LWN.net

The 7.2 kernel has been released.Linus said:

Ihor Solodrai and Shung-Hsi Yu wrapped up the BPF track at the 2026LinuxStorage, Filesystem, Memory-Management, and BPF Summit with a pair ofsessions related to testing.Solodrai spoke about what has changed for BPF's continuous-integration (CI)testing. Yu spoke about what may beneeded to test BPF updates in stable kernels more thoroughly. TheBPF subsystem's CI tests are in a good place, they said; even so, Solodrai and Yu have ahandful of possible avenues toward enabling better test coverage in the future.

The Python Software Foundation (PSF) has announcedthe candidatesrunning for the Python packaging council that was approved by the Python steering councilin April.

Security updates have been issued by AlmaLinux (.NET 10.0, .NET 8.0, .NET 9.0, bind, bind9.16, and dracut), Debian (apr-util, chromium, postgresql-17, python-httplib2, unzip, and zip), Fedora (erlang-cowboy, erlang-cowlib, flatpak, and libnfs), Gentoo (Apache HTTPD, Bubblewrap, Dnsmasq, Exim, Flatpak, libinput, and rsync), Mageia (dhcpcd, qemu, and roundcubemail), Oracle (.NET 8.0, .NET 9.0, bind, bind9.16, freerdp, glib2, gnome-remote-desktop, grafana, gstreamer1-plugins-good, isns-utils, java-17-openjdk, kernel, libpng, libXfont2, nghttp2, perl-DBI:1.641, python-idna, python3.9, and xorg-x11-server), Slackware (rsync), SUSE (bouncycastle, chromium, dnsdist, dracut, java-1_8_0-ibm, kernel, libXfont2, nodejs22, nodejs24, php8, python-httplib2, rrdtool, rsyslog, samba, and wireshark), and Ubuntu (linux, linux-aws, linux-kvm, linux-aws-hwe, linux-aws-hwe, linux-azure, linux-gcp, linux-hwe, linux-azure, linux-gcp, linux-hwe, linux-oracle, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-nvidia-tegra, linux-oracle, linux-nvidia-tegra-igx, linux-oem-7.0, linux-oracle, and node-axios).

Christopher Domas haspublished a proof of concept with a description showing how to use AMD memory controllers' bank swizzle mode to bypass memory protection and read or write arbitrary data, including CPU microcode definitions and memory belonging to the platform security processor. Among other things, this allows code running at the kernel level to directly manipulate the meaning of processor instructions, potentially bypassing other security measures such as memory encryption and virtual machine isolation.This is not, strictly, unexpected behavior: it is documented in AMD's manual (on page 113 of that PDF). But the fact that it can be used to access arbitrary memory and thereby rewrite supposedly immutable parts of the computer's firmware without crashing the host machine seems like an unintentional side-effect of the design. Fortunately, since enabling bank swizzle mode requires kernel-level privileges, the vulnerability is not an immediate problem for most software. Still, it seems likely that this technique will end up being used for nefarious purposes eventually.

Version3.5.0 of rsync has been released with a hugenumber of security fixes:

The size of a processor's page-table entries directly limits how muchphysical memory that processor is able to access. Back in the 32-bit days,that limit was 4GB, an amount of memory that once seemed nearly infinite,but which would now struggle to hold a basic AI-enabled "hello world" app.The expansion to 64bits on most popular architectures would seem tohave removed those limits now; some Arm systems, for example, can use56of those bits to access up to 72PB of memory. So it might besurprising that the Arm architecture is evolving to support even largerpage-table entries (PTEs). Thispatch set from Anshuman Khandual adds support for 128-bit PTEs, butwho will benefit from this capability is not entirely clear.

