The Servo web-browser engineproject has published an updateabout all of the changes that landed in June 2026, along with version0.4.0 of the Servo Tech Demo. This release includes a record 558commits, betterlayout correctness for web sites, improved WebGPU support, enhancementsfor users who are using the servoshelltest browser, and many performanceand stability fixes.
Song Liu believes that the way that programmers assemble complex BPF programswill be changing rapidly in the future. At a session of the 2026Linux Storage,Filesystem, Memory-Management, and BPF Summit, he shared his thoughts on whatthat change could look like, though he did not have any concrete proposals forwhat, if anything, the BPF maintainers should do. He anticipates anecosystem of Rust BPF packages developing, which is significant because BPFdoes not really have a package manager at the moment.
The Arch Linux DevOps team has announcedthat adoption of orphaned packages in the Arch User Repository (AUR)has been disabled due to "the current influx of malicious packageadoptions and follow-up commits made via the AUR". Michael Taggarthas posted a brief analysis of the malware being added to a longlist of packages in this round of attacks. The payload appearsto be an remote-access trojan (RAT) that takes commands over theTor network and attempts to upload a wide range of user data.The project had suspendednew account registration in June. That followed a campaign in which anattacker or attackers created new accounts to adopt orphaned packagesand push malicious updates to them that would install malware on usersystems. AUR registration was reopenedon July13 after the DevOps team added some minor, and apparentlyineffective, restrictions on creating new accounts.
Linux provides a system call (mkdir())to create a directory, and a few variants ofopen() that can open a directory. There is, however, nosystem call in Linux that can create and open a directory in a single,race-free call. Jori Koolstra has been working on remedying thatsituation, most recently by repurposing a set of open() flags that currentlyreturn an error. There are, however, concerns that show just how hard itcan be to create user-space interfaces that do not present traps forapplication developers.
Greg Kroah-Hartman has announced the release of the 6.18.41, 6.12.100, 6.6.147, 6.1.180, 5.15.213, and 5.10.262 stable kernels.Each of these kernels contains a single fix for a use-after-freevulnerability (CVE-2026-64560). Usersof these kernels are advised to upgrade.
BPF programs useBPF type format (BTF) debugging information in order todetermine how to interact with functions in the kernel. Specifically, tracing akernel function involves finding its address in the kernel's BTF section - butthat doesn't work for functions that have been inlined, and therefore don't havea single, specific address. Alan Maguire wants to add information about inlinedfunctions to BTF in order to allow them to be traced, and led a session on thattopic at the 2026Linux Storage, Filesystem, Memory-Management, and BPF Summit.
Greg Kroah-Hartman has announced the release of the 6.12.99, 6.6.146, and 6.1.179 stable kernels. This batch ofstable kernels includes a single fix for a regressioncaused by thiscommit. Users of those kernels should upgrade.
Leo Sandoval and Marta Lewandowska have put forward a changeproposal for Fedora45, which is expected in October, toprovide a separate, slimmed-down version of GRUB for a niche usecase. The new package would be in addition to the main GRUB packageand would not replace it for the majority of Fedora users. The ideamet with some resistance from Fedora contributors who thought that itwould be better to use systemd-boot,or another modern bootloader, rather than trying to wrangle GRUB intoa suitable state for the use case. The Fedora Engineering SteeringCouncil (FESCo), however, votedto accept the change on July7.
The GCC steering committee has announcedthat it has accepted anAI contributions policy recommended by the GCC AI policy workinggroup.The policy, in part, states that the project will decline any"legally significant contributions which include LLM-generatedcontent or are derived from LLM-generated content". It uses the definitionof "legally significant" from the GNU Project maintainer guidelines,which holds that the threshold is "around 15 lines of code and/ortext" to qualify as significant for copyright purposes. GCCmaintainers may, however, choose to accept legally significant testcases that are generated by an LLM.The policy does not forbid use of LLMs for research, analysis, bugdiscovery and reporting, patch review, etc. as long as the output isnot included in contributions. The committee says that it expects thepolicy will evolve and will be revisited periodically.
The gccrs project, which is creating a Rust frontend for the GCC compiler, hasspent the first half of 2026 focusing on compiling the Linuxkernel. By testing the compiler against the kernel crates, thedevelopment team has made significant progress toward generating correct codefor other Rust programs. As detailed in the project'sweekly andmonthly reports, this effort has uncovered and resolved problemsin areas such asattribute handling (described in thereport for February), name resolution, and resource management (bothdetailed in the May report). Currently, the compiler can only handle simplestandalone programs, but that situation could change rapidly in the comingmonths.
