LWN.net

The results of theDebian general-resolution vote on the useof large language models have been posted; the winner is choice 5:Responsible Use of Generative AI.

Konstantin Ryabitsev has written a blog post withhard numbers about the impact of AI crawlers on the Linux kernelrepositories at git.kernel.org:

Meven Car has written a pair of interesting blog posts (part1,part2). Thefirst post is largely about some of the recent new features and performance workthat have gone into the Dolphin filemanager 26.08 release, as well as the KIO framework. The second looks atthe performance improvements and benchmarks for previous, current, and upcomingreleases.

Thenull blockdriver (null_blk)is a small driver that is mostly useful for benchmarking block-layerimplementations. It accepts all requests and marks them complete as quickly aspossible, doing as little work as possible. In June2026, Andreas Hindborg shareda patch set implementing the same functionality in Rust, in order to showthat a simple block driver is now possible to write using the kernel'sRust APIs and to enable comparisons between the C and Rustimplementations.A minimal version of the "rnull" driver is already present in the mainlinekernel, but Hindborg's patch set brings it up to feature parity with the Cversion.

Greg Kroah-Hartman has announced the release of the 7.2.2, 7.1.12, 6.18.48, 6.12.107, 6.6.155, 6.1.186,5.15.219, and 5.10.268 stable kernels.Each of these contains asingle fix for avulnerability (CVE-2026-80590)that allows marking IPv4 or IPv6 fragments as GSO,which can allow an unprivileged user to cause a kernel panic. This vulnerabilityhas been present since Linux2.6.27. Users are advised to upgrade.

Security updates have been issued by AlmaLinux (assertj-core, golang, httpd, kernel, and libxml2), Debian (chromium and suricata-update), Fedora (rust-h2), Mageia (avahi and python-django), Oracle (kernel and mingw-openssl), SUSE (c-ares-devel, dracut, gh, gstreamer-plugins-bad, java-11-openjdk, liboqs, librest0_7, openssl, openssl-3, pcp, python313-mistune, python36-pip, qt6-svg, rmt-server, rsync, suseconnect-ng, texlive, tor, wicked, and xmlrpc-c), and Ubuntu (linux-azure, linux-azure-4.15, linux-azure-fips, linux-azure-6.8, linux-ibm, linux-ibm-6.8, linux-oracle-6.8, linux-raspi, linux-raspi-realtime, linux-azure-fde-5.15, linux-fips, linux-gke, linux-gcp-fips, opencryptoki, and pam).

Virtualization can increase CPU utilization by allowing a large number ofvirtual CPUs to share a smaller number of physical CPUs. The amount of CPUtime that is actually available does not change, though, so heavy activityon too many virtual CPUs can lead to contention and significant performanceloss. The steal governorpatch series from Shrikanth Hegde is an attempt to address that problemwith a mechanism that allows virtual machines to voluntarily reduce thenumber of virtual CPUs they use when contention is high.

Greg Kroah-Hartman has announced the release of the 7.2.1, 7.1.11, 6.18.47, 6.12.106, 6.6.154, 6.1.185,5.15.218, and 5.10.267 stable kernels. Each of these hasimportant updates throughout the tree; users are advised to upgrade.

