The 7.2-rc7 kernel prepatch is out fortesting. It is still bigger than Linus would like, but he saidnonetheless: "I don't currently see any value in delaying the 7.2release, so I would expect that to happen next weekend unless somethingreally bad pops up."
The shadow-utilsproject provides the tools that handle /etc/shadow,/etc/passwd, and other related databases; ingeneral, it manages users and groups on many Linux systems. While mostsoftware releases are notable for what is added, the recent shadow-utils4.20.0release is most noteworthy for what has been removed. Specifically,several utilities and functionality related to periodic passwordexpiry, which were deprecated in the December 2025 4.19.0release, have been removed as planned. It is still possible to managesome aspects of password aging with shadow-utils, but organizationsthat depend on such features should start planning for their completeremoval within a few years.
Version1.33.0 of the LightDMdisplay manager has been released. This is the firstrelease in four years: the project had been sponsored by Canonicalbut was effectivelyunmaintained in recent years. It has been transferredto a new community repository and is now maintained by JoshuaPeisach and Neal Gompa.The new release includes Qt6 support, code optimizations, and alist of other fixes that had been in limbo pending a new release.
Greg Kroah-Hartman has announced the release of the 6.12.102, 6.6.150, 6.1.182, 5.15.215, 5.10.264 stable kernels. This round ofstable kernel releases contains a fix for a single bug, foundby Thomas Lamprecht, that affected several of the kernels released yesterday inresponse to a securityvulnerability (CVE-2026-68480)that could allow data leakage through speculative execution.The 6.12.102 release adds the backported security fix for CVE-2026-68480 to the 6.12series. As always, users are advised to upgrade.
Greg Kroah-Hartman has announced the release of the 7.1.7, 6.18.43, 6.6.149, 6.1.181, 5.15.214, and 5.10.263 stable kernels. These kernelsfix a singlesecurity vulnerability (CVE-2026-68480)that could allow data leakage through speculative execution. Users ofthose kernels are advised to upgrade.
The kernel is able to run a few types of executable files, including nativebinaries in the ELF format and interpreted programs that begin with the#! marker. It also, however, has a mechanism, called binfmt_misc,that can be configured from user space to enable the transparent executionof programs in just about any format. This feature has been relativelystatic for years, but it seems likely to receive some significant updatesin the near future, including the ability to load BPF programs that candecide how to run a given program.
Version0.10 of the uutils project's Rust Coreutils has been released. Thisrelease focused on compatibility with the GNU Core Utilities suite,with Rust Coreutils now passing 645 of 690 tests, up from 625 with version0.9.0. Notablechanges in this release include addition of the mv--exchangeoption, an OpenSSL backend for checksum utilities, applying SELinux labels atcreation when using mkdir, mkfifo, and mknod, as wellas a number of performance and security improvements.The project has anonline playground that runs theRust Coreutils directly in the browser via WebAssembly for those who would liketo try the utilities without installing them. LWN covered the uutils project inFebruary 2025.
Konstantin Ryabitsev has announced the release of version 0.16.0 of the b4 software-development tool. The biggest change is the addition ofbug-tracking support:
Jordan Rife's work involves writing BPF programs forCilium that interface withKubernetesnetworking. As part of that work, he wants to enable BPF programs withappropriate permissions to iterate through the sockets of a different networknamespace. He led a session about the idea at the 2026Linux Storage,Filesystem, Memory-Management, and BPF Summit where the BPF developers inattendance were quick to suggest a number of related alternatives.
Filesystem inUserspace (FUSE) maintainer Miklos Szeredi led a birds-of-a-feather(BoF) discussion about the subsystem atthe 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit. In it, he talked aboutmaintenance challenges, proposed features and their status, and his plansfor a new FUSE API. There is a lot of interest and activity in theFUSE community these days it seems.
The AI Security Institute has released adetailed report on an security incident of its own making. TheInstitute set some LLM agents loose on the Internet with a securitychallenge; soon they were creating malware-laden pull requests andsock-puppet accounts to promote them.