Security updates have been issued by AlmaLinux (abrt, dhcpcd, edk2, freerdp, gegl04, grafana, gstreamer1-plugins-good, iscsi-initiator-utils, isns-utils, kernel, kernel-rt, keylime, libarchive, libyang, nodejs-nodemon, opencryptoki, osbuild-composer, pacemaker, postgresql-jdbc, postgresql18, python-idna, python3.9, udisks2, valkey, vim, xorg-x11-server-Xwayland, and yggdrasil-worker-package-manager), Debian (flatpak, lemonldap-ng, neutron, python-django, spip, xdg-dbus-proxy, and xorg-server), Fedora (apr-util, cri-o1.34, libcupsfilters, linux-firmware, sqlite, and vaultwarden), Gentoo (FreeType), Oracle (dovecot, evince, fence-agents, gnutls, gstreamer1-plugins-bad-free, gstreamer1-plugins-good, isns-utils, java-1.8.0-openjdk, kernel, libarchive, osbuild-composer, pipewire, postgresql, ruby, ruby:3.3, sudo, and udisks2), Red Hat (bind, bind9.16, gnome-remote-desktop, grafana, opentelemetry-collector, python-pillow, python3, python3.12, python3.14, python3.9, and rhc), SUSE (chromium, clusterctl, dracut, gd, git-cliff, gleam, govulncheck-vulndb, graphicsmagick, gzip, kernel, kubevirt, libheif, librest0_7, nodejs22, nodejs24, openssh, openvpn, python3, python313-scikit-learn, rpm, stunnel, and zk), and Ubuntu (kernel, libgit2, linux, linux-aws, linux-aws-fips, linux-azure, linux-azure-6.8, linux-azure-fde, linux-azure-fde-6.8, linux-azure-fips, linux-fips, linux-gcp, linux-gcp-6.8, linux-gcp-fips, linux-gke, linux-gkeop, linux-ibm, linux-ibm-6.8, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-realtime, linux-realtime-6.8, linux-xilinx, linux, linux-aws, linux-aws-fips, linux-azure, linux-azure-fde, linux-azure-fips, linux-gkeop, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-oracle-5.15, linux-realtime, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-fips, linux-azure-4.15, linux-azure-fips, linux-fips, linux-gcp-4.15, linux-gcp-fips, linux-kvm, linux, linux-aws, linux-azure, linux-azure-fde, linux-ibm, linux-oracle, linux-raspi, linux-realtime, linux-azure, linux-azure-6.17, linux-gcp-6.17, linux-hwe-6.17, linux-oem-6.17, linux-realtime-6.17, node-follow-redirects, and yelp).

Inside this week's LWN.net Weekly Edition:

Storage code has to cope with hardware that fails in inconvenientways, but coaxing a healthy disk into producing those failures ondemand, for testing, is usually not possible. The kernelprovides several ways to inject block-layer I/O errors, but none of those can select the operation to fail, pick the status code to return, or target a diskdirectly without employing a stacked device on top. Use of a stacked device meansthe test runs against the mapper device, not the disk it was meant toexercise. A patchseries from Christoph Hellwig adds a configurable error-injectioninterface that does all three things that the current error-injection codelacks, controlled by a per-disk debugfsfile.

There are a number of small,inexpensive, low-powered e-reader or e-paper devices that have promise asebook readers with one minor problem: the firmware they ship with does notrealize their full potential. To solve that problem, the CrossPoint Reader project looks toprovide replacement firmware that offers necessary features, better performance,and a more pleasant reading experience. On August7, the project released version1.5.0, which opens large EPUBs more quickly, providesoffline dictionary lookups, and has reworked settings for changing layout andfont options. The release also improves support for right-to-left text as wellas Chinese, Japanese, andKorean (CJK) text rendering.

Version11.1 of the QEMU emulator has been released. The release containsmore than 3,200 commits from 285 authors and includes a long list ofimprovements; see the announcement and changelog for thedetails.

Security updates have been issued by AlmaLinux (fence-agents, firefox, frr10, gstreamer1-plugins-good, iscsi-initiator-utils, isns-utils, kernel, kernel-rt, perl-DBI:1.641, postgresql, postgresql:12, and resource-agents), Debian (libgd2, openjdk-25, php7.4, php8.2, and postfix), Fedora (clamav, domoticz, and libidn), Red Hat (delve, edk2, firefox, go-fdo-client, go-fdo-server, grafana, host-metering, ignition, kernel, kernel package, kernel-rt, ldns, libarchive, mariadb10.11, mariadb:10.11, multiple packages, rhc, rhc-worker-playbook, rhc-worker-script, sssd, thunderbird, yggdrasil, and yggdrasil-worker-package-manager), Slackware (expat and openssh), and SUSE (avahi, chromedriver, erlang26, gawk, glib2, go-sendxmpp, google-guest-agent, google-osconfig-agent, gpg2, gstreamer-plugins-bad, gstreamer-plugins-base, helm, ignition, ImageMagick, java-11-openj9, java-17-openj9, java-1_8_0-openj9, java-21-openj9, java-25-openj9, libarchive, libkrun, libpcp-devel, libpng16, libssh, libssh2_org, multipath-tools, net-tools, nmap, openssl-1_1, openssl-3, pcp, perl, python-pip, python-pyasn1, python-urllib3, python3-pip, python313-Django5, runc, samba, snpguest, spice-vdagent, sssd, unbound, wget, wild, wpa_supplicant, xmlrpc-c, and zpaqfranz).

