The 7.4 merge window, whichclosed on November 1,included a record-breaking 18,591 non-merge changesets.That is almost as many as the entire 7.3 development cycle, which had 18,765, itself a record breaker. Ofthose, 11,838 landed after the article covering thefirst part of the merge window. Most of those were bug fixes ofvarious forms; it seems as though bug fixes may be crowding out featureadditions across the open-source ecosystem tosome extent. Still, a good number of new features were included, and a handfulremoved, in the tail end of the merge window.
We recently looked at how thekernel community is dealing with the firehose of vulnerability reports, butsaid little about how users of the kernel are responding. At the 2026 Linux Plumbers Conference, Amazon employeesDylan Johnson and Justinien Bouron discussed the problem from the point ofview of engineers trying to keep AWS running and secure in the face of astorm of CVE disclosures. The kernel community's longstanding advice is torun current kernels, and that turns out to work - sort of.
Version16.0 of the Tor Browserhas been released. This is the first stable version based on Firefox ESR153. Notable changes in this release include support for Linux on 64-bit Arm,redesigned settings, and a "generic window titles" feature to help prevent otherapplications from snooping on one's browser activity. Tor Browser forAndroid has had a number of interface updates to Google's MaterialDesign3 design language.This release also follows Firefox in ending support for 32-bit x86 Linuxsystems. See the fullchangelog for all of the updates and bug fixes.
The Hacktron blog documents howthe group was able to compromise the GNU Savannah forge and could havepushed malware into any of the projects hosted there.
The final talk at Kangrejos 2026 was about the removal of the C implementationof Android'sBinder driver, the primary interprocess communication mechanismused on Android devices. Carlos Llamas announced that he had deleted the Ccode to general applause, and then shared some insights about what went intoreplacing the C implementation. Alice Ryhl, who has worked on the Rustimplementation for some years, added her own thoughts about what the mostdifficult and interesting parts of the transition were.
On October 27, LLM provider Anthropicreportedon aremotely exploitable use-after-free bug affecting systems withmultipath TCP listeners open. The bug works by triggering a response to aretransmitted SYN packet at the same moment that the TCP connection isestablished in another thread, causing the first thread to access theconnection's options structure after the second thread has freed it. The firstthread can then disclose kernel memory or cause a buffer overflow, writing anattacker-controlled payload. The fix wasto only free the structure after an RCU grace period.On October 29, the Go security teamadvisedthat all programs written in Go use multipath TCP by default, so manysystems may be unknowingly vulnerable. And, of course, there is always thepossibility of related bugs in other sections of the TCP stack. Users may bewise to update to a patched kernel as soon as one becomes available for theirdistribution.
In a followup to his session at the2025 Linux Plumbers Conference (LPC), Carlos O'Donell returned to the topicof system-callwrappers for the GNU C library (glibc) at this year's event. This timearound, he was joined by Florian Weimer, who is another glibc maintainer.The idea was to give an update on what has happened over the last year withregard to Linux system calls that lack a glibc wrapper, thus are onlyaccessible viasyscall(). In addition, they wanted to hear from attendees about theirneeds in this area.
Greg Kroah-Hartman has announced the release of the 7.3.1,7.2.14,6.18.60,6.12.115,6.6.161,6.1.191,5.15.224, and5.10.273 stable kernels. As usual, he advisesall users to update-advice that seems especially wise given theincreased number of security-relevant bug fixes that the kernel is seeing these days.[Edit: the 7.2.15 stable release is already in review as well.]
The foundation of the design for containers in the kernel is that thereisn't one; there is no container abstraction that the kernel recognizes.Instead, the kernel provides a long list of components - namespaces,control groups, sandboxing mechanisms, and more - along with a note thatsays, in effect, "some assembly required". There have been attempts (repeatedly) over the years to turn containersinto first-class objects with kernel support, but they have never gottenfar. Now Josef Bacik is making atry with a concept that he calls "cells".
There is not a broad selection of mature, open-source web-browser enginesfor Linux users. Most of the browsers available for Linux are based on one ofjust three projects: Chromium's Blink, Firefox'sGecko, or WebKit. A new entrant wouldgenerally be seen as a welcome alternative, but the recent campaign to push oneof the LLM-written Nordstjernen browsersinto Debian and Arch Linux has raised some questions aboutthe project's development and security processes.
The Redox OS project, which is aUnix-like microkernel-based operating system written in Rust, has published a report on the workthat it has done in the last year to implement io_uring-likeI/O.
Peter Robinson has written a blog post aboutthe current state of Fedora support for RaspberryPi5devices. According to Robinson, the upcoming Fedora45 release willwork-with caveats-onall variants of the RaspberryPi Model5B; theComputeModule5 and Pi500+ are still works in progress.
Alexandre Courbot spends most of his time working on the kernel doing codereviews. Recently, he's been wondering about what the standards should be forwhen Rust code is allowed to panic, and how it should do error handling moregenerally. Unlike many of the other talks at Kangrejos 2026, his talk was notpresenting some existing work, but rather hoping to solicit opinions on thetopic from the assembled Rust for Linux developers. He brought along a collection of trickycases that he had run into recently to prompt discussion.
