The Fedora Project is known for,among other things, having a well-defined set of processes for just abouteverything. It has extensive packagingguidelines that deal with the complexities of creating RPMs to installsoftware, as well as processes for managing the legal questions thatarise around shipping software. Fedora also has a well-defined changeprocess for dealing with self-contained technical changes as well as majorchanges to the distribution, and other issues as they arise. At the moment,though, the project seems to be experiencing a sort of midlife crisis as itre-examines several of its change processes at once to determine if they arestill effective.
Michael Catanzaro, who has been managing GNOME security issue tracking sinceNovember 2020, has written a blog post that details some changes in how he willbe managing GNOME vulnerability reports from now on due to an increase inAI-generated security reports. He will be switching from a 90-day deadline fordisclosures to 30 days for issues reported on August1, or later. "Theshorter deadline would probably work better for GNOME even if not for theincrease in AI-generated issue reports."He also has indicated that he will be stepping away from the task of managingsecurity issue tracking entirely by December 1, 2026, which means that therewill be a gap to fill:
The famfs filesystem, which is meant to provide shared access to hugememory-resident files on CXL and otherdevices, returned tothe Linux Storage,Filesystem, Memory Management, and BPF Summit (LSFMM+BPF) in 2026.It was first discussed at LSFMM+BPF 2024 and a new implementation was described at the 2025gathering, but it still has not made its way into the kernel; LWN lookedat a discussion about merging famfs back in April 2026.
The 7.2-rc4 kernel prepatch is out fortesting. Linus said: "This whole week I had the feeling that peoplewere starting to go on summer vacation, but running the numbers shows thatI must have been wrong - it all looks pretty normal."
Adrian Mastronardi has released a book called Half a Second; it is adetailed look into the XZ backdoor attemptof 2024. The book is freely available under a (non-free) noncommercial,no-derivatives CC license.
Collabora has published a blogpost about its work with Valve on Holo Core, which is a port of Arch Linux toaarch64 to be used as the the operating system on Valve's64-bit Arm Steam Frame gaming system. Collabora has released thesources,binarypackages, and a container image for aarch64 devices. The postdescribes some of the challenges in porting Arch Linux to a newarchitecture, and what remains to be done:
Since 2020, BPF programs have been able toact as Linux security modules(LSMs). Several projects, including systemd, have been working to usethat capability to provide more security to users. Christian Braunerspoke at the 2026Linux Storage, Filesystem, Memory-Management, and BPF Summitabout some of the limitations of using BPF in this way, and the changes hewould like to see for systemd's use. In particular, he would like a way to makesure that BPF programs cannot be removed or have their private data tampered with.
The extensiblescheduler class (sched_ext) allows the installation of custom CPUschedulers as a set of BPF programs. While sched_ext, in its current form,has already led to a lot of interesting scheduler-development work, thesubsystem itself is still undergoing rapid evolution. Among other work,the ability to set up a hierarchy of sub-schedulers is approaching completion, anda longstanding incompatibility with proxyexecution is coming to an end.
It should come as no surprise that a gathering of filesystem developerswould discuss filesystem testing; it has been a mainstay of the Linux Storage,Filesystem, Memory Management, and BPF Summit over the years and the2026 summit was no exception. Ted Ts'o led the discussion this time; hehad a few different topics to raise, including his perception of increasingregressions for ext4 in the stable kernels and what can be done to helpreduce them. As with other similarsessions at the summit over the years,there is a lot of interest in collaborating on test inputs and outputs, butfinding a way to centralize that information has so far eluded thefilesystem community.
The SUSE Security Team Blog has a postwith an analysis of seunshare,which is used by SELinux to confine untrusted programs. During areview of version3.10 of the program, the team identified two localDenial-of-Service (DoS) vectors.
Processes that use io_uringtend to keep a lot of balls in the air; being able to have many operationsunderway at any given time is part of the point of that API in the firstplace. The io_uring subsystem must, as a result, keep track of a lot oftasks that have to be performed at the right time. In current kernels,io_uring uses a standard kernel linked-list primitive to track those workitems. As of the 7.2 kernel release, though, io_uring will, instead, use anew lockless, multi-producer, single-consumer (MPSC) queue, resulting insome notable performance gains. Lockless algorithms tend to be tricky, butthe one used here is relatively approachable and shows how these algorithmscan work.