Virtualization places a guest system into a separate security domain,typically with less privileges than software running directly on the host.Increasingly, there is interest in creating multiple security domainswithin a single virtualized system as well. CPU vendors (and softwarevendors too) are implementing solutions; each of which, of course, isdifferent from all of the others. KVM planes, currently under developmentby Jorg Rodel, Paolo Bonzini, and others in the KVM community, is anattempt to provide an abstraction layer that makes all of these featuresavailable on Linux systems; it is not a small task.

GNOME contributor Tobias Bernard has publisheda blog post that details some of the design team's ideas for theGNOME Shell over the long term:

Security updates have been issued by AlmaLinux (gpsd), Debian (caddy, libyaml-syck-perl, nss, and wordpress), Fedora (chezmoi, chromium, emacs, kernel, knot, libcupsfilters, mingw-gstreamer1-plugins-good, mingw-libidn, mingw-python-pip, nghttp2, p11-kit, python-webob, suricata, and xen), Mageia (bind, openslide, php8.4, and php8.5), Oracle (gpsd-minimal, kernel, libarchive, libpng12, nodejs-nodemon, php:8.3, ruby:3.3, and ruby:4.0), SUSE (agama-web-ui, bind, bouncycastle, dhcpcd, ffmpeg, ffmpeg-4, freerdp, gd, gitoxide, kak-lsp, kernel-devel, librest-1_0-0, libsdb2_5_0, libssh2_org, nodejs22, PackageKit, perl, perl-Date-Manip, python-ujson, python3-sqlparse, python311, python312, python313-pymongo, ruby2.5, runc, suseconnect-ng, thunderbird, vlang, webkit2gtk3, and weechat), and Ubuntu (imagemagick and systemd).

BPF offers useful safety guarantees, but Kumar Kartikeya Dwivedi wants BPFprograms to be even safer. At the 2026Linux Storage, Filesystem,Memory-Management, and BPF Summit, he led a session(slides)discussing the possibilityof adding domain-specific invariants to BPF programs. It was not a discussionintended to lead to the implementation of any particular kernel feature, butrather an overview of why additional formal verification might be needed, andhow it could work with the existing BPF ecosystem.

The Django Python web-frameworkproject has announcedthat it has accepted an annualrelease cycle proposal. This means that the project is moving from a somewhatcomplicated schedule that interspersed short-lived feature releases andlong-term-support (LTS) releases to a simpler annual cycle where each release issupported for three years.

Security updates have been issued by AlmaLinux (firefox, gpsd-minimal, kernel, libarchive, libgcrypt, and LibRaw), Debian (bind9, ca-certificates, chromium, dnsdist, icinga2, kitty, libheif, openjdk-21, pdns, pdns-recursor, thunderbird, and xen), Fedora (bird, erlang, kernel, mingw-glib2, nghttp2, p11-kit, perl, perl-Devel-Cover, perl-PAR-Packer, pgadmin4, polymake, python-nh3, python-wsgidav, python3.12, rabbitmq-server, rust-ammonia, seamonkey, and udisks2), Mageia (python-starlette), Oracle (gnutls, kernel, and LibRaw), Red Hat (container-tools:rhel8), Slackware (wpa_supplicant), and SUSE (azure-storage-azcopy, bouncycastle, ffmpeg-4, fuse-overlayfs, gleam, gstreamer-plugins-bad, libssh2-1, libssh2_org, libwireshark19, libXfont2-2, perl-Mojo-JWT, perl-Mojolicious, podman, python310, python313-Django4, and tekton-cli).

The 7.2-rc7 kernel prepatch is out fortesting. It is still bigger than Linus would like, but he saidnonetheless: "I don't currently see any value in delaying the 7.2release, so I would expect that to happen next weekend unless somethingreally bad pops up."

The7.1.8,6.18.44,6.12.103, and6.6.151stable kernels have been released; each contains a fair number of importantfixes.

