Version6.0.0 of the Homebrewpackage-management system has been released. Notable changes in thisrelease include the introduction of tap trust to improvesupply-chain security, improvements in sandboxing on Linux, a numberof performance tweaks, and many other changes.See the changelogfor a full list. LWN covered Homebrew inNovember 2025.
The Linux kernel has long tried to use huge pages as a way to improveperformance, sometimes with more success than others. The size of hugepages has traditionally been imposed by the hardware, which typically onlyoffers a couple of relatively large options. In more recent times, though,the use of multi-size transparent huge pages (mTHPs), with more flexiblesizing implemented in software, has been growing. If all goes well, the7.2 development cycle will include the addition of a new feature,contributed by Nico Pache, to make the use of mTHPs even more transparent.
Seth Larson, the Python Software Foundation's securitydeveloper-in-residence, has writtenabout the difficulty in classifying insecure code completion inthe PyCharm IDE usingits FullLine code completion plugin. Larson discovered that the plugin,which uses a local "deep learning module" to offer code completions,suggests code that would lead to severe vulnerabilities. He was unsurewhether it warranted a CVE or not, however:
Agentic AI systems can be used to do a variety of thingsautonomously on behalf of a human user: open or manage bugs, generatecode, submit pull-requests, and (apparently) even complain aboutrejection. In May, a Fedora developer discovered that an allegedlyrogue agent had been pestering the project in a number of ways:reassigning bugs, fabricating unhelpful replies to bugs, and evenpersuading maintainers to merge questionable code into the Anacondainstaller. It also submitted a number of pull requests (PRs),some accepted, to several upstream projects. The Fedora accountassociated with the agent has had its group privileges revoked and themesses have been mopped up, but the motive behind the agent's actions is stilla mystery.
Version2026.05 of the Buildroot toolhas been released. Buildroot simplifies and automates the process ofbuilding embedded Linux systems using cross-compilation. Notablechanges in this release include support for Arm Neoverse cores,addition of XFS rootfs generation, as well as many package updates andbug fixes. See the CHANGESfile for the full list.
Thomas Ward has publishedan update about the future of the Ubuntu MATE project, which did not have a26.04release with the other Ubuntu flavors inApril:
Trustedpublishing is an authentication mechanism that relies onshort-lived credentials to reduce the risk of supply-chain attacks. Atthe 2026 OpenSource Summit North America, Mike Fiedler walked the audiencethrough why trusted publishing exists, how it works, and made the casefor its adoption. It is not a silver bullet against all attacks, butit does offer protection against theft of long-lived credentials usedto publish to package registries.
The BPF verifier has, in the course of wrestling with the difficult problem ofstatically analyzing loops, grown special support for many kinds of loops over itshistory, but its fundamental approach to simple for loops has notchanged.When it encounters a loop, it evaluates it, iteration by iteration, until reachingan exit condition - a process that can cause the verifier to mistakenly hit thelimit on the number of allowed instructions where a better implementationwould not.Eduard Zingermanspoke at the 2026Linux Storage, Filesystem, Memory-Management, and BPF Summitabout his in-progress work on improving the verifier's treatment of loops, especially nestedloops.
Greg Kroah-Hartman has announced the release of the 7.0.12, 6.18.35, and 6.12.93 stable kernels. Each containsimportant fixes throughout the tree. Users are advised to upgrade.
In a filesystem-track session at the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit, Amir Goldstein updatedattendees on the fanotifyfilesystem-event monitoring subsystem. He wanted to describe changes that had come in the last year orso, as well as upcoming features and some remaining challenges in hisefforts to use fanotify for hierarchicalstorage management (HSM). Fanotify is the user-space API for monitoringfiles, directories, and filesystems for events of various sorts(e.g. opening or deleting a file).
Andrew Tridgell has announcedthe release of rsync 3.4.4 withfixes for the regressions introduced in the 3.4.3 release. He alsonotes there will be an rsync 3.5.0 soon, with many more securityupdates:
The 7.1-rc7 kernel prepatch is out fortesting. Linus said: "Anyway, as things look now this is the lastrc. Something can obviously always come up and force us to change that, butplease give rc7 a whirl and keep testing for one more week."
Since the earliest days of Unix, two of the core process-oriented systemcalls have been fork(), which creates a child process as a copy ofthe parent, and exec(), which runs a new program in the place ofthe current one. In Linux kernels, those system calls are better known asclone()and execve(),but the core functionality remains the same. While there is elegance tothis process-creation model, there are shortcomings as well. A recent proposal fromLi Chen to add "spawn templates" to the kernel will not be accepted in itscurrent form, but it may point the way toward a new process-creationprimitive in the future.
The Software Engineering Radio podcast has put up aninterview with graphics maintainer Dave Airlie. Much of what is inthere will not be news to LWN readers, but it is an interesting overview ofthe life of a large-subsystem maintainer.
The splice()and vmsplice()system calls are meant to improve performance for certain data-movementtasks by minimizing (or avoiding altogether) system calls and the copyingof data. They also have a long history of security problems. The recentflood of LLM-discovered vulnerabilities has drawn attention, once again, tosplice() and vmsplice(); as a result, they may end upbeing removed altogether.
The EFF has a blogpost looking at a new bill in California that would exemptopen-source operating systems from the Digital Age Assurance Actpassed last year, but has problems of its own:
Over time, many open-source maintainers face the same problem: theylack the time to do all of the work that their project needs, and noone else is stepping up to provide adequate help. Maintainers, though,are often reluctant to throw in the towel. The result is suboptimalall around; the maintainer is stressed out, project quality suffers,and users face security risks that they may not be fully aware of. Atthe 2026 OpenSource Summit North America, Robin BenderGinn spoke about thisproblem, when it might be time for maintainers to pass the torch, andthe responsibilities of users.