The CMU CERT Coordination Center has put out an advisory that manyexploitable versions of the shim binary, used to boot Linux on systems withUEFI secure boot enabled, were never added to the revocation list.
The Maintainers Summit is an annual, invitation-only gathering of kerneldevelopers and maintainers to discuss development-process issues; see LWN's 2025 Maintainers Summit coverage for anexample. The call fortopics for the 2026 gathering (Prague, October8) has gone out.One of the best ways to obtain an invitation to the Summit is with a goodtopic proposal. For best consideration, topics should be submitted beforeJuly24.
Tetragon, the BPF-based security monitoring tool,uses BPF to monitor different aspects of a running kernel andenforce user-specified policies. It sends its data to a user-space process,which forwards the data to a central monitoring service elsewhere in thenetwork, however. Thispresents a point of vulnerability: if an attacker can kill Tetragon's user-spaceagent, it won't be able to properly report on the situation. Song Liu, MaheTardy, and Liam Wiseheart spoke about their work removing the need for theuser-space agent at the 2026Linux Storage, Filesystem, Memory-Management, andBPF Summit.
Cisco has some unusual challenges when it comes to deploying security patchesacross the company's many devices running custom kernels. John Fastabend spokeabout his work preventing exploits with BPF at the 2026Linux Storage,Filesystem, Memory-Management, and BPF Summit.The technique could substantially reduce the time necessary to respond to kernelvulnerabilities, but it will not be fully effective unless more hooks are addedto the kernel.
Debian hasannounced the final normal update for Debian 12 ("bookworm"). Long-term-support updates will continue until 2028. As may be expected from a stable version, the update is mostly limited to security fixes. Still, it may be time for Debian users to look into upgrading to a more recent version. Conveniently, Debian 13 ("trixie") alsoreceived an update this weekend, with many of the same security fixes.
The 7.2-rc3 kernel prepatch is out fortesting. Linus said: "Things continue to look normal (the 'new normal'with slightly higher rates of commits, although I do get the feeling thatwe're seeing that slightly balanced out by people starting to go on summervacation)".
Our article "Fighting the AI scraper botscourge", published in early 2025, discussed the problem of widespreadscraping of web sites in search of training data for large language modelsand related projects. This activity overwhelms sites with traffic. Over ayear after that article is published, the problem is still growing. Thehammering of sites by shadowy actors has reached new heights, and the openweb is becoming increasingly difficult to maintain. Where is this trafficcoming from, and what can be done about it?
QBE, a compact compiler backend developed by Quentin Carbonneaux, is alightweight alternative to larger compiler backends such as LLVM and GCC.Designed to be small enough for a single developer to understand, QBE uses astatic single-assignment (SSA) intermediate representation (IR), supports the C ABI,and serves as the backend for projects such as Hare andthe cproc C11 compiler. Frontendsemit the textual form of QBE's IR directly; QBE then takes care of register allocation,optimization, and native-code generation, producing assembly for the targetarchitecture.
Kitty is a terminalemulator thatruns on Linux, macOS, and the BSDs, which is notable for its speed and featuressuch as image support and advanced font handling. It is under active development; arecent major release adds anew level of mouse support. Here, we will look at some of those featuresand show how the program can also be used as platform fortext-based applications. Kitty is free software, releasedunder the GPLv3.
Version1.97.0 of the Rust programming language has been released. Changesinclude using a new symbol-mangling scheme by default, support for denyingwarnings in Cargo, and an end to the practice of hiding the linker's outputafter a successful build.
Over on the OpenMandrivaforum, the Linux distribution has reportedsabotage of its repositories by a disgruntled contributor withadministrative credentials. According to "AngryPenguin", an abusiveincident in a distribution Matrix chat led to a user being kicked out ofthe chat; that "triggered a cascade of events", which led to peopleresigning from the distribution. Eventually, one of those people usedtheir administrative privileges to delete part of the distribution's GitHubrepository and to "publish an empty package in the cookerrepository, which obsoleted all gnome and cosmic packages, which could havedamaged the systems of people using gnome or cosmic".