The FedoraCouncil is consideringa conflict-of-interest (COI) policy for its decision-making bodies,such as the Fedora EngineeringSteering Committee (FESCo), special-interest groups (SIGs), andany other groups or individuals that report to the council andare responsible for decisions that impact the Fedora project. Thecurrent draft does not, however, apply to the council itself. The publicdiscussion for the COI policy began on July23 and seems to benearing completion, with the council set to discuss the topic againduring its meeting on August13.
StepSecurity is reporting the emergence of a new worm affecting npm packages.The design of the worm is nothing new, but the rapidity with which it isexploiting captured npmpackager credentials is noteworthy.
The recent discussion on "spawn templates"raised questions about whether it was time to provide an alternative to theclassic Unix fork()/exec() pattern for process creation.One idea that was raised there was to shift the template pattern into aninterface that could be used to efficiently assemble new processes frombare cloth, without duplicating the parent process. Preferably, thatinterface would be able to implement posix_spawn().Li Chen, the author of the spawn-template work, has now responded with a patch series(written with significant LLM assistance) showing what a process-builderAPI for Linux might look like.
The Filesystem inUserspace (FUSE) subsystem provides a way to service filesystemrequests from a user-space server, which moves the format-handling code outof the kernel. The FUSE server can use the io_uringfacility for better performance, but Bernd Schubert is concerned thatmemory is being wasted because the current implementation has a single,large buffer size that is excessive for small I/O operations. He led a discussion on that topicin the filesystem track of the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit in Zagreb, Croatia.
The JFrog blog examinessome reported vulnerabilities in SQLite, some of which made their wayinto high-profile vulnerability databases, that turned out to be entirelyfabricated by LLMs.
Greg Kroah-Hartman has announced the release of the 7.1.6, 6.18.42, 6.12.101, and 6.6.148 stable kernels. Each containshundreds of patches-the 7.1.6 kernel has more than700-with fixes throughout the tree. Users are advised toupgrade.
The release of NetBSD 11.0, the 19th major version of the operatingsystem, has been announced. There aremany changes and enhancements since the 10.1 release, including a newport to RISC-V, better support for Linux system calls in compat_linux(),as well as improvements to the NPFfirewall.
The 7.2-rc6 kernel prepatch is out fortesting. Quoth Linus: "Hmm. This rc is huge. Even by the "new normal"standards this is a big rc, and I think it's the biggest rc6 we've had inyears at least by commit count." There were 537 non-merge commitsapplied between 7.2-rc5 and 7.2-rc6.
The Servo web-browser engineproject has published an updateabout all of the changes that landed in June 2026, along with version0.4.0 of the Servo Tech Demo. This release includes a record 558commits, betterlayout correctness for web sites, improved WebGPU support, enhancementsfor users who are using the servoshelltest browser, and many performanceand stability fixes.
Song Liu believes that the way that programmers assemble complex BPF programswill be changing rapidly in the future. At a session of the 2026Linux Storage,Filesystem, Memory-Management, and BPF Summit, he shared his thoughts on whatthat change could look like, though he did not have any concrete proposals forwhat, if anything, the BPF maintainers should do. He anticipates anecosystem of Rust BPF packages developing, which is significant because BPFdoes not really have a package manager at the moment.
The Arch Linux DevOps team has announcedthat adoption of orphaned packages in the Arch User Repository (AUR)has been disabled due to "the current influx of malicious packageadoptions and follow-up commits made via the AUR". Michael Taggarthas posted a brief analysis of the malware being added to a longlist of packages in this round of attacks. The payload appearsto be an remote-access trojan (RAT) that takes commands over theTor network and attempts to upload a wide range of user data.The project had suspendednew account registration in June. That followed a campaign in which anattacker or attackers created new accounts to adopt orphaned packagesand push malicious updates to them that would install malware on usersystems. AUR registration was reopenedon July13 after the DevOps team added some minor, and apparentlyineffective, restrictions on creating new accounts.
Linux provides a system call (mkdir())to create a directory, and a few variants ofopen() that can open a directory. There is, however, nosystem call in Linux that can create and open a directory in a single,race-free call. Jori Koolstra has been working on remedying thatsituation, most recently by repurposing a set of open() flags that currentlyreturn an error. There are, however, concerns that show just how hard itcan be to create user-space interfaces that do not present traps forapplication developers.