Security updates have been issued by AlmaLinux (assertj-core, attr, firefox, go-toolset:rhel8, golang, grafana, gstreamer1-plugins-good, httpd, kernel, mingw-openssl, mod_http2, nginx, nginx:1.24, pam, polkit, and sqlite), Debian (bubblewrap, cockpit, emacs, gimp, libdbi-perl, openjdk-11, openjdk-17, wireshark, and xrdp), Fedora (bluez, curl, emacs, golang, knot, libopenmpt, libsoup3, openbao, openssh, rsync, rust-anstyle-hyperlink, rust-anstyle-progress, rust-cargo, rust-cargo-c, rust-cargo-credential-libsecret, rust-cargo-util, rust-cargo-util-schemas, rust-cargo-util-terminal, rust-crates-io, and rust-rustfix), Gentoo (Chromium, Google Chrome, Microsoft Edge, Opera, Chromium, Google Chrome, Microsoft Edge, Opera, Vivaldi, Chromium, Google Chrome, Microsoft Edge. Opera, and OpenRGB), Oracle (abrt, assertj-core, attr, gstreamer1-plugins-base, gstreamer1-plugins-good, httpd, nginx:1.24, nginx:1.26, nodejs24, and polkit), SUSE (apache2-mod_auth_openidc, buildah, curl, docker, dracut, evince, go1.25-openssl, go1.26-openssl, go1.27, gstreamer-plugins-bad, kernel, kubernetes, kubernetes-old, libarchive, LibVNCServer, libwireshark19, pcp, python310-pip, qemu, rootlesskit, rsync, snpguest, and util-linux), and Ubuntu (bind9, libheif, and openssl, openssl1.0).

Inside this week's LWN.net Weekly Edition:

At FOSSY 2026, several people from theSoftware Freedom Conservancy (SFC),which organizes the conference, gave a presentation about an ongoingviolation of the Affero General PublicLicense version 3 (AGPLv3). Bradley Kuhn, Karen Sandler, and DenverGingerich spoke about different aspects of the violation, which is inregard to 3D-printer software from Bambu Lab, and what is beingdone to try to provide users with alternatives. One aspect that isparticularly interesting is that the circumvention that the company isemploying is precisely what the AGPL was written to prevent.

Version 26.8 ofthe Armbian distribution for Arm hardware hasbeen released.

Security updates have been issued by AlmaLinux (firefox, gstreamer1-plugins-base, kernel, kernel-rt, and sqlite), Debian (freecad, kernel, libvncserver, and openssl), Fedora (apr-util, chromium, nnn, perl-DBI, python-tablib, python3.10, python3.11, python3.12, and sympa), Gentoo (DTrace, GNU screen, UnrealIRCd, and Vinyl Cache), Oracle (389-ds-base, attr, firefox, gegl04, grafana, gstreamer1-plugins-base, gstreamer1-plugins-good, httpd, mod_http2, nginx, pam, python-pyasn1, python-urwid, python3.12, python3.14, sqlite, and xorg-x11-server), SUSE (amazon-ecs-init, containerd, curl, distribution, dracut, ffmpeg-7, fuse-overlayfs, gd, git-lfs, go1.25-openssl, go1.26-openssl, govulncheck-vulndb, hauler, himmelblau, kernel, librest, libssh2_org, open-iscsi, openssh, patch, perl-Date-Manip, podman, postgresql14, postgresql16, python-cryptography, python-Pillow, python311, rmt-server, rootlesskit, rpm, rsync, runc, snpguest, sssd, suseconnect-ng, unbound, and util-linux), and Ubuntu (curl, ffmpeg, linux-aws-6.8, linux-azure-fde, linux-azure-fde-6.8, linux-azure-fips, linux-nvidia-tegra, linux-azure, linux-azure-fde, linux-azure, linux-azure-fde, linux-nvidia-tegra-igx, linux-azure-5.4, linux-azure-fips, linux-oracle, linux-raspi, linux-raspi-realtime, openjdk-17, openjdk-21, openjdk-25, openjdk-8, openjdk-lts, openssl, perl, and vim).

Version26.8 of the LibreOffice suite has been released.

For people who would like to experiment with the multi-kernel Linux concept, Cong Wang hasannounced therelease of mklinux v7.0-mk2.

Remind is acommand-line calendar and alarm program, with an optional Tk-based graphicalinterface, for Linux and Unix-like operating systems. It has its own scriptinglanguage that allows users to create reminders that are difficult (if notimpossible) to specify in other calendaring programs. It is wholly unsuitable for use incorporate environments that require calendar sharing and exchanging meetinginvitations; however, it may be precisely the calendaring tool for users whoprefer the command line and fast, flexible tools that can help keep track ofmessy schedules.

