which is meant to provide shared access to hugememory-resident files on CXL and otherdevices, returned tothe Linux Storage,Filesystem, Memory Management, and BPF Summit (LSFMM+BPF) in 2026.It was first discussed at LSFMM+BPF 2024 and a new implementation was described at the 2025gathering, but it still has not made its way into the kernel; LWN lookedat a discussion about merging famfs back in April 2026.

Security updates have been issued by Debian (kernel, libnfs, roundcube, and tiff), Fedora (antlr4-project, chromium, erlang, libseccomp, libtiff, log4cxx, mbedtls, node-exporter, opam, openssh, proftpd, python-asyncssh, python-django5, python-libcst, python-orjson, python-uv-build, ruby, rust-astral_async_zip, spoofdpi, uv, and yq), Mageia (bind, clamav, erlang, libidn, libreoffice, nmap, nodejs, perl-Bytes-Random-Secure, perl-Config-IniFiles, perl-CSS-Minifier-XS, perl-HTML-Parser, perl-Mojolicious, perl-String-Util, python-pydantic-settings, rsync, and upower), Oracle (.NET 10.0, .NET 8.0, .NET 9.0, bind, cockpit, cockpit-image-builder, coreutils, delve, dnsmasq, dovecot, expat, fence-agents, flatpak, frr, gdk-pixbuf2, giflib, glib2, go-fdo-client and go-fdo-server, golang-github-openprinting-ipp-usb, grafana, grafana-pcp, httpd, jq, kernel, keylime, krb5, libcap, libexif, libpng, libsndfile, libsolv, libsoup3, libtasn1, libtiff, libxslt, libyang, mariadb10.11, mod_http2, mod_md, opencryptoki, PackageKit, perl-Archive-Tar, perl-IO-Compress, poppler, postfix, postgresql-jdbc, python-urllib3, python3.14, python3.14-pip, python3.14-urllib3, qt6-qtdeclarative, rrdtool, rsync, ruby, ruby4.0, samba, skopeo, thunderbird, valkey, wireshark, xorg-x11-server-Xwayland, and yggdrasil-worker-package-manager), and SUSE (blender, chromium, containerized-data-importer1, cyrus-imapd, go1.26-openssl, gomuks, grafana, gstreamer-plugins-bad, kbfs, kubevirt1.8-container-disk, libxml2, lux, mariadb-connector-c, nginx, opam, openssl-3, oras, perl-DBI, php-composer2, python-django-haystack, python-paramiko, python-weasyprint, python311, python313-Pillow, python315, shibboleth-sp, system-user-zabbix, and wget).

The 7.2-rc4 kernel prepatch is out fortesting. Linus said: "This whole week I had the feeling that peoplewere starting to go on summer vacation, but running the numbers shows thatI must have been wrong - it all looks pretty normal."

Adrian Mastronardi has released a book called Half a Second; it is adetailed look into the XZ backdoor attemptof 2024. The book is freely available under a (non-free) noncommercial,no-derivatives CC license.

The7.1.4,6.18.39, and6.12.96 stable kernel updates have beenreleased; each contains a fairly large set of important fixes.

Collabora has published a blogpost about its work with Valve on Holo Core, which is a port of Arch Linux toaarch64 to be used as the the operating system on Valve's64-bit Arm Steam Frame gaming system. Collabora has released thesources,binarypackages, and a container image for aarch64 devices. The postdescribes some of the challenges in porting Arch Linux to a newarchitecture, and what remains to be done:

Since 2020, BPF programs have been able toact as Linux security modules(LSMs). Several projects, including systemd, have been working to usethat capability to provide more security to users. Christian Braunerspoke at the 2026Linux Storage, Filesystem, Memory-Management, and BPF Summitabout some of the limitations of using BPF in this way, and the changes hewould like to see for systemd's use. In particular, he would like a way to makesure that BPF programs cannot be removed or have their private data tampered with.

Security updates have been issued by AlmaLinux (cifs-utils, container-tools:rhel8, libreoffice, nodejs:24, perl-XML-LibXML, and python3.12), Fedora (ansible-collection-ansible-posix, firefox, freerdp, ImageMagick, mingw-glib2, perl-DBI, perl-HTTP-Date, rust-cargo-rpmstatus, and rust-opendal), Oracle (cifs-utils, gegl, gimp, git-lfs, go-toolset:ol8, hplip, kernel, libreoffice, maven:3.9, perl-XML-LibXML, python3, python3.12, python3.9, and uek-kernel), Red Hat (kernel, kernel-rt, and podman), Slackware (netatalk), SUSE (agama, aws-nitro-enclaves-binaryblobs-upstream, gimp, gpsd, grafana, hostapd, ImageMagick, jackson-databind, kernel, libssh2_org, nm-configurator, opennlp, perl-Mojolicious, python-Pillow, python-python-engineio, python-python-socketio, and tomcat11), and Ubuntu (ntfs-3g, python-authlib, ruby2.3, tar, and ubuntu-advantage-tools).