Greg Kroah-Hartman has announced the release of the 6.18.41, 6.12.100, 6.6.147, 6.1.180, 5.15.213, and 5.10.262 stable kernels.Each of these kernels contains a single fix for a use-after-freevulnerability (CVE-2026-64560). Usersof these kernels are advised to upgrade.
BPF programs useBPF type format (BTF) debugging information in order todetermine how to interact with functions in the kernel. Specifically, tracing akernel function involves finding its address in the kernel's BTF section - butthat doesn't work for functions that have been inlined, and therefore don't havea single, specific address. Alan Maguire wants to add information about inlinedfunctions to BTF in order to allow them to be traced, and led a session on thattopic at the 2026Linux Storage, Filesystem, Memory-Management, and BPF Summit.
Greg Kroah-Hartman has announced the release of the 6.12.99, 6.6.146, and 6.1.179 stable kernels. This batch ofstable kernels includes a single fix for a regressioncaused by thiscommit. Users of those kernels should upgrade.
Leo Sandoval and Marta Lewandowska have put forward a changeproposal for Fedora45, which is expected in October, toprovide a separate, slimmed-down version of GRUB for a niche usecase. The new package would be in addition to the main GRUB packageand would not replace it for the majority of Fedora users. The ideamet with some resistance from Fedora contributors who thought that itwould be better to use systemd-boot,or another modern bootloader, rather than trying to wrangle GRUB intoa suitable state for the use case. The Fedora Engineering SteeringCouncil (FESCo), however, votedto accept the change on July7.
The GCC steering committee has announcedthat it has accepted anAI contributions policy recommended by the GCC AI policy workinggroup.The policy, in part, states that the project will decline any"legally significant contributions which include LLM-generatedcontent or are derived from LLM-generated content". It uses the definitionof "legally significant" from the GNU Project maintainer guidelines,which holds that the threshold is "around 15 lines of code and/ortext" to qualify as significant for copyright purposes. GCCmaintainers may, however, choose to accept legally significant testcases that are generated by an LLM.The policy does not forbid use of LLMs for research, analysis, bugdiscovery and reporting, patch review, etc. as long as the output isnot included in contributions. The committee says that it expects thepolicy will evolve and will be revisited periodically.
The gccrs project, which is creating a Rust frontend for the GCC compiler, hasspent the first half of 2026 focusing on compiling the Linuxkernel. By testing the compiler against the kernel crates, thedevelopment team has made significant progress toward generating correct codefor other Rust programs. As detailed in the project'sweekly andmonthly reports, this effort has uncovered and resolved problemsin areas such asattribute handling (described in thereport for February), name resolution, and resource management (bothdetailed in the May report). Currently, the compiler can only handle simplestandalone programs, but that situation could change rapidly in the comingmonths.
Version0.11 of the wlroots-basedWayfire Wayland compositor has beenreleased. Notable changes include better fractional scaling,per-output ICCprofiles, support for additional Wayland protocols, and more.
The DFSG, Licensing& New Packages Team (usually shortened to "DFSG team") wascreated in October 2025 as part of the ftpmaster team split. Itsjob is to review packages in the new queue for compliancewith the DebianFree Software Guidelines (DFSG), among other things, before thepackages are allowed to enter the Debianarchive. The change was long in coming, and some questionsremained after the split whether it was the right move. AndrewMcMillan provided an overview of the team's activities and its currentstatus during DebConf26. While it may betoo early to say with certainty, his report suggests that the newdivision of duties is working out well.
The kernel's read-copy-update (RCU) subsystem ensures that data will not bedeleted until it is known that there are no threads holding references toit. RCU works well and is widely used throughout the kernel, but it canincrease memory use and add significant delays before unused kernel objectsare cleaned up. Hazard pointers arean alternative approach to lockless data updates that offers betterperformance, for some situations at least. The kernel community iscurrently considering ahazard-pointer implementation by Mathieu Desnoyers and Paul McKenney.
Version2.47 of GNUBinutils has been released. In addition to the usual bug fixesthere are some notable new features in this release including addedsupport for a number of RISC-V standard extensions, a command-lineoption (-Mannotate) which displays the symbol forundefined instructions for AArch64, and more. The 32-bit s390 targethas been deprecated with this release.
LWN.net