Since the merge window for 7.4 opened, there have been 6,753 non-mergechangesets pulled into the mainline repository. Many more are expected,especially given the possibility that this merge window will be extended tothree weeks. Still, even this initial set brought in a number of new features,in addition to the continued general cleanups and security fixes that the kernelhas seen recently.
Memory has always been a scarce resource in computing systems, but theproblem seems to have worsened recently. In particular, the worldwideshortage of memory chips has led to a renewed focus by systems developerson reducing memory usage. During the memory-management microconference atthe 2026 Linux Plumbers Conference, WillDeacon discussed one specific consumer of memory that is beingre-examined: kernel stacks.
Linus Torvalds rarely writes significant amounts of kernel code these days, sothe mergingof a 48-part patch series from him is an unusual event. This series,destined for the 7.4 kernel release, performs some long-delayed kernelcleanup by removing a couple of the primitives used to access user-space memoryfrom the kernel. What was once a best practice has long been superseded,but it can take time for such changes to work their way through a body ofcode this large.
There are several Rust features that kernel developers have been hoping tostabilize, but Josh Triplett wanted to describe all of the otherfeatures that the Rust project is currently working on. He spoke about the topicat Kangrejos 2026, leaving the assembled kernel developers with several ideasabout how to use these upcoming Rust features in the kernel.The features included refinements to the type system, small syntax improvements, and asmarter borrow checker.
The Node.js project hasreleaseda number of security updates to fix, among other vulnerabilities, aremote-code-execution bug affecting programs that use Brotli compression. And,in case any programmers who use compiled languages thought they could relax, themusl libc project has also announced anew vulnerability: anout-of-boundswrite that could potentially lead to remote code execution, although thathas not been demonstrated.
We last looked in on hash-based integritychecking for kernel modules just over a year and half ago. Since that time,the patchset has undergone multiple revisions. At the 2026 Linux Plumbers Conference(LPC), Thomas Weischuh described the need for kernel-module integrityguarantees while still providing reproducible builds, how his patches implement that, and some ideas for possiblefurther work.
Nix flakes are anexperimental feature of the Nix package-managementtool designed to build projects in a more self-contained and reproducibleway. Despite the feature's experimental status, it has become increasinglypopular for open-source projects to publish flake.nix files that offerpredefined development environments and build automation even when thoserepositories may not offer an upstream package or module for the NixOS Linux distribution. AlthoughNix flakes have a complicated history, and the path for stabilization isuncertain, flakes can provide useful capabilities for projects that choose toinclude them.
The PHP project has published PHPversions 8.5.12,8.4.27, 8.3.36 and 8.2.35 to addresstwo critical vulnerabilities that could allow unauthenticated remote codeexecution.
Greg Kroah-Hartman has announced the release of the 7.2.12,6.18.58,6.12.114, and 6.6.160 stable kernels. Each contains a numberof important fixes; users are advised to upgrade.
The PHP security team has let it beknown that there is a high-stakes security update coming at14:00UTC on October21. "All PHP users are encouraged toprepare now so they can upgrade as soon as the release is available".Anybody running a PHP site probably needs to be prepared for this one.
Setuid (and setgid) binaries have long been a source of headaches, and securityvulnerabilities, on Linux systems. They are largely seen as something to beavoided; SUSE's security team, for example, forbidsthe inclusion of setuid or setgid binaries in packages unless they have beenreviewed and explicitly allowed. Thorsten Kukuk wants to go a step further anddisallow them entirely. At the 2026AllSystemsGo! conference, he spokeabout his work to disable setuid system-wide, as well as some of the hurdlesthat remain.
The work to support block sizes larger than the page size on XFS has beendifficult. Many users of XFS run stable kernels, which means that they aren't testingnew XFS code as it is released. That has made Daniel Gomez wonder whetheradopting Rust for some of the data structures underlying XFS, particularlyXArrays, could reduce the number of bugs lurking in the code. AtKangrejos 2026, he led a discussion about the potential problems with convertingXArray to Rust. The assembled kernel developers had a number of reasons to becautious about replacing the XArray code, but Gomez was determined to experimentwith the possibility, citing both security and performance improvements.
OpenBSD 8.0 has beenreleased. There are many new features, including the addition of hibernatesupport for arm64, an increase in the kernel virtual address space for amd64 to512GB, quite a few improvements for the qwx driver that supportsQualcommWiFi6 devices, and much more. See the full changelog fordetails.
Mike Rapoport has announcedthe release of the video recordings from the 2026 Linux Plumbers Conference (LPC),which was held in Prague from October5 through October7. Find thecomplete set via the YouTube playlistor look for the video links in the schedule. See also LWN'scoverageof talks from LPC.
Linus Torvalds releasedthe 7.3 kernel, at the end of the usual nine-week development cycle, onOctober18. This cycle, abundantly fueled by LLM-assistedcontributions, broke just about every record imaginable. As usual, we havecompiled some statistics showing how this release, which is expected to bethe next long-term-support (LTS) kernel, came together. Also included isan attempt to determine whether automated patch review is actually reducingthe number of bugs introduced into the kernel.
Rust has several ad-hoc mechanisms to allow user code to influence how thestandard library executes. For example, custom panic handlers and customallocators both involve registering functions that core standard library codeneeds to call. With more similar features planned,Jana Donszelmann spotted the developing pattern and put together ageneral solution, introducing a safer, checked analogue of C's weak symbollinking. At Kangrejos 2026, she explained how this new language feature works,and proposed using it to clean up the kernel's handling of integer overflows inRust code.
