When a computer hibernates, the kernel writes the contents of memory to disk andthen shuts the system down. Resuming from hibernation involves reading that databack into memory, and then having the kernel pick up where it left off.Unfortunately, the kernel does not haveany way to know that the data it is reading back has not been tampered with,which is why lockdown, an optional kernelfeature that attempts to prevent modifications to the running kernel, disables hibernation.Matthew Garrett, who has been working on lockdown for many years, has shareda patch set that aims to fix this problem. His solution must also protectagainst downgrade attacks (where an attacker reboots the computer with an olderkernel version to bypass new protections), which complicates the implementation.
Hot on the heels of the previoustwo stable kernels, Greg Kroah-Hartman has announced the release of the 7.3.3, 6.18.62,6.12.116, 6.6.162, 6.1.192,5.15.225, and 5.10.274 stable kernels. Each one only containsfixes for three use-after-free vulnerabilities announced today by the Xensecurity team.Two of the vulnerabilities could allow an attacker to DoS theentire Xen host machine with possible information leakage (CVE-2026-100080,CVE-2026-100082),and one may allow privilege escalation as well as a DoS of the host machine (CVE-2026-100081). Usersshould, of course, upgrade if they are using Xen.
Greg Kroah-Hartman has released the 7.3.2and 6.18.61 stable kernels. Each contains quitea few changes throughout the tree; users are advised to upgrade.
User namespaces are a key part of thekernel's toolkit for assembling containers; processes within a usernamespace can appear to have full root access to the system while gainingno extra privileges in the wider system. At least, that is the intent. Inpractice, keeping privilege contained within a user namespace has oftenturned out to be difficult. As an example, consider thissmall patch series from Josef Bacik, which is intended to address somesituations where a process within a user namespace can elevate theprivileges of processes outside of it.
Version 10.6p2 ofOpenSSH has been released with a workaround for a critical vulnerability thataffects Linux systems that use musl libcwith PAM disabled, such as AlpineLinux. OpenSSH developer Damien Miller said:
The KDE Project announced, in2025, that Plasma6.7 wouldbe the last version of the desktop environment that would support X11sessions. Those who keep up with KDE's announcements no doubt expected it whenPlasma6.8dropped X11 support as promised. What seems to have come as a surprise, atleast to a number of Fedora KDE PlasmaDesktop users, is that the Fedora44 release-which shipped inApril with Plasma6.6-receivedan update to Plasma6.8 that swept away the X11 session without much warning.Despite the surprise, it is gone for good: the Fedora Engineering SteeringCommittee (FESCo) has votedagainst a request to revert the update for Fedora 44 and the just-releasedFedora 45.
Version45 of Bazzite, the image-based gaming distribution based onFedoraLinux, has been released. Notable changes in this release include arebase to Fedora45, updated Open Gaming Collective (OGC)kernels, support for Logitech TrueWheel devices, and more.LWN covered Bazzite inDecember2025.
A basic Python script is portable: it can be copied between machines with little concern about compatibility.A script that depends on third-party packages requires quite a bit morecare and consideration, however.In 2023, PEP723 ("Inline script metadata") introduced a standard for declaring a Python script'sdependencies inside the script itself.Several third-party tools can now automatically install and manage those dependencies, but there is still little official support for this standard within Python itself.
The openSUSE project has announced the release of openSUSE Leap 16.1. The release is notable for allowing both traditional installations and immutable images with transactional updates. While immutable images had previously been available for Leap Micro, they are now available across all platforms that Leap supports, including servers, desktops, and virtual machines.
The Debian project has wrestled with the topic of LLM usage for years, whichculminated in a general-resolutionvote this August. The project voted in favor of the fifth, out ofeight, option: "Responsible Use ofGenerative AI". With the door open to LLM use, the DFSG, Licensing & New PackagesTeam (usually shortened to "DFSG team"), which is relatively new, has started to employ LLMs insending out reviews of packages entering Debian's new queue. The practice hasraised a number of objections and questions about where lines should be drawn inthe use of LLM-generated output.