The shadow-utilsproject provides the tools that handle /etc/shadow,/etc/passwd, and other related databases; ingeneral, it manages users and groups on many Linux systems. While mostsoftware releases are notable for what is added, the recent shadow-utils4.20.0release is most noteworthy for what has been removed. Specifically,several utilities and functionality related to periodic passwordexpiry, which were deprecated in the December 2025 4.19.0release, have been removed as planned. It is still possible to managesome aspects of password aging with shadow-utils, but organizationsthat depend on such features should start planning for their completeremoval within a few years.

The Software Stewardship Lab, anonprofit organization based in Scotland, has announcedits existence.

Version1.33.0 of the LightDMdisplay manager has been released. This is the firstrelease in four years: the project had been sponsored by Canonicalbut was effectivelyunmaintained in recent years. It has been transferredto a new community repository and is now maintained by JoshuaPeisach and Neal Gompa.The new release includes Qt6 support, code optimizations, and alist of other fixes that had been in limbo pending a new release.

Greg Kroah-Hartman has announced the release of the 6.12.102, 6.6.150, 6.1.182, 5.15.215, 5.10.264 stable kernels. This round ofstable kernel releases contains a fix for a single bug, foundby Thomas Lamprecht, that affected several of the kernels released yesterday inresponse to a securityvulnerability (CVE-2026-68480)that could allow data leakage through speculative execution.The 6.12.102 release adds the backported security fix for CVE-2026-68480 to the 6.12series. As always, users are advised to upgrade.

Security updates have been issued by AlmaLinux (compat-libtiff3, fence-agents, firefox, freerdp, frr, gimp, gstreamer1-plugins-bad-free, java-25-openjdk, kernel, kernel-rt, ldns, libgcrypt, libXfont2, nodejs:22, nodejs:24, p11-kit, pipewire, resource-agents, sg3_utils, thunderbird, and yelp), Debian (async-http-client, jq, kernel, linux-6.1, linux-6.12, redis, and udisks2), Fedora (abrt, chromium, coreutils, curl, freeipa, gst-devtools, gst-editing-services, gstreamer1, gstreamer1-doc, gstreamer1-plugin-libav, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, gstreamer1-rtsp-server, ImageMagick, kernel, libXfont2, php, python-gstreamer1, samba, tcpreplay, and trafficserver), Mageia (firefox, nss, rootcerts, python-django, and thunderbird), Oracle (freerdp, gimp, gpsd, kernel, kernel-uek, and osbuild-composer), Red Hat (buildah and container-tools:rhel8), Slackware (libXfont2 and p11-kit), and SUSE (amazon-ecs-init, azure-storage-azcopy, bind, bouncycastle, cockpit-repos, cockpit-subscriptions, dnsdist, ffmpeg-4, hawk-apiserver, nodejs22, nodejs24, OpenImageIO, openssl-1_1, openssl-3, perl-Mojo-JWT, php8, rsyslog, sssd, and wireshark).

Greg Kroah-Hartman has announced the release of the 7.1.7, 6.18.43, 6.6.149, 6.1.181, 5.15.214, and 5.10.263 stable kernels. These kernelsfix a singlesecurity vulnerability (CVE-2026-68480)that could allow data leakage through speculative execution. Users ofthose kernels are advised to upgrade.

The kernel is able to run a few types of executable files, including nativebinaries in the ELF format and interpreted programs that begin with the#! marker. It also, however, has a mechanism, called binfmt_misc,that can be configured from user space to enable the transparent executionof programs in just about any format. This feature has been relativelystatic for years, but it seems likely to receive some significant updatesin the near future, including the ability to load BPF programs that candecide how to run a given program.

Version0.10 of the uutils project's Rust Coreutils has been released. Thisrelease focused on compatibility with the GNU Core Utilities suite,with Rust Coreutils now passing 645 of 690 tests, up from 625 with version0.9.0. Notablechanges in this release include addition of the mv--exchangeoption, an OpenSSL backend for checksum utilities, applying SELinux labels atcreation when using mkdir, mkfifo, and mknod, as wellas a number of performance and security improvements.The project has anonline playground that runs theRust Coreutils directly in the browser via WebAssembly for those who would liketo try the utilities without installing them. LWN covered the uutils project inFebruary 2025.