Version0.11 of the wlroots-basedWayfire Wayland compositor has beenreleased. Notable changes include better fractional scaling,per-output ICCprofiles, support for additional Wayland protocols, and more.
The DFSG, Licensing& New Packages Team (usually shortened to "DFSG team") wascreated in October 2025 as part of the ftpmaster team split. Itsjob is to review packages in the new queue for compliancewith the DebianFree Software Guidelines (DFSG), among other things, before thepackages are allowed to enter the Debianarchive. The change was long in coming, and some questionsremained after the split whether it was the right move. AndrewMcMillan provided an overview of the team's activities and its currentstatus during DebConf26. While it may betoo early to say with certainty, his report suggests that the newdivision of duties is working out well.
The kernel's read-copy-update (RCU) subsystem ensures that data will not bedeleted until it is known that there are no threads holding references toit. RCU works well and is widely used throughout the kernel, but it canincrease memory use and add significant delays before unused kernel objectsare cleaned up. Hazard pointers arean alternative approach to lockless data updates that offers betterperformance, for some situations at least. The kernel community iscurrently considering ahazard-pointer implementation by Mathieu Desnoyers and Paul McKenney.
Version2.47 of GNUBinutils has been released. In addition to the usual bug fixesthere are some notable new features in this release including addedsupport for a number of RISC-V standard extensions, a command-lineoption (-Mannotate) which displays the symbol forundefined instructions for AArch64, and more. The 32-bit s390 targethas been deprecated with this release.
The 7.2-rc5 kernel prepatch is out fortesting. Linus said: "So it's a bit too big for my liking, but nothingin there strikes me as particularly strange or scary".
The Debian project is considering a generalresolution on the use of large language models in the creation of thedistribution. There are three alternatives to consider: atotal ban on LLM usage, rejecting LLMs "as far as practical", orexplicitly allowing LLM usage subject to a set of conditions. Thediscussion period has just begun; the beginning of the voting period doesnot yet appear to have been set. Those who want to look over thediscussion ahead of the inevitable LWN article can find it over here.
On July 21, the kernel community lost Dan Williams, one of its most belovedcontributors. Dave Hansen and Thomas Gleixner, both of whom worked withWilliams extensively, have written an obituary and allowed LWN to publishit. He will be deeply missed, but he has left us with a lot to rememberhim by.
Version 2.44 of theGNU C Library has been released. Changes include a new/etc/tunables.conf file for the system-wide setting of tunableparameters, a new tunable to control the use of transparent huge pages forread-only executable segments, a number of math-function improvements, ahandful of security fixes, and more.
Greg Kroah-Hartman has released the 6.12.98 stable Linux kernel with asingle fix for a file descriptor leak in ext4. Users of the ext4filesystem should upgrade.
Greg Kroah-Hartman has announced the release of the 7.1.5, 6.18.40, 6.12.97, 6.6.145, 6.1.178, 5.15.212, and 5.10.261 stable Linux kernels.This batch of kernels includes a hefty set of updates, possibly the largest ever. 7.1.5-rc1,for example, included more than 2,000 patches, 6.18.40-rc1included 1,611 patches, and so forth. Users are advised to upgrade.
Registration is nowopen for the 2026 Linux Plumbers Conference, to be held October5to7 in Prague, Czechia. Tickets to this event tend to sell outquickly, so interested attendees probably should not procrastinate.
Fedora contributor Simon de Vlieger has published a blogpost with a walkthrough of how the project turns source code andpackages into the final release that users install on their systems.
Daniel Borkmann led a session at the 2026Linux Filesystem, Memory-Management,and BPF Summit about the progress that has been made with netkit, the subsystemthat allows virtual machines (VMs) running on Linux to perform networking efficiently.When that did not fill the full time, he went on to discuss his idea forusing BPF to live-patch user-space applications. While netkit is makingprogress, and can now support zero-copy receipt of packets into a VM in anetwork namespace, the idea of using BPF for patching user-space programsremains entirely speculative.
I have just received the shocking news that Dan Williams, a longtime,high-profile kernel developer, has passed away. I knew him primarilythrough his long service on the Linux Foundation Technical Advisory Board;he was always a strong, thoughtful, and intelligent presence. Dan will bedeeply missed.There is a supporteffort underway for Dan's family as they come to terms with this loss.