VanillaOS 3, an immutable desktop Linux distribution, has been released. Notablechanges in this release include support for Arm64, introduction of a VanillaOSSDK,a rewrite of the Apx packagemanager using the new SDK, and much more. LWN covered VanillaOS2 in2024.

Security updates have been issued by AlmaLinux (cups-filters, gstreamer1-plugins-base, gstreamer1-plugins-good, kernel, mrtg, NetworkManager, nginx, nginx:1.24, nodejs24, perl-Date-Manip, python-pyasn1, python-urwid, python3.12, python3.14, and qemu-kvm), Debian (erlang, thunderbird, webkit2gtk, and zfs-linux), Fedora (calibre, chromium, freeipa, java-21-openjdk, java-21-openjdk-portable, java-25-openjdk, java-latest-openjdk, jfrog-cli, kernel, libxls, nextcloud, perl-URI, and samba), Gentoo (Incus), Mageia (kernel and kernel-linus), Oracle (ansible-core, cups-filters, curl, firefox, kernel, libcupsfilters, libreoffice, mrtg, NetworkManager, perl-Date-Manip, php:8.2, php:8.3, python-urwid, python3.14, qemu-kvm, and sqlite), Red Hat (assertj-core, httpd, and osbuild-composer), SUSE (buildah, comfyui, dracut, erlang, erlang27, grafana, kernel, libssh2_org, openvswitch, perl-Dancer2-Plugin-Auth-Extensible, postgresql17, python-cryptography, python-sqlparse, python311, python313-hpack, rpm, suseconnect-ng, thunderbird, and vim), and Ubuntu (async-http-client, curl, and ffmpeg).

Practical quantum computers have been ten years away for the last severaldecades. Now, however, it's beginning to look as though they will bepossible in just a few years. Recentresearch with obfuscated results demonstrated much lower memory requirements to factorECDSA keys on a quantum computer, withwork by other researchers in the open more than halving memory use comparedto the state of the art in 2023.At the same time, computermanufacturers areboasting quantum processors that retain viable superpositions over longer periods.Given how slowly software updates filter out to stable systems, it's worthlooking at what configuration changes and protocol updates are needed to be safefrom quantum computers now.

Version 31.1 of the Emacs editor has been released. There is a long list ofchanges including the removal of the Emacs dumper, a new user Lispdirectory feature, a "Send to..." menu item in context-menu-mode, andmany other changes; see the NEWS file formore information. Mickey Petersen, author of Mastering Emacs, also hasa rundownof some of the quality-of-life features appearing in this release.

Security updates have been issued by AlmaLinux (ansible-core, cups-filters, curl, java-1.8.0-openjdk, java-17-openjdk, java-21-openjdk, java-25-openjdk, kbd, kernel, perl-Date-Manip, php:8.2, and php:8.3), Debian (designate, firefox-esr, gst-plugins-bad1.0, libnet-dns-perl, nvidia-graphics-drivers, openjdk-21, openjdk-25, spip, and thunderbird), Fedora (AusweisApp2, bluez, calibre, ceph, chromium, GitPython, kernel, pack, perl-URI, rsync, and tcpreplay), Gentoo (GNU Emacs and needrestart), Oracle (ansible-core, java-1.8.0-openjdk, java-17-openjdk, java-21-openjdk, java-25-openjdk, kbd, kernel, mysql:8.4, perl-Date-Manip, perl:5.32, and sssd), Red Hat (curl, dnsmasq, kbd, kernel, libcap, libreswan, openssh, rsync, samba, unbound, and vim), SUSE (389-ds, apptainer, avahi, bugwarden, chromium, ffmpeg-9-libavcodec-devel, firefox, firefox-esr, gimp, go1.27, helm, ignition, libarchive, libjxl-devel, libssh, multipath-tools, openssl-3, pcp, perl-Net-CIDR-Set, perl-Net-OAuth, postgresql14, postgresql15, python-msgpack, python-pyasn1, python-urllib3, python313, python313-pytest-html, redis, runc, sccache, sssd, util-linux, vim, weechat, and wget), and Ubuntu (linux-fips, linux-gcp-5.15, linux-hwe-7.0, linux-ibm, linux-kvm, linux-lowlatency, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, and linux-nvidia-6.17).