Security updates have been issued by Debian (7zip, kernel, libde265, and p7zip), Mageia (tomcat), Oracle (fence-agents, frr10, kernel, ldns, libgcrypt, mingw-glib2, nodejs24, osbuild-composer, p11-kit, php8.4, sg3_utils, and thunderbird), Red Hat (libXfont2), and SUSE (containerd, evince, libXfont2, nginx, openssl-3, pcp, php7, php8, python-Django, python-httplib2, python-nltk, rrdtool, vifm, and wireshark).

Inside this week's LWN.net Weekly Edition:

Konstantin Ryabitsev has announced the release of version 0.16.0 of the b4 software-development tool. The biggest change is the addition ofbug-tracking support:

Jordan Rife's work involves writing BPF programs forCilium that interface withKubernetesnetworking. As part of that work, he wants to enable BPF programs withappropriate permissions to iterate through the sockets of a different networknamespace. He led a session about the idea at the 2026Linux Storage,Filesystem, Memory-Management, and BPF Summit where the BPF developers inattendance were quick to suggest a number of related alternatives.

Filesystem inUserspace (FUSE) maintainer Miklos Szeredi led a birds-of-a-feather(BoF) discussion about the subsystem atthe 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit. In it, he talked aboutmaintenance challenges, proposed features and their status, and his plansfor a new FUSE API. There is a lot of interest and activity in theFUSE community these days it seems.

Jynn Nelson describesthe Rust language team's new LLM policy on the Inside Rust blog.

Security updates have been issued by AlmaLinux (fence-agents, gstreamer1-plugins-good, kernel, kernel-rt, p11-kit, perl-Archive-Tar, perl-DBI, and thunderbird), Debian (aom, botan3, and kernel), Fedora (abrt, coreutils, doctl, kernel, open62541, perl, perl-Devel-Cover, perl-PAR-Packer, and polymake), Mageia (acl and php), Oracle (firefox, frr, kernel, libreswan, nodejs-nodemon, nodejs22, perl-Archive-Tar, php:7.4, php:8.2, rsync, and thunderbird), Red Hat (compat-libtiff3, libpq, libtiff, postgresql, postgresql16, postgresql18, postgresql:12, postgresql:13, postgresql:15, postgresql:16, and postgresql:18), Slackware (stunnel), and SUSE (alloy, alsa, bind, chromedriver, corepack24, ffmpeg-4, golang-github-prometheus-prometheus, google-guest-agent, google-osconfig-agent, kubevirt, libgcrypt, libpng16, multipath-tools, netty, netty-tcnative, nodejs26, openssl-1_1, openssl-3, perl-HTTP-Tiny, perl-YAML-Syck, podman, python-sh, python-ujson, rsyslog, spice-vdagent, thrift, valkey, wpa_supplicant, and xen).

The AI Security Institute has released adetailed report on an security incident of its own making. TheInstitute set some LLM agents loose on the Internet with a securitychallenge; soon they were creating malware-laden pull requests andsock-puppet accounts to promote them.

The FedoraCouncil is consideringa conflict-of-interest (COI) policy for its decision-making bodies,such as the Fedora EngineeringSteering Committee (FESCo), special-interest groups (SIGs), andany other groups or individuals that report to the council andare responsible for decisions that impact the Fedora project. Thecurrent draft does not, however, apply to the council itself. The publicdiscussion for the COI policy began on July23 and seems to benearing completion, with the council set to discuss the topic againduring its meeting on August13.

StepSecurity is reporting the emergence of a new worm affecting npm packages.The design of the worm is nothing new, but the rapidity with which it isexploiting captured npmpackager credentials is noteworthy.

The recent discussion on "spawn templates"raised questions about whether it was time to provide an alternative to theclassic Unix fork()/exec() pattern for process creation.One idea that was raised there was to shift the template pattern into aninterface that could be used to efficiently assemble new processes frombare cloth, without duplicating the parent process. Preferably, thatinterface would be able to implement posix_spawn().Li Chen, the author of the spawn-template work, has now responded with a patch series(written with significant LLM assistance) showing what a process-builderAPI for Linux might look like.