The GNOME Project has provided GNOMEOS for some time; until now, theproject only provided a "Nightly" edition that was built from the latest commitsand was aimed solely at GNOME developers. Adrian Vovk has now announcedthe release of GNOMEOSPreview, which is intended for a non-developer audience:
Self-referential structures that can be used without unsafe codehave posed a problem for Rust for years.There are many cases where a self-referential data structure is the elegantalgorithmic choice, but implementing it in accordance with Rust's lifetime rulesis all but impossible. At Kangrejos 2026, Gary Guo presented a clever solutionto the problem in the context of the kernel'spin_init crate, which helps with the creation of immovable data structures,typically for interoperability with C. Guo's changes could help remove most ofthe unsafe code related to lifetimes in theNova driver and, eventually, other Rust components.
The NFS network filesystem protocol has a long history on Unix-likeoperating systems (and beyond). NFS is still evolving, though, andimplementations need to keep up. At the 2026 Linux Plumbers Conference, NFS developerJeff Layton gave an overview of recent enhancements to the Linuximplementation, along with some hints for what will be coming in the nearfuture.
The resultsfrom the 2026 election for members of the Linux Foundation TechnicalAdvisory Board (TAB) have been announced. Kees Cook, Dave Hansen, MiguelOjeda, and Shuah Khan have all been re-elected, and Laurent Pinchart willbe joining the board.
Since Android's inception, the kernels it has used have divergedsignificantly from the mainline. While many of those differences have beenresolved over time, and the move to the generickernel image has helped to bring Android closer, current devices stillcarry a lot of out-of-tree changes. The preferred form for such changes isby way of vendorhooks. At the 2026 LinuxPlumbers Conference, Todd Kjos ran a fast-paced session in the Androidtrack to discuss vendor hooks and how they are used.
Greg Kroah-Hartman has announced the release of the 7.2.11, 6.18.57,6.12.113, 6.6.159, 6.1.190,5.15.223, and 5.10.272 stable kernels. This series includes,among other things, a fix for acritical vulnerability (CVE-2026-99999). Theflaw in skb_checksum_help()would allow an IPv4 packet with bad checksum metadata to "corrupt the networkheader and cause a bunch of mischief" in the words of patch author MichaelS. Tsirkin. As usual, all users are advised to upgrade.
LTTng creator Mathieu Desnoyers seems abit trapped in something of a catch-22.At the 2026 Linux Plumbers Conference(LPC), he led a discussion on the problem he is having in trying tocollaborate with other tracing projects (e.g. ftrace, perf) in the kernel. Thefeedback he has gotten, both over the years and more recently, does notshow a path that would allow him to contribute the 21-year-oldGPLv2-licensed LTTng tracing framework, or, incrementally, features fromit, to the mainline kernel.
At the recently concluded MaintainersSummit, Linus Torvalds said that he had been using a large languagemodel to work on a patch series addressing a longstanding problem; he hasnow postedthat series for review.
Version 6.8 ofthe KDE Plasma desktop has beenreleased. The The KDE project has timed the release to coincide with the 30thanniversary of Matthias Ettrich's email announcing theproject:
After much deliberation, the GCC project recently came up with a policy on the use of largelanguage models for development of the compiler suite. It is somewhatrestrictive, but still leaves room for LLMs in the development process. Atthe 2026 GNU Tools Cauldron,Jeff Law and Kyrill Tkachov discussed how these tools have been useful forthem.
KDELinux, the KDE Project's secondstab at creating its own distribution, was first introduced as "Project Banana"at the Akademy conference in 2024 byHarald Sitter. Nate Graham announcedthe first alpha-quality release during Akademy2025. Graham and Sitterpaired up at Akademy2026 to provide an update on its progress, lay out plans for refining the distribution toaddress user feedback, and discuss some of the problems that still need to bedealt with. KDE Linux is still not-quite-ready for prime time, but Graham hopesthat it will be suitable for widespread use soon-for an undefined value of"soon".
The Lix and Nix projects have jointlydisclosed a set of vulnerabilities that can be used to escalate privilegesto root on systems running the Lix or Nix daemons. "All systems that builduntrusted derivations are affected." Releases with fixes from each projectare available today. CVE IDs have not yet been requested. See the announcementfor more details on the vulnerabilities.
Rust's system of ownership and borrowed references is convenient when it cancorrectly model a program's needs. TheRust for Linux project has worked toprovide adapters between Rust's semantics and the existing C codein the kernel. At Kangrejos 2026, Andreas Hindborg spoke about apatchseries implementing the next such adaptor: an Ownable trait forrepresenting objects that are allocated in C code, but which Rust code is responsiblefor cleaning up (if not necessarily deallocating) when it is done with them.He hoped to finally reach a consensus on the patch series, after months ofdiscussion on the mailing list.
PostgreSQL coreteam member Peter Eisentraut has written a blogpost reflecting on the "unusually high number of features" that havebeen taken out of the upcoming PostgreSQL19 release since the beta periodbegan.
Asterinas is a project to builda new operating-system kernel in Rust; it was covered here in 2025. Version0.19.0 of the Asterinas kernel has been released; changes include a newgraphics subsystem capable of running X.org, "minimal but usable"64-bit Arm support, better virtualization support, and more.
The Maintainers Summit is a one-day, invitation-only gathering of about 30kernel developers; it is held once each year to discuss policy-related issuesthat are not always amenable to resolution via email. The 2026 event wasscheduled for October8 in Prague, Czechia. Unsurprisingly, the discussionthere was dominated by large language models (LLMs) and their effect on thedevelopment community, but some time was also found to talk about securitybugs and long-term succession planning.
LWN.net