The7.1.10,6.18.46,6.12.105,6.6.153,6.1.184,5.15.217, and5.10.266stable kernels have all been released; each contains another set ofimportant fixes.

From Jeremy Allison we have thesad news of the passing of Steve French. He was the maintainer of thekernel's SMB filesystem code for many years, having only dropped thatrole due to health issues in the last week. "I've known Steve forover 20 years. He was a legend in the community, and a really goodfriend. He will be greatly missed. Farewell Steve." He will indeed be missed.

The open-source world has been struggling for a few years now to understandhow to approach large language models (LLMs) and the licensing applied tothem. What constitutes "freedom" with respect to a black box filled withnumerical weights? The process taken by the Open Source Initiative (OSI)in the development of its Open Source AIDefinition was controversial at best, as was its output. Now, theLinux Foundation's Mike Dolan has broughta new license to the OSI for approval. It is called the OpenMDW ("OpenModel, Data, and Weights"), and it aims to clarify licensing for thedistribution of LLMs and related materials, but consensus is proving hardto find for this license as well.

Security updates have been issued by AlmaLinux (ansible-core and pcp), Debian (chromium, libgit2, python-httplib2, and sabnzbdplus), Fedora (dokuwiki, domoticz, dotnet10.0, dotnet8.0, dotnet9.0, firefox, i2c-display, libgit2, lyx, ntpsec, openssh, perl-DBI, php-phpseclib3, python-alembic, python-asyncmy, python-sqlalchemy, python3.13, roundcubemail, trafficserver, wireshark, and wordpress), Red Hat (compat-openssl10, compat-openssl11, fence-agents, gnutls, kernel, kernel-rt, libarchive, libreswan, multiple packages, openssl, python-idna, python-pillow, qemu-kvm, resource-agents, rh-podman-desktop, ruby, unbound, and vim), SUSE (buildah, chromium, container-suseconnect, containerd, cosign, ctop, docker, firefox, forgejo-cli, gitea-tea, go1.25, go1.26, helm, kubernetes, kubernetes-old, kubevirt1.8, podman, python-pytest-html, python-unearth, python311, python313, rootlesskit, and rsync), and Ubuntu (linux, linux-aws, linux-aws-5.4, linux-azure, linux-bluefield, linux-fips, linux-gcp, linux-gcp-5.4, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-oracle, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-7.0, linux-ibm, linux-oem-7.0, linux-raspi, linux-realtime, linux, linux-aws, linux-aws-fips, linux-azure-fips, linux-gkeop, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-oracle, linux-oracle-5.15, linux-realtime, linux-xilinx-zynqmp, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-aws-6.8, linux-azure-5.15, linux-gcp, linux-gcp-fips, linux-hwe-5.15, linux-lowlatency-hwe-5.15, linux-gcp, linux-gcp-4.15, linux-gcp-fips, linux-gcp, linux-gke, linux-gke, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-hwe-6.8, linux-nvidia, linux-nvidia-7.0, linux-nvidia-bos, linux-raspi, linux-raspi-realtime, netty, postgresql-14, postgresql-16, postgresql-18, vim, and wget).

Quickshell is a toolkit forbuilding desktop components, such as toolbars or menus. It uses QML, which is a declarative languagefor designing GUI applications. Quickshell helps developers create graphical toolsfor common desktop use cases with a focus on ease of development. It offers aconvenient method for writing user interfaces and has been adopted by a numberof projects, such as caelestia-shell and DankMaterialShell, thatprovide desktop environments for minimal window managers like Sway and niri.

Version 26.08 ofthe KDEGearcollection of applications has been released. Notable changes in this releaseinclude improvements in the signingfeatures of Okular, improved file-groupingfeatures in the Dolphin filemanager, and a number of enhancements to the Kdenlive video editor. See the changelog fora full list of updates, enhancements, and bug fixes.