The extensiblescheduler class (sched_ext) allows the installation of custom CPUschedulers as a set of BPF programs. While sched_ext, in its current form,has already led to a lot of interesting scheduler-development work, thesubsystem itself is still undergoing rapid evolution. Among other work,the ability to set up a hierarchy of sub-schedulers is approaching completion, anda longstanding incompatibility with proxyexecution is coming to an end.

Security updates have been issued by AlmaLinux (cups, git-lfs, kernel, libsolv, libxml2, python3.12, and python3.9), Debian (chromium, dhcpcd5, and ntfs-3g), Fedora (firefox, perl-Imager, python-bcrypt, python-tiktoken, roundcubemail, and xrdp), Mageia (openssl, poppler, python-mistune, and tmux), Oracle (389-ds-base, cups, git-lfs, glibc, host-metering, kernel, libsolv, libxml2, nginx:1.24, PackageKit, python-pillow, and qemu-kvm), Red Hat (buildah, containernetworking-plugins, and skopeo), SUSE (buildah, cosign, curl, distribution, dnsmasq, glib-networking, glibc, gnutls, gstreamer-plugins-bad, ImageMagick, kernel, podman, python-cryptography, python313-django-debug-toolbar, rekor, sccache, sssd, and yelp), and Ubuntu (dotnet8, dotnet10, libslirp, luajit, python-idna, sympa, and tomcat8).

Inside this week's LWN.net Weekly Edition:

It should come as no surprise that a gathering of filesystem developerswould discuss filesystem testing; it has been a mainstay of the Linux Storage,Filesystem, Memory Management, and BPF Summit over the years and the2026 summit was no exception. Ted Ts'o led the discussion this time; hehad a few different topics to raise, including his perception of increasingregressions for ext4 in the stable kernels and what can be done to helpreduce them. As with other similarsessions at the summit over the years,there is a lot of interest in collaborating on test inputs and outputs, butfinding a way to centralize that information has so far eluded thefilesystem community.

The SUSE Security Team Blog has a postwith an analysis of seunshare,which is used by SELinux to confine untrusted programs. During areview of version3.10 of the program, the team identified two localDenial-of-Service (DoS) vectors.

Processes that use io_uringtend to keep a lot of balls in the air; being able to have many operationsunderway at any given time is part of the point of that API in the firstplace. The io_uring subsystem must, as a result, keep track of a lot oftasks that have to be performed at the right time. In current kernels,io_uring uses a standard kernel linked-list primitive to track those workitems. As of the 7.2 kernel release, though, io_uring will, instead, use anew lockless, multi-producer, single-consumer (MPSC) queue, resulting insome notable performance gains. Lockless algorithms tend to be tricky, butthe one used here is relatively approachable and shows how these algorithmscan work.

Security updates have been issued by AlmaLinux (cifs-utils, corosync, cups, freerdp, git-lfs, go-fdo-client and go-fdo-server, go-toolset:rhel8, kernel, kernel-rt, libinput, libxml2, nginx:1.24, openssl, pacemaker, perl-DBI:1.641, php8.4, python-pillow, python3, and python3.12), Debian (grub2, libxfont, opam, and wolfssl), Fedora (freerdp, kernel, and prometheus), Mageia (imagemagick), Oracle (buildah, freerdp, gimp, kernel, nginx, openexr, openssl, perl-DBI, podman, vim, xorg-x11-server, and xorg-x11-server-Xwayland), Red Hat (python3.12), SUSE (afterburn, buildah, busybox, enc, freetype2-devel, go1.25, go1.25-openssl, go1.26-openssl, gosec, grafana, helm, krb5, kubernetes-old, libopenbabel8, libxml2, libxml2-16, nasm, openssl-3, patch, python-Authlib, python-mistune, python-soupsieve, python-sqlparse, python3-dulwich, python313-Pillow, rootlesskit, sbootutil-1, tomcat, and tomcat11), and Ubuntu (alsa-lib, dnsmasq, gnutls28, libheif, linux-aws, linux-fips, linux-lts-xenial, linux-gcp-5.15, linux-intel-iotg-5.15, linux-hwe-6.17, linux-raspi, mariadb, openvpn, python-httplib2, vim, and wget).

The CMU CERT Coordination Center has put out an advisory that manyexploitable versions of the shim binary, used to boot Linux on systems withUEFI secure boot enabled, were never added to the revocation list.

Rob Kennedy has posted thestory of the birth of Linux.org - oneof the earliest Linux-related web sites - and its more recent rebirth.