Python's experimentaljust-in-time (JIT) compiler, which was added to CPython in 2024 for the 3.13release,is on its way out. In June, the Python steering council announcedthat it was pausing work on the JIT in CPython's main branch until there was anaccepted Python EnhancementProposal (PEP) that addressed concerns about maintenance, compatibility, andset clear success metrics as well as a timeline for completion. After creatingPEP836 ("JIT Go Brrr: ThePath to a Supported JIT Compiler for CPython")to try to meet the council's request, and after months of discussion, theJIT maintainers have withdrawn the PEP. For now, it appears that development onthe once-promising project has come to an end.
Greg Kroah-Hartman has announced the release of the 7.2.13 and 6.18.59 stable kernels. Each contains a number offixes throughout the tree. Users are advised to upgrade.
Christian Brauner has announced that hehas merged supportfor writing leaf components of systemd in Rust. Rust will be used only for newleaf components, existing code is not being ported to Rust and nothing thatother components depend on is written in Rust.Brauner said that theproject would like to move forward with Rust support in core systemd, "butthere are several blockers in Rust's support for dynamic libraries whichprevents us from doing that without massively bloating every binary webuild". Assuming all goes well, it seems likely this work will appear in thesystemd v263 release expected in December.
Since the merge window for 7.4 opened, there have been 6,753 non-mergechangesets pulled into the mainline repository. Many more are expected,especially given the possibility that this merge window will be extended tothree weeks. Still, even this initial set brought in a number of new features,in addition to the continued general cleanups and security fixes that the kernelhas seen recently.
Memory has always been a scarce resource in computing systems, but theproblem seems to have worsened recently. In particular, the worldwideshortage of memory chips has led to a renewed focus by systems developerson reducing memory usage. During the memory-management microconference atthe 2026 Linux Plumbers Conference, WillDeacon discussed one specific consumer of memory that is beingre-examined: kernel stacks.
Linus Torvalds rarely writes significant amounts of kernel code these days, sothe mergingof a 48-part patch series from him is an unusual event. This series,destined for the 7.4 kernel release, performs some long-delayed kernelcleanup by removing a couple of the primitives used to access user-space memoryfrom the kernel. What was once a best practice has long been superseded,but it can take time for such changes to work their way through a body ofcode this large.
There are several Rust features that kernel developers have been hoping tostabilize, but Josh Triplett wanted to describe all of the otherfeatures that the Rust project is currently working on. He spoke about the topicat Kangrejos 2026, leaving the assembled kernel developers with several ideasabout how to use these upcoming Rust features in the kernel.The features included refinements to the type system, small syntax improvements, and asmarter borrow checker.
The Node.js project hasreleaseda number of security updates to fix, among other vulnerabilities, aremote-code-execution bug affecting programs that use Brotli compression. And,in case any programmers who use compiled languages thought they could relax, themusl libc project has also announced anew vulnerability: anout-of-boundswrite that could potentially lead to remote code execution, although thathas not been demonstrated.
We last looked in on hash-based integritychecking for kernel modules just over a year and half ago. Since that time,the patchset has undergone multiple revisions. At the 2026 Linux Plumbers Conference(LPC), Thomas Weischuh described the need for kernel-module integrityguarantees while still providing reproducible builds, how his patches implement that, and some ideas for possiblefurther work.
Nix flakes are anexperimental feature of the Nix package-managementtool designed to build projects in a more self-contained and reproducibleway. Despite the feature's experimental status, it has become increasinglypopular for open-source projects to publish flake.nix files that offerpredefined development environments and build automation even when thoserepositories may not offer an upstream package or module for the NixOS Linux distribution. AlthoughNix flakes have a complicated history, and the path for stabilization isuncertain, flakes can provide useful capabilities for projects that choose toinclude them.
The PHP project has published PHPversions 8.5.12,8.4.27, 8.3.36 and 8.2.35 to addresstwo critical vulnerabilities that could allow unauthenticated remote codeexecution.
Greg Kroah-Hartman has announced the release of the 7.2.12,6.18.58,6.12.114, and 6.6.160 stable kernels. Each contains a numberof important fixes; users are advised to upgrade.
The PHP security team has let it beknown that there is a high-stakes security update coming at14:00UTC on October21. "All PHP users are encouraged toprepare now so they can upgrade as soon as the release is available".Anybody running a PHP site probably needs to be prepared for this one.
Setuid (and setgid) binaries have long been a source of headaches, and securityvulnerabilities, on Linux systems. They are largely seen as something to beavoided; SUSE's security team, for example, forbidsthe inclusion of setuid or setgid binaries in packages unless they have beenreviewed and explicitly allowed. Thorsten Kukuk wants to go a step further anddisallow them entirely. At the 2026AllSystemsGo! conference, he spokeabout his work to disable setuid system-wide, as well as some of the hurdlesthat remain.
The work to support block sizes larger than the page size on XFS has beendifficult. Many users of XFS run stable kernels, which means that they aren't testingnew XFS code as it is released. That has made Daniel Gomez wonder whetheradopting Rust for some of the data structures underlying XFS, particularlyXArrays, could reduce the number of bugs lurking in the code. AtKangrejos 2026, he led a discussion about the potential problems with convertingXArray to Rust. The assembled kernel developers had a number of reasons to becautious about replacing the XArray code, but Gomez was determined to experimentwith the possibility, citing both security and performance improvements.
OpenBSD 8.0 has beenreleased. There are many new features, including the addition of hibernatesupport for arm64, an increase in the kernel virtual address space for amd64 to512GB, quite a few improvements for the qwx driver that supportsQualcommWiFi6 devices, and much more. See the full changelog fordetails.
LWN.net