The Rust blog reportson a malicious crate, called proc-macro1, that was uploaded to thecrates.io repository.

Version 6.1.0 of the RPM Package Manager has been released. Notablechanges include the ability to provide modifiers to RPM macros at definitiontime, improved build and verification error handling, support for signing fileswith PKCS11 tokens using rpmsign, as well asthe addition of several new man pages. The 6.1.0 release also debuts a new release modelinspired by the Linux kernel's.

As of this writing, 2,346 non-merge changesets have been pulled into themainline repository for the 7.3 kernel release. That, clearly, is a meredown payment on the flood that is to come. Even so, those early pullsbrought in some noteworthy changes, including (but not limited to) asignificant reworking of how group scheduling works on multiprocessorsystems.

Security updates have been issued by AlmaLinux (bind9.18, glib2, gstreamer1-plugins-bad-free, gstreamer1-plugins-good, kernel-rt, libcupsfilters, mysql8.4, mysql:8.4, pcp, perl-Date-Manip, php8.4, php:7.4, php:8.2, php:8.3, python3, and yggdrasil), Debian (designate, firefox-esr, and swift), Gentoo (acl, attr, Emacs, libssh2, and quickjs-ng), Oracle (.NET 10.0, .NET 9.0, attr, bind9.18, curl, glib2, gstreamer1-plugins-bad-free, gstreamer1-plugins-good, kernel, libXfont2, mysql8.4, nghttp2, nodejs:22, nodejs:24, pam, pcp, perl-Date-Manip, php8.4, python3, sg3_utils, and yggdrasil), Slackware (mozilla-firefox and mozilla-thunderbird), SUSE (open-iscsi, podman, python311, and python313), and Ubuntu (bind9, capnproto, curl, libheif, libpng, libpng1.6, libssh, nginx, and tiff).

Inside this week's LWN.net Weekly Edition:

Go 1.27, the most recent version ofthe Go programming language, has been releasedwith a number of new tools, the addition of support for the ML-DSA post-quantum algorithm,new JSON-processing packages, language updates, and more.

Greg Kroah-Hartman has announced the release of the7.1.9,6.18.45,6.12.104,6.6.152,6.1.183, 5.15.216, and 5.10.265 stable kernels. Each contains importantfixes throughout the tree; users are advised to upgrade.

The Debian Project is voting on the usageof large language models (LLMs) to make contributions to the project. The firstproposal, sent in late July by Matthias Geiger, would expressly forbid anycontributions to Debian that are created by or with the assistance of LLMs. Thatkicked off a firestorm of discussion and a flood of alternate proposals. Debiandevelopers are now voting oneight proposals in total that range from banning LLM-assisted contributionsto explicitly approving them, as well as the standard "none of the above" optionthat would leave Debian with no agreed policy.

Version0.11 of the Tubafediverse client has been released. Notable changes in this release includesupport for Mastodon collectionsand quotes,ability to create custom thumbnails for attachments, a new emoji picker, a buildfor Android, as well as many other enhancements.

At the outset of his PyCon US 2026talk, Trey Hunner said that his goal was for attendees to stop representingfilesystem paths as strings and to use pathlibinstead. That's kind of a tall order, at least for longtime Python users,since string-based paths have been pervasive-and mostly work. It is that"mostly" part that makes Hunner want to see things change, of course, so heset out to describe a lesser-known corner of the language and to try tochange some minds.