One of the ideas raised at the 2026 LinuxStorage, Filesystem, Memory Management, and BPF Summit (LSFMM+BPF) wasthe creation of anoperations structure for the swap subsystem. Like many parts of thekernel, the swap layer evolved over time, with pieces being added asneeded; the end result of this evolution is rarely what one would expecthad the subsystem been designed today. The interface between the swaplayer and the devices it uses is just one example. It appears that oneresult of the swap subsystem's evolution - the lack of an abstraction layerto interface with underlying storage - will soon be addressed, but in adifferent way than was initially envisioned.
The Codeberg forge has adopted a pair of new policies, promising not to usehosted projects to train LLMs and, more controversially, banning thehosting of LLM-generated software. The site's blog describesand justifies these policies.
One of the features that users often miss when moving from X11 to Wayland isthe ability to save and restore the position of windows between sessions. At GUADEC2026, held inACoruna, Spain, Adrian Vovk provided an overview of work that has goneinto providing a platform-wide save and restore framework for GNOME. After twofailed attempts at landing an API, he believes that the third try will be theone to succeed-though not in time for the upcoming GNOME51 releasedue in October.
Python Software Foundation security developer-in-residence SethLarson has announcedthat the Python Package Index (PyPI) will now reject new files thatare uploaded to releases older than 14 days. The restriction is toprevent the poisoning of old releases if publishing tokens orworkflows of PyPI projects are compromised.
Tracepoints in the kernel are useful for a variety of purposes: debugging,active monitoring, and performance measurements, among other things. Previously,any given BPF program could only be attached to a single tracepoint.Jiri Olsa has been working to change that, and led a discussion abouthis progress at the 2026Linux Storage, Filesystem, Memory-Management, and BPFSummit. That work has since beenmerged, and can be expected as part of the 7.2kernel.
Version153.0 of the Firefox web browser has been released. Notablechanges in this release include a change to the defaultlocal-file-access permissions for extensions, enabling LANrestrictions by default for all users, a visual indicator when a website has access to the user's location, the ability to merge PDFs andadd images as pages within PDFs, as well as experimental support forthe JPEG XL image format.See thereleasenotes for developers for all changes that affect web developers,and securityadvisories for vulnerabilities fixed in this release.
Like many development communities, the kernel community has been strugglingto determine how large language models will be used in its developmentprocess. The news has been dominated recently by a strongly worded missivefrom Linus Torvalds on the subject, but the discussion has been rather morewide-ranging and nuanced than that. Topics that have been consideredrecently include the LLM attribution requirement, code-review tools,dependence on proprietary tools, and whether there is a place for concernsabout the ethics of LLMs.
The Fedora Project is known for,among other things, having a well-defined set of processes for just abouteverything. It has extensive packagingguidelines that deal with the complexities of creating RPMs to installsoftware, as well as processes for managing the legal questions thatarise around shipping software. Fedora also has a well-defined changeprocess for dealing with self-contained technical changes as well as majorchanges to the distribution, and other issues as they arise. At the moment,though, the project seems to be experiencing a sort of midlife crisis as itre-examines several of its change processes at once to determine if they arestill effective.
Michael Catanzaro, who has been managing GNOME security issue tracking sinceNovember 2020, has written a blog post that details some changes in how he willbe managing GNOME vulnerability reports from now on due to an increase inAI-generated security reports. He will be switching from a 90-day deadline fordisclosures to 30 days for issues reported on August1, or later. "Theshorter deadline would probably work better for GNOME even if not for theincrease in AI-generated issue reports."He also has indicated that he will be stepping away from the task of managingsecurity issue tracking entirely by December 1, 2026, which means that therewill be a gap to fill:
The famfs filesystem, which is meant to provide shared access to hugememory-resident files on CXL and otherdevices, returned tothe Linux Storage,Filesystem, Memory Management, and BPF Summit (LSFMM+BPF) in 2026.It was first discussed at LSFMM+BPF 2024 and a new implementation was described at the 2025gathering, but it still has not made its way into the kernel; LWN lookedat a discussion about merging famfs back in April 2026.
The 7.2-rc4 kernel prepatch is out fortesting. Linus said: "This whole week I had the feeling that peoplewere starting to go on summer vacation, but running the numbers shows thatI must have been wrong - it all looks pretty normal."
Adrian Mastronardi has released a book called Half a Second; it is adetailed look into the XZ backdoor attemptof 2024. The book is freely available under a (non-free) noncommercial,no-derivatives CC license.
LWN.net