Fedora Linux45 has been released. This includes all editions: Fedora Workstation, Fedora KDE Plasma Desktop, Fedora Server, Fedora Cloud, Fedora CoreOS, and Fedora IoT, as well as the Atomic Desktops and Spins.This release adds support for installationon Stratis storage using Anaconda or Kickstart installs, retiresunmaintained VPN plugins for NetworkManager, and updates Fedora's desktopenvironments, developer toolchains, and system packages. See the Fedora wikiChangeSet page for a list of major changes.
The 7.4 merge window, whichclosed on November 1,included a record-breaking 18,591 non-merge changesets.That is almost as many as the entire 7.3 development cycle, which had 18,765, itself a record breaker. Ofthose, 11,838 landed after the article covering thefirst part of the merge window. Most of those were bug fixes ofvarious forms; it seems as though bug fixes may be crowding out featureadditions across the open-source ecosystem tosome extent. Still, a good number of new features were included, and a handfulremoved, in the tail end of the merge window.
We recently looked at how thekernel community is dealing with the firehose of vulnerability reports, butsaid little about how users of the kernel are responding. At the 2026 Linux Plumbers Conference, Amazon employeesDylan Johnson and Justinien Bouron discussed the problem from the point ofview of engineers trying to keep AWS running and secure in the face of astorm of CVE disclosures. The kernel community's longstanding advice is torun current kernels, and that turns out to work - sort of.
Version16.0 of the Tor Browserhas been released. This is the first stable version based on Firefox ESR153. Notable changes in this release include support for Linux on 64-bit Arm,redesigned settings, and a "generic window titles" feature to help prevent otherapplications from snooping on one's browser activity. Tor Browser forAndroid has had a number of interface updates to Google's MaterialDesign3 design language.This release also follows Firefox in ending support for 32-bit x86 Linuxsystems. See the fullchangelog for all of the updates and bug fixes.
The Hacktron blog documents howthe group was able to compromise the GNU Savannah forge and could havepushed malware into any of the projects hosted there.
The final talk at Kangrejos 2026 was about the removal of the C implementationof Android'sBinder driver, the primary interprocess communication mechanismused on Android devices. Carlos Llamas announced that he had deleted the Ccode to general applause, and then shared some insights about what went intoreplacing the C implementation. Alice Ryhl, who has worked on the Rustimplementation for some years, added her own thoughts about what the mostdifficult and interesting parts of the transition were.
On October 27, LLM provider Anthropicreportedon aremotely exploitable use-after-free bug affecting systems withmultipath TCP listeners open. The bug works by triggering a response to aretransmitted SYN packet at the same moment that the TCP connection isestablished in another thread, causing the first thread to access theconnection's options structure after the second thread has freed it. The firstthread can then disclose kernel memory or cause a buffer overflow, writing anattacker-controlled payload. The fix wasto only free the structure after an RCU grace period.On October 29, the Go security teamadvisedthat all programs written in Go use multipath TCP by default, so manysystems may be unknowingly vulnerable. And, of course, there is always thepossibility of related bugs in other sections of the TCP stack. Users may bewise to update to a patched kernel as soon as one becomes available for theirdistribution.
In a followup to his session at the2025 Linux Plumbers Conference (LPC), Carlos O'Donell returned to the topicof system-callwrappers for the GNU C library (glibc) at this year's event. This timearound, he was joined by Florian Weimer, who is another glibc maintainer.The idea was to give an update on what has happened over the last year withregard to Linux system calls that lack a glibc wrapper, thus are onlyaccessible viasyscall(). In addition, they wanted to hear from attendees about theirneeds in this area.
Greg Kroah-Hartman has announced the release of the 7.3.1,7.2.14,6.18.60,6.12.115,6.6.161,6.1.191,5.15.224, and5.10.273 stable kernels. As usual, he advisesall users to update-advice that seems especially wise given theincreased number of security-relevant bug fixes that the kernel is seeing these days.[Edit: the 7.2.15 stable release is already in review as well.]