Security updates have been issued by AlmaLinux (.NET 10.0, .NET 9.0, 389-ds-base, attr, curl, glib2, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, haproxy, kernel, libssh, libXfont2, nodejs22, pam, php, php8.4, sg3_utils, and unbound), Debian (librabbitmq, ruby-grape, spip, srt, and swift), Fedora (GitPython, lemonldap-ng, libgit2, libnfs, perl-Imager, perl-List-SomeUtils-XS, python3.12, python3.14, and radsecproxy), Oracle (.NET 10.0, 389-ds-base, 389-ds:1.4, bind, curl, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, haproxy, libssh, libXfont2, nodejs22, nodejs:22, pcp, and unbound), Red Hat (golang, grafana, grafana-pcp, osbuild-composer, and rhc), SUSE (erlang, forgejo-cli, go1.25, go1.26, htop, python-pypdf2, python313-tablib, and snphost), and Ubuntu (c3p0, dotnet8, dotnet10, kernel, linux, linux-aws, linux-aws-fips, linux-aws-hwe, linux-fips, linux-hwe, linux-kvm, linux, linux-aws, linux-aws-fips, linux-azure, linux-fips, linux-gcp, linux-gcp-6.8, linux-gcp-fips, linux-gkeop, linux-oracle, linux-realtime, linux-realtime-6.8, linux-xilinx, linux-hwe-7.0, linux-oracle, linux-oracle-6.17, and linux-oracle-6.8).

Version154.0 of the Firefox browser has been released. Changes includeextending local network access protections to WebSocket connections, moreflexible, per-site configuration of cookie and data clearing, and more.

The Linux kernel's user-space interface(AF_ALG) to the CryptoAPI has been linked to a number of recent high-profile security problems,including Copy Fail and successorvulnerabilities. It was deprecatedearlier this year. Eric Biggers, and other kernel developers,have been working to remove itfrom the kernel. With that in mind, the Fedora Project is planning torestrict use of AF_ALG in the next Fedora release in the hopes of nudgingremaining users of the API to prepare for its eventual removal.

Security updates have been issued by AlmaLinux (.NET 8.0, 389-ds:1.4, bind, haproxy, kernel, kernel-rt, libXfont2, nghttp2, and unbound), Debian (calibre, expat, ironic, and linux-6.12), Fedora (coturn, linux-firmware, php-phpseclib, and sqlite), Red Hat (fence-agents, osbuild-composer, pam, resource-agents, and sg3_utils), SUSE (ffmpeg, jetty-minimal, open-iscsi, python, python313-h2, python313-pysaml2, redis, redis7, rsync, sccache, texlive, and wasm-bindgen), and Ubuntu (engrampa, linux-aws-7.0, and linux-azure-fde-5.15).

Linus Torvalds releasedthe 7.2 kernel on August17, after noting that the number of fixescoming in was still "bigger than I would have wished for". In fact,7.2 was one of the busiest development cycles in the kernel's history,adding nearly 600,000 lines of code. It's time to look at some statisticsto get a handle on how the kernel's development community is changing.

This year's edition of the Free and OpenSource Software Yearly conference, better known as "FOSSY", moved north to thebeautiful (and enormous) campus of the University of British Columbia (UBC)in Vancouver, Canada from its home for the three previous editions:Portland, Oregon, in the US. There were many different types of talks atFOSSY, from deeply technical kernel-track topics, through talks on legaland community issues, to the "FOSS in Daily Life" talks. In the "Toolchainsand Other Development Tools" track, Timothy Sample gave a presentationabout bootstrappable builds,which is somewhat less well-known than its cousin, reproducible builds, though LWNdid look at the topic just over two yearsago. In short, a bootstrappable build is one that starts with a tinyprogram that can build another slightly larger program, which can build yetanother, and so on, until the entirety of a modern Linux user space isbuilt from a small seed. Ultimately, it results in code with acompletely understood origin-unlike a typical Linux user space today.

Version 5.0 of GNU Poke,a binary-data editor, has been released. This release includes anumber of improvements to the Poke compiler, additions to the Pokelanguage, as well as runtime and standard library updates. See belowfor the full list of changes.

The Software FreedomConservancy has announcedthat Mark J. Wielaard has been honored with the second annualDistinguished Service Award in Software Freedom for his many years ofservice to software freedom.