Alexei Starovoitov gave "less of a presentation, more of a scream ofrealization" at the BPF track of the 2026Linux Storage, Filesystem,Memory-Management, and BPF Summit. He shared a set of ideas for how BPF couldchange to avoid being swept away by the sea-change in programming represented by modernlarge language models (LLMs) and the coding agents based on them.In a follow-up session, the discussion coveredmore problems with how coding agents use tools like bpftrace, and the current deluge ofpatches in need of review in the BPF subsystem.
Extendedattributes (xattrs) provide a way to attach key/value metadata toinodes-files, directories, and the like-in a filesystem. As with manyLinux filesystems, the FUSE filesystemsupports xattrs. In a filesystem-track session at the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit, FUSE maintainer MiklosSzeredi led a discussion about caching xattrs in kernel memory; he wouldlike to create some common infrastructure that could be used by FUSE andshared with other filesystems.
Package managers for operating systems and programming languages have beenaround for decades. Each package manager, and its accompanying packaging format,has been shaped by the needs of its respective ecosystem, but there is a growingneed to make use of package metadata for more than software management: forexample, in vulnerability scans, software bills of materials (SBOMs), and more. OnMay19, Damian Vicino spoke at the Open Source Summit North America 2026about his experiences in the past year trying to make sense of the variedmetadata provided by more than 20 package managers.
Over on the AboutCode blog, leadmaintainer Philippe Ombredanne writesabout an agentic LLM system porting the ScanCodeToolkit to Rust. In the process, the LLM (or the people behind it)infringed the ScanCode trademark, stripped copyright and license notices,"and started an outreach campaign, without ever engaging the AboutCodecommunity". Ironically, the toolkit is used to scan source code and binaries inorder to figure out licensing and copyright information; it also reports onpackagedependencies, vulnerabilities, and more.
Optimizing compilers can, under some circumstances, infer when a parameter to afunction is not needed, and remove it. This is all well and good until thekernel's tracing or BPF subsystems need information on how to call the functionor where its arguments are stored.Alan Maguire and Yonghong Song spoke at the 2026LinuxStorage, Filesystem, Memory-Management, and BPF Summit about their work onrecording information regarding changed function signatures in the kernel's BTF debugginginformation, to better support tracing such functions.
Greg Kroah-Hartman has announced the release of the 7.0.11, 6.18.34, 6.12.92, 6.6.142, 6.1.175, 5.15.209, and 5.10.258 stable kernels. As usual, eachcontains important fixes throughout the tree, including a fix for the "CIFSwitch" vulnerability (CVE-2026-46243) which could allow a local-privilege-escalation exploit. Users are advised toupgrade.
The DistroWatch site is celebrating its25th anniversary. "All in all, it has been an incredible ride. Manyof you who read these pages regularly know that downloading and testingdistributions is a highly addictive pastime. I have been an aviddistro-hopper for the last 25 years and I don't see myself abandoning thisactivity for many more years to come." Congratulations to LadislavBodnar and all the others who have kept that resource going for so long.
The x32 ABI was meantto be the best of both worlds, providing the expanded registers andinstruction set of the x86-64 architecture while preserving the lowermemory use of 32-bit systems. The Linux kernel has supported x32 since the3.4 release in 2012. The initial excitement around x32 did not last,though, and kernel developers are considering removing that support - andnot for the first time. Even the most unloved features tend to have a fewusers, though, making removal hard.
The Fedora Project has publishedinterviews with candidates running for the open seats on the FedoraCouncil, Fedora EngineeringSteering Committee, FedoraMindshare Committee, and EPELSteering Committee. Voting is open through Friday,June 12 at 23:59 UTC.
The 7.1-rc6 kernel prepatch is out fortesting. Linus said: "Well, I wouldn't call this 'small', but it iscertainly smaller than rc5 was. And I don't think there's anythingparticularly scary here, so maybe we're still on track for a normal releasecycle. Let's see."
MeshCore is a relatively new project, started in January 2025, that aimsto build a scalable mesh network using low-power long-distance radios. Whilemany other projects of the same general nature have been tried before, MeshCoregrew quickly because of its more efficient message routing and enthusiasticcommunity. In early 2026, an early proponent of the project made a sudden shiftthat left the rest of the community stunned and embroiled in a trademark dispute.
Many organizations require US Federal Information Processing Standard (FIPS)certification of the crypto code they are running. The certificationprocess is lengthy, but the bigger problem is that the way the cryptosubsystem is built into the kernel makes the result unable to be reusedacross kernel updates. I have proposed a patchseries that decouples the crypto subsystem into a standaloneloadable module, allowing a certified crypto module to be reused withmultiple kernels and, thus, requiring fewer lengthy recertification delays.
Andrew Nesbitt has written a blogpost detailing a recent incident with the jqwik library for property-based testingin Java. On May25, the 1.10.0 release of jqwik included a changethat attempts to instruct coding agents to disregard previousinstructions and delete jqwik tests and code.
Version1.96.0 of the Rust programming language has been released. Changesinclude a new set of Copy-implementing Range types,assertions with pattern matching, a number of stabilized APIs, and twoCargo vulnerability fixes.
Gentoo developer Micha Gorny has written a lengthyarticle explaining the philosophy and purpose of the Gentoo Linuxdistribution, in response to athread on Mastodon:
LWN.net