The foundation of the design for containers in the kernel is that thereisn't one; there is no container abstraction that the kernel recognizes.Instead, the kernel provides a long list of components - namespaces,control groups, sandboxing mechanisms, and more - along with a note thatsays, in effect, "some assembly required". There have been attempts (repeatedly) over the years to turn containersinto first-class objects with kernel support, but they have never gottenfar. Now Josef Bacik is making atry with a concept that he calls "cells".
There is not a broad selection of mature, open-source web-browser enginesfor Linux users. Most of the browsers available for Linux are based on one ofjust three projects: Chromium's Blink, Firefox'sGecko, or WebKit. A new entrant wouldgenerally be seen as a welcome alternative, but the recent campaign to push oneof the LLM-written Nordstjernen browsersinto Debian and Arch Linux has raised some questions aboutthe project's development and security processes.
The Redox OS project, which is aUnix-like microkernel-based operating system written in Rust, has published a report on the workthat it has done in the last year to implement io_uring-likeI/O.
Peter Robinson has written a blog post aboutthe current state of Fedora support for RaspberryPi5devices. According to Robinson, the upcoming Fedora45 release willwork-with caveats-onall variants of the RaspberryPi Model5B; theComputeModule5 and Pi500+ are still works in progress.
Alexandre Courbot spends most of his time working on the kernel doing codereviews. Recently, he's been wondering about what the standards should be forwhen Rust code is allowed to panic, and how it should do error handling moregenerally. Unlike many of the other talks at Kangrejos 2026, his talk was notpresenting some existing work, but rather hoping to solicit opinions on thetopic from the assembled Rust for Linux developers. He brought along a collection of trickycases that he had run into recently to prompt discussion.
Python's experimentaljust-in-time (JIT) compiler, which was added to CPython in 2024 for the 3.13release,is on its way out. In June, the Python steering council announcedthat it was pausing work on the JIT in CPython's main branch until there was anaccepted Python EnhancementProposal (PEP) that addressed concerns about maintenance, compatibility, andset clear success metrics as well as a timeline for completion. After creatingPEP836 ("JIT Go Brrr: ThePath to a Supported JIT Compiler for CPython")to try to meet the council's request, and after months of discussion, theJIT maintainers have withdrawn the PEP. For now, it appears that development onthe once-promising project has come to an end.
Greg Kroah-Hartman has announced the release of the 7.2.13 and 6.18.59 stable kernels. Each contains a number offixes throughout the tree. Users are advised to upgrade.
Christian Brauner has announced that hehas merged supportfor writing leaf components of systemd in Rust. Rust will be used only for newleaf components, existing code is not being ported to Rust and nothing thatother components depend on is written in Rust.Brauner said that theproject would like to move forward with Rust support in core systemd, "butthere are several blockers in Rust's support for dynamic libraries whichprevents us from doing that without massively bloating every binary webuild". Assuming all goes well, it seems likely this work will appear in thesystemd v263 release expected in December.
Since the merge window for 7.4 opened, there have been 6,753 non-mergechangesets pulled into the mainline repository. Many more are expected,especially given the possibility that this merge window will be extended tothree weeks. Still, even this initial set brought in a number of new features,in addition to the continued general cleanups and security fixes that the kernelhas seen recently.
Memory has always been a scarce resource in computing systems, but theproblem seems to have worsened recently. In particular, the worldwideshortage of memory chips has led to a renewed focus by systems developerson reducing memory usage. During the memory-management microconference atthe 2026 Linux Plumbers Conference, WillDeacon discussed one specific consumer of memory that is beingre-examined: kernel stacks.
Linus Torvalds rarely writes significant amounts of kernel code these days, sothe mergingof a 48-part patch series from him is an unusual event. This series,destined for the 7.4 kernel release, performs some long-delayed kernelcleanup by removing a couple of the primitives used to access user-space memoryfrom the kernel. What was once a best practice has long been superseded,but it can take time for such changes to work their way through a body ofcode this large.
LWN.net