Security updates have been issued by AlmaLinux (frr, ldns, mingw-glib2, and perl-Archive-Tar), Debian (ruby2.7), Fedora (borgbackup, nebula, python-nh3, rust-ammonia, and seamonkey), Mageia (librabbitmq, libvncserver, packages, perl, perl-GD, perl-Unicode-LineBreak, squid, and unbound), Oracle (compat-libtiff3, frr, gstreamer1-plugins-good, javapackages-tools:201801, libreswan, nodejs:22, nodejs:24, p11-kit, perl-Archive-Tar, perl-DBI, php, pki-deps:10.6, and python-tornado), and SUSE (aws-iam-authenticator, bind, containerd, gawk, google-cloud-sap-agent, ignition, ImageMagick, java-11-openjdk, libpng16, libssh, mcphost, nginx, openssh, openssl-1_1, perl-DBI, perl-HTTP-Date, perl-Net-DNS, python-urwid, python3-dulwich, python312, python313, python3, python313-pydantic, python313-sentry-sdk, rrdtool, s390-tools, samba, spice-vdagent, vim, and xen).

John MacFarlane has published a lengthyretrospective to commemorate twenty years of the Pandoc document converter.

For those of us with a long memory: John Goerzen has announcedthe release of C-Kermit11, the first release of this file-transferutility in 15years.

The Filesystem inUserspace (FUSE) subsystem provides a way to service filesystemrequests from a user-space server, which moves the format-handling code outof the kernel. The FUSE server can use the io_uringfacility for better performance, but Bernd Schubert is concerned thatmemory is being wasted because the current implementation has a single,large buffer size that is excessive for small I/O operations. He led a discussion on that topicin the filesystem track of the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit in Zagreb, Croatia.

The JFrog blog examinessome reported vulnerabilities in SQLite, some of which made their wayinto high-profile vulnerability databases, that turned out to be entirelyfabricated by LLMs.

Greg Kroah-Hartman has announced the release of the 7.1.6, 6.18.42, 6.12.101, and 6.6.148 stable kernels. Each containshundreds of patches-the 7.1.6 kernel has more than700-with fixes throughout the tree. Users are advised toupgrade.

The release of NetBSD 11.0, the 19th major version of the operatingsystem, has been announced. There aremany changes and enhancements since the 10.1 release, including a newport to RISC-V, better support for Linux system calls in compat_linux(),as well as improvements to the NPFfirewall.

Security updates have been issued by AlmaLinux (.NET 10.0, .NET 8.0, .NET 9.0, fence-agents, kernel, kernel-rt, openssh, osbuild-composer, perl-Archive-Tar, perl-DBI, perl:5.32, pipewire, python-pillow, qemu-kvm, unbound, and vim), Debian (chromium, incus, kernel, kissfft, libgd2, libmodbus, libssh, node-tar, php8.4, poppler, python-authlib, sslh, and starlette), Fedora (borgbackup, coturn, curl, exim, fuse-overlayfs, gh, GitPython, goaccess, lemonldap-ng, libgit2, nextcloud, nsd, php, postgresql16, python3.12, rabbitmq-server, rust-libgit2-sys, and xen), Mageia (bluez, firmware, kernel, kmod, wireless-regdb), Oracle (buildah, compat-libtiff3, dovecot, fence-agents, firefox, gimp, glibc, grafana, gstreamer1-plugins-bad-free, java-25-openjdk, kernel, libgcrypt, libtiff, libXfont2, nodejs24, nodejs:22, nodejs:24, openssh, openssl, PackageKit, pipewire, python-pillow, rest, sssd, vim, and yelp), SUSE (bind, chromium, dnsdist, gdk-pixbuf-loader-libheif, gio-branding-upstream, google-guest-agent, govulncheck-vulndb, GraphicsMagick, ignition, ImageMagick, keybase-client, kronosnet, libblkid-devel, libntpc1, libpng16, nano, openssh, openssl-1_0_0, openssl-3, openvpn, PackageKit, perl-mojolicious, php8, python-nltk, python313-asteval, python313-certifi, python313-GitPython, python313-huggingface-hub, rsyslog, tomcat, tomcat10, tomcat11, traefik2, valkey, warewulf4, webkit2gtk3, and yq), and Ubuntu (linux-intel-iotg).

The 7.2-rc6 kernel prepatch is out fortesting. Quoth Linus: "Hmm. This rc is huge. Even by the "new normal"standards this is a big rc, and I think it's the biggest rc6 we've had inyears at least by commit count." There were 537 non-merge commitsapplied between 7.2-rc5 and 7.2-rc6.

The Servo web-browser engineproject has published an updateabout all of the changes that landed in June 2026, along with version0.4.0 of the Servo Tech Demo. This release includes a record 558commits, betterlayout correctness for web sites, improved WebGPU support, enhancementsfor users who are using the servoshelltest browser, and many performanceand stability fixes.