The Maintainers Summit is an annual, invitation-only gathering of kerneldevelopers and maintainers to discuss development-process issues; see LWN's 2025 Maintainers Summit coverage for anexample. The call fortopics for the 2026 gathering (Prague, October8) has gone out.One of the best ways to obtain an invitation to the Summit is with a goodtopic proposal. For best consideration, topics should be submitted beforeJuly24.

Tetragon, the BPF-based security monitoring tool,uses BPF to monitor different aspects of a running kernel andenforce user-specified policies. It sends its data to a user-space process,which forwards the data to a central monitoring service elsewhere in thenetwork, however. Thispresents a point of vulnerability: if an attacker can kill Tetragon's user-spaceagent, it won't be able to properly report on the situation. Song Liu, MaheTardy, and Liam Wiseheart spoke about their work removing the need for theuser-space agent at the 2026Linux Storage, Filesystem, Memory-Management, andBPF Summit.

Security updates have been issued by AlmaLinux (389-ds:1.4, buildah, freeipmi, freerdp, gegl, gimp, golang, kernel, libreoffice, maven:3.9, openexr, perl-DBI, plexus-utils, podman, tomcat, tomcat9, xorg-x11-server, and xorg-x11-server-Xwayland), Debian (imagemagick, p7zip, and redis), Fedora (breezy, calibre, and golang-github-openprinting-ipp-usb), Mageia (ffmpeg, gzip, haproxy, libheif, libtiff, libxml2, packages, perl-List-SomeUtils-XS, and perl-Socket), SUSE (alsa, chromedriver, curl, dhcpcd, docker-compose, glibc, haproxy, ImageMagick, jq, kernel, kubernetes, libpng15, libredwg-devel, libslirp, nghttp2, php8, python-Pillow, python313-Django, python313-weasyprint, qemu, rust-keylime, sccache, and systemd), and Ubuntu (cifs-utils, libexif, libreoffice, libssh2, openssh, and pipewire).

Cisco has some unusual challenges when it comes to deploying security patchesacross the company's many devices running custom kernels. John Fastabend spokeabout his work preventing exploits with BPF at the 2026Linux Storage,Filesystem, Memory-Management, and BPF Summit.The technique could substantially reduce the time necessary to respond to kernelvulnerabilities, but it will not be fully effective unless more hooks are addedto the kernel.

Debian hasannounced the final normal update for Debian 12 ("bookworm"). Long-term-support updates will continue until 2028. As may be expected from a stable version, the update is mostly limited to security fixes. Still, it may be time for Debian users to look into upgrading to a more recent version. Conveniently, Debian 13 ("trixie") alsoreceived an update this weekend, with many of the same security fixes.

Security updates have been issued by Debian (chromium, libxfont, mesa, opam, and wireless-regdb), Fedora (acl, attr, chromium, cjson, composer, docker-compose, jfrog-cli, librabbitmq, libssh2, libXfont2, log4cxx, OpenImageIO, openssh, p11-kit, perl-Crypt-DSA, perl-HTML-Gumbo, prometheus, python-dulwich, python-idna, python-pillow, python-tornado, sssd, tmux, upower, webkitgtk, xorg-x11-server, and xorg-x11-server-Xwayland), Mageia (libarchive and vim), Oracle (389-ds:1.4, buildah, cups, edk2, freerdp, golang, grafana, gstreamer1-plugins-bad-free, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, kernel, libexif, libsolv, libtasn1, libxml2, nginx:1.24, nginx:1.26, nodejs:22, nodejs:24, oci-seccomp-bpf-hook, podman, postgresql:18, python-urllib3, tigervnc, tomcat, unbound, and xorg-x11-server), Slackware (p11-kit), and SUSE (agama, dash, dracut, flannel, go1.26, gsasl, gstreamer-plugins-good, ImageMagick, imagemagick, kernel, krb5, krb5, krb5-mini, libIex-3_4-33, libmbedtls23, libxfont2, nasm, nghttp2, perl-CGI-Session, perl-dbi, perl-List-SomeUtils-XS, python-pillow, python-social-auth-app-django, python-urllib3, python313-Django4, python313-Django6, python313-pytest-html, python313-sqlparse, python313-websockets, rclone, rust-keylime, rustup, sccache, spectre-meltdown-checker, sssd, terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provid, thunderbird, tiff, traefik2, xorg-x11-server, and xwayland).

The 7.2-rc3 kernel prepatch is out fortesting. Linus said: "Things continue to look normal (the 'new normal'with slightly higher rates of commits, although I do get the feeling thatwe're seeing that slightly balanced out by people starting to go on summervacation)".

Our article "Fighting the AI scraper botscourge", published in early 2025, discussed the problem of widespreadscraping of web sites in search of training data for large language modelsand related projects. This activity overwhelms sites with traffic. Over ayear after that article is published, the problem is still growing. Thehammering of sites by shadowy actors has reached new heights, and the openweb is becoming increasingly difficult to maintain. Where is this trafficcoming from, and what can be done about it?