Security updates have been issued by AlmaLinux (.NET 8.0, .NET 9.0, bind, dracut, freerdp, gnome-remote-desktop, kernel, and nghttp2), Debian (apr-util, docker.io, ironic, neutron, postgresql-15, unzip, and util-linux), Fedora (chromium, jfrog-cli, jrnl, libgsasl, libsoup3, pdns, pdns-recursor, perl-Archive-Tar, php-pear-PHP-CodeSniffer, rust-bat, rust-git-delta, rust-git-interactive-rebase-tool, rust-lsd, rust-pretty-git-prompt, rust-tokei, and stunnel), Gentoo (haveged, HTTP-Daemon, nginx, NTFS-3G, Portage, PostgreSQL, and X.Org X server, XWayland), Oracle (.NET 10.0, .NET 8.0, .NET 9.0, bind, dhcpcd, dracut, grafana, iscsi-initiator-utils, kernel, nodejs:24, openssh, osbuild-composer, python-idna, ruby, and ruby4.0), Slackware (proftpd), and SUSE (7zip, afterburn, ansible-lint, bouncycastle, cargo-audit, cargo-c, chromedriver, chromium, containerized-data-importer, dnsdist, dracut-112, ffmpeg-9-libavcodec-devel, firefox, freetype2, git-cliff, glib2, go1.25, go1.26, google-guest-agent, google-osconfig-agent, gzip, himmelblau, java-1_8_0-openjdk, kernel, kernel-devel, kubeshark-cli, kubevirt1.9-continer-disk, libkrun, libXfont2, molecule, net-tools, nginx, nodejs22, nodejs24, open-iscsi, perl, pgadmin4, php-composer2, php8, python-httplib2, python-sh, python-ujson, python3-ansible-compat, python313-nltk, rrdtool, rsyslog, samba, spice-vdagent, sssd, webkit2gtk3, wireshark, and wpa_supplicant).

The 7.2 kernel has been released.Linus said:

Ihor Solodrai and Shung-Hsi Yu wrapped up the BPF track at the 2026LinuxStorage, Filesystem, Memory-Management, and BPF Summit with a pair ofsessions related to testing.Solodrai spoke about what has changed for BPF's continuous-integration (CI)testing. Yu spoke about what may beneeded to test BPF updates in stable kernels more thoroughly. TheBPF subsystem's CI tests are in a good place, they said; even so, Solodrai and Yu have ahandful of possible avenues toward enabling better test coverage in the future.

The Python Software Foundation (PSF) has announcedthe candidatesrunning for the Python packaging council that was approved by the Python steering councilin April.

Security updates have been issued by AlmaLinux (.NET 10.0, .NET 8.0, .NET 9.0, bind, bind9.16, and dracut), Debian (apr-util, chromium, postgresql-17, python-httplib2, unzip, and zip), Fedora (erlang-cowboy, erlang-cowlib, flatpak, and libnfs), Gentoo (Apache HTTPD, Bubblewrap, Dnsmasq, Exim, Flatpak, libinput, and rsync), Mageia (dhcpcd, qemu, and roundcubemail), Oracle (.NET 8.0, .NET 9.0, bind, bind9.16, freerdp, glib2, gnome-remote-desktop, grafana, gstreamer1-plugins-good, isns-utils, java-17-openjdk, kernel, libpng, libXfont2, nghttp2, perl-DBI:1.641, python-idna, python3.9, and xorg-x11-server), Slackware (rsync), SUSE (bouncycastle, chromium, dnsdist, dracut, java-1_8_0-ibm, kernel, libXfont2, nodejs22, nodejs24, php8, python-httplib2, rrdtool, rsyslog, samba, and wireshark), and Ubuntu (linux, linux-aws, linux-kvm, linux-aws-hwe, linux-aws-hwe, linux-azure, linux-gcp, linux-hwe, linux-azure, linux-gcp, linux-hwe, linux-oracle, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-nvidia-tegra, linux-oracle, linux-nvidia-tegra-igx, linux-oem-7.0, linux-oracle, and node-axios).