At the 2026 Linux Security Summit North America, Eric Biggers spoke aboutsome of the problems with the kernel's cryptography framework, as wellas the recent progress in adding library APIs to allow developers touse cryptographic functions without using the traditional cryptoAPI. He walked through a couple of examples to demonstrate thefrailty of the original API and showed how the new library API madelife easier for developers and kernel maintainers.
William Woodruff, better known online as "yossarian", has publisheda blog post to make the case that users should not place their trustin trustedpublishing:
Puranjay Mohan shared some of thework he's been doing recently on improving theperformance of read-copy-update (RCU) at the 2026LinuxStorage, Filesystem, Memory-Management, and BPF Summit; his talk would havebeen nice context to have earlier in the day when Harry Yoo and AlexeiStarovoitov led a session about thenew kmalloc_nolock() function thatallows for lockless allocation from any kernel context, and which interacts withthe RCU subsystem to allow that. This article therefore covers the two sessionstogether and in the reverse order, to provide that missing context.
OpenSSH 10.4 has been released. In addition to a number of securityand bug fixes, there are a few notable changes; this release addsexperimental support for a composite post-quantum signature schemecombining ML-DSA 44 and Ed25519 as described in thisIETF draft. With 10.4, if OpenSSH is compiled with sandbox supportit will fail on Linux systems that have not enabled SECCOMPor NO_NEW_PRIVS; prior to this release, sshd would log an errorbut continue operation. See the release notes fora full list of changes.
Conversations about the kernel's filesystem implementations often involve alayer called "iomap", but relatively few people can reliably say what iomapactually is. That is just the kind of gap that LWN exists to fill. Inshort, iomap handles the mapping between data in the filesystem space(identified by a file of interest, and an offset within that file) and inthe storage space (which may be a memory location, or a set of blocks on astorage device). Using that mapping, iomap handles a long list of common,filesystem-related tasks, allowing a lot of boilerplate code to be removedfrom individual filesystem implementations.
The 7.2-rc2 kernel prepatch is out fortesting. Linus said: "It's Sunday afternoon, and rc2 is out. Thingslook very normal - it's not a small rc2, but it's in line with recentreleases, and slightly smaller than rc2 was in 7.1. Let's see how that allcontinues, but so far so good."
Greg Kroah-Hartman has announced the release of the 7.1.3, 6.18.38, 6.12.95, 6.6.144, 6.1.177, 5.15.211, and 5.10.260 stable kernels. Several kernelsin this batch include afix for a vulnerability introduced in the 6.0 kernel in IPv6 (CVE-2026-53362),which couldallow an attacker to escape a container and gain root access.There is also afix for a use-after-free bug in KVM (CVE-2026-53359)that was introduced in the 2.6.36 kernel. As usual, each stable kernel includesa number of fixes throughout the tree. Users are advised toupgrade.
The GNU Guix project has announcedthree vulnerabilities in the guix substitute utility as wellas a fourth that affects the guix pull and guixtime-machine commands. The impact of the vulnerabilities ranges from remote privilegeescalation to local disclosure of sensitive files.
A number of problems related to negative directory entries (dentries) werethe topic of a filesystem-track session atthe 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit. Negative dentries areused to indicate that a file of a given name does not exist in a directory;it is an optimization that short-circuits the lookup of the file name whenthe answer is already known.Miklos Szeredi led asession that discussedsome problems that come from having too many negative dentries for adirectory.
In August 2025, the CalyxOS privacy-focusedAndroid distribution announcedthat it was pausing all releases while it reworked itsrelease process, security protocols, and changed its signing keysfollowing the departure of one of its founders. The project has now announcedthat it is "officially back from the hiatus" with the7.2.2.0 release.
A few astute observers have noticed that somecontent on kernel.org had disappeared and were understandablyconcerned. Konstantin Ryabitsev has provided an update viasocial.kernel.org:
We were made aware today of an email sent to a reader that wasspoofed to appear to be from LWN. The message claimed, among otherthings, that we were providing personal information about the readerto another site user. As is explained in our privacy policy we do not,and would not, provide such information.If any other readers have received an odd message from LWN, it isan attempt at a hoax; if in doubt, please check the DKIM header of theemail. Any email that does come from LWN will have a proper DKIMsignature in its headers.If you receive such a message, please feel free to send it to us,with its headers intact. But to reiterate, we are not providing anyuser information upon request, nor banning any accounts. We hope thiswill not be a recurring problem.
LWN.net