QBE, a compact compiler backend developed by Quentin Carbonneaux, is alightweight alternative to larger compiler backends such as LLVM and GCC.Designed to be small enough for a single developer to understand, QBE uses astatic single-assignment (SSA) intermediate representation (IR), supports the C ABI,and serves as the backend for projects such as Hare andthe cproc C11 compiler. Frontendsemit the textual form of QBE's IR directly; QBE then takes care of register allocation,optimization, and native-code generation, producing assembly for the targetarchitecture.

Security updates have been issued by AlmaLinux (aardvark-dns, cups, edk2, gstreamer1-plugins-bad-free, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, kernel, libsolv, libtasn1, libxml2, nginx:1.24, nginx:1.26, oci-seccomp-bpf-hook, python-urllib3, and tomcat), Debian (rlottie), Fedora (c-ares, k9s, kind, libXfont2, nmap, pam, perl-DBI, php, python-pendulum, tmux, and xorg-x11-server-Xwayland), Mageia (7zip and ack), Slackware (tigervnc), SUSE (alloy, cargo-c, chromium, clamav, cosign, dirmngr, firefox, flannel, fluidsynth, gnutls, go1.25, go1.26, gol, GraphicsMagick, helm, kernel-devel, libaom, libexif, openQA, os-autoinst, python-Django, python-idna, python-sqlparse, rust-keylime, rustup, sccache, SUSE Manager Client Tools, SUSE_Multi-Linux_Manager Client Tools, transmission, and warewulf4), and Ubuntu (curl, expat, golang-go.crypto, libheif, libidn, libraw, libsoup2.4, linux, linux-azure-4.15, linux-azure-fips, linux-fips, linux-gcp-4.15, linux-gcp-fips, linux-kvm, linux-oracle, linux-aws, linux-aws-fips, linux-azure-fips, linux-fips, linux-raspi, linux-xilinx-zynqmp, and python2.7, python3.5).

Kitty is a terminalemulator thatruns on Linux, macOS, and the BSDs, which is notable for its speed and featuressuch as image support and advanced font handling. It is under active development; arecent major release adds anew level of mouse support. Here, we will look at some of those featuresand show how the program can also be used as platform fortext-based applications. Kitty is free software, releasedunder the GPLv3.

Version1.97.0 of the Rust programming language has been released. Changesinclude using a new symbol-mangling scheme by default, support for denyingwarnings in Cargo, and an end to the practice of hiding the linker's outputafter a successful build.

Security updates have been issued by AlmaLinux (389-ds-base, aardvark-dns, buildah, compat-openssl10, freeipmi, frr, gnutls, grafana, grafana-pcp, kernel, kernel-rt, libyang, nginx, openexr, pcs, perl-HTTP-Daemon, postgresql:18, python3.14-pip, skopeo, tomcat9, and wireshark), Debian (chromium and pgextwlist), Fedora (openssh, opkssh, perl-CSS-Minifier-XS, python-jiter, python-nh3, python-pendulum, rust-jiter, and upower), Mageia (openvpn and vips), Oracle (389-ds-base, aardvark-dns, compat-openssl10, container-tools:ol8, freeipmi, kernel, libyang, perl-HTTP-Daemon, python3.14-pip, and skopeo), Slackware (libXfont2, proftpd, and xorg-server), SUSE (alloy, apache2, apptainer, assimp, chromium, clamav, docker, docker-compose, dracut, glib-networking, go-sendxmpp, go1.26-openssl, gstreamer-plugins-good, haproxy, hauler, jackson-annotations, jackson-bom, jackson-core, jackson- databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent, kernel, krb5, kubevirt, libslirp, libXfont2, mpv, libkpipewirerecord6, ffmpegthumbs-kf5, netty, netty-tcnative, openqa, os-autoinst, podman, python-maturin, python-msgpack, python313-yt-dlp, radare2, rust-keylime, systemd, systemd, systemd-mini, tomcat11, trivy, xorg-x11-server, and xwayland), and Ubuntu (apache2, clamav, linux-raspi, and mailcap).

Inside this week's LWN.net Weekly Edition:

Over on the OpenMandrivaforum, the Linux distribution has reportedsabotage of its repositories by a disgruntled contributor withadministrative credentials. According to "AngryPenguin", an abusiveincident in a distribution Matrix chat led to a user being kicked out ofthe chat; that "triggered a cascade of events", which led to peopleresigning from the distribution. Eventually, one of those people usedtheir administrative privileges to delete part of the distribution's GitHubrepository and to "publish an empty package in the cookerrepository, which obsoleted all gnome and cosmic packages, which could havedamaged the systems of people using gnome or cosmic".