LWN.net

The 7.1-rc4 kernel prepatch is out fortesting.

We have receivedword that Peter G. Neumann, who, among many other things, ran the RISKS Digest for decades, haspassed away. He will be much missed.Update: the New York Times has published anobituary of Dr. Neumann.

The 7.0.9,6.18.32,6.12.90, and6.6.140 stable kernels have been released.Each contains yet another set of important fixes.

Roman Gushchin began his session in the memory-management track of the2026 Linux Storage,Filesystem, Memory Management, and BPF Summit by saying that thecommunity has seen a lot of proposals adding BPF-based interfaces formemory management. None of them have made their way into the mainline,though. He wanted to explore the ways in which BPF might be helpful andthe obstacles that have kept BPF-based solutions out so far. This sessionwas followed by a discussion led by Shakeel Butt on what the requirementsfor a new, BPF-based interface for memory control groups might look like.

Greg Kroah-Hartman has announced the 7.0.8, 6.18.31, 6.12.89, 6.6.139, 6.1.173, 5.15.207, and 5.10.256 stable kernels. These kernelscontain a patch for CVE-2026-46333a vulnerability reportedby the Qualys Security Advisory team, though Jann Horn proposeda patch in 2020. The vulnerability has a proof-of-conceptexploit published already. Some of the kernels have additionalpatches for other bugs; as always, users are advised to upgrade.

Recent times have seen a lot of effort put into the implementation of the kexec handover and live update orchestratorfeatures in the Linux kernel. But that work is not yet complete. At the2026 Linux Storage,Filesystem, Memory Management, and BPF Summit, Pratyush Yadav led amemory-management-track session on adding the ability to preserve hugetlbfs-providedmemory during the live-update process.

Security updates have been issued by Debian (ffmpeg, gsasl, nodejs, postgresql-15, postgresql-17, python3.9, and thunderbird), Fedora (expat, firefox, freerdp, GitPython, kernel, php, rust-podman-sequoia, rust-rpm-sequoia, rust-sequoia-chameleon-gnupg, rust-sequoia-git, rust-sequoia-keystore-server, rust-sequoia-octopus-librnp, rust-sequoia-openpgp, rust-sequoia-sop, rust-sequoia-sq, and rust-sequoia-sqv), Mageia (awstats, libreoffice, perl-HTTP-Tiny, and tomcat), Oracle (corosync, freerdp, gimp, git-lfs, glib2, jq, kernel, krb5, libsoup3, libtiff, openexr, thunderbird, uek-kernel, and yggdrasil), Red Hat (podman and skopeo), SUSE (amazon-ssm-agent, avahi, c-ares, cairo, containerd, cpp-httplib, dnsmasq, dovecot24, ffmpeg-4, firefox, helm, ImageMagick, iproute2, kernel, krb5, libtpms, ongres-scram, ongres-stringprep, plexus-testing, maven, maven-doxia, mojo-parent, sisu, openCryptoki, openssh, perl-Text-CSV_XS, php8, python-lxml, python-Twisted-doc, python311-click, python311-GitPython, rclone, regclient, and syncthing), and Ubuntu (avahi).

The kernel's control-groupsubsystem works well for resource management, Chris Li said at thebeginning of his memory-management-track session at the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit. Control groups workless well for other use cases, though. He was there to present hisproposed enhancement, called "policy groups", that would address some ofthe shortcomings that he has encountered. A consensus on how this featureshould look still seems distant, though.

In back-to-back sessions at the start of the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit (which spilled over intoa third slot), the atomic-buffered-writesfeature was discussed. In the first session, Pankaj Raghav and AndresFreund set the stage with an introduction to the problem, along with a usecase for its solution: the PostgreSQL database system. In the second, Ojaswin Mujoodescribed a potential way forward for the feature using an approach basedon writethrough, which effectively means that the kernel immediately writesthe data to disk instead of waiting for writeback from the page cache to occur. As might beexpected, there was quite a bit of discussion among the assembledfilesystems and storage developers during the combined sessions for thosetracks.

Greg Kroah-Hartman has announced the release of the 7.0.7, 6.18.30, and 6.12.88 stable kernels. These kernels donot include a patch for the Fragnesialocal-privilege-escalation exploit that came to light onMay13, but do include many other important fixes throughout thetree. Users are, as always, advised to upgrade.

The kernel's reverse-mapping machinery is charged with locating thepage-table entries that refer to a given page in memory. The reversemapping of anonymous pages is handled differently than for file-backedpages. The kernel's implementation of reverse mapping for anonymous pagesis, according to Lorenzo Stoakes in his proposalfor a memory-management-track session at the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit, "a very brokenabstraction", due to its complexity. It also has some performanceproblems. Stoakes was there to present, in raw form, a proposedreplacement that he calls a "COW context".

Security updates have been issued by AlmaLinux (gimp, jq, and yggdrasil), Debian (nghttp2 and thunderbird), Fedora (chromium, firefox, freerdp, GitPython, kernel, kernel-headers, krb5, nano, nix, nodejs20, php, python-click, python-django5, SDL2_image, and xen), Mageia (dnsmasq, flatpak, kernel, kmod-virtualbox, kernel-linus, perl-Net-CIDR-Lite, perl-XML-LibXML, and redis), SUSE (dnsmasq, firefox, jupyter-jupyterlab, kernel, krb5, libvinylapi3, log4j, Mesa, mozjs60, NetworkManager, OpenImageIO, python-Mako, python-Pillow, and python39), and Ubuntu (dnsmasq and nginx).

Inside this week's LWN.net Weekly Edition:

A push by Red Hat employees to create a Fedora "AI DeveloperDesktop" with support for out-of-tree kernel drivers and AI toolkitshas been met with objections from some long-time members of the Fedoracommunity. After more than a month of sometimes heated discussion, theFedoraCouncil had votedto approve the initiative; however, a last-minute change to vote against theproposal by council member Justin Wheeler has (at least temporarily)sent it back to the drawing board.

Sam James has sent an announcementto the OSS Security mailing list about anotherlocal-privilege-escalation (LPE) exploit in the same class as Dirty Frag, called"Fragnesia". From the disclosure:

When Brendan Jackman proposeda session for the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit, his topic was "apagetable library for the kernel". During the actualmemory-management-track session, though, he stated that the idea had"fizzled" and he was going to cover related topics instead. Whatresulted was a session on ways to efficiently manage pages that are notpresent in the kernel's direct map.

Linux can share memory between processes, but each process (almost always)has its own set of page tables. In situations where vast numbers ofprocesses are sharing a memory region, the combined size of the pagetables can exceed that of the shared memory itself. There has, thus, longbeen an interest in enabling unrelated processes to share page tablesreferring to shared memory. Anthony Yznaga is the latest developer to tryto push this idea (known as "mshare") forward; he described the status ofthat work in a memory-management-track discussion at the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit (LSFMM+BPF).

Security updates have been issued by AlmaLinux (corosync, freerdp, git-lfs, glib2, jq, kernel-rt, krb5, libpng, libtiff, openexr, and thunderbird), Debian (exim4), Mageia (apache, perl-Gazelle, php, and sed), Slackware (expat), SUSE (assimp-devel, go1.26, libQt6Svg6, python-jupyterlab, raylib, thunderbird, tor, and trivy), and Ubuntu (exim4).

The KDE project has announcedthat it has been awarded over 1million from the Sovereign Tech Fundto improve its desktop-environment software. "The investment will beused to strengthen the structural reliability and security of KDE's coreinfrastructure, including Plasma, KDE Linux, and the frameworks underlyingits communication services."

The kernel's dma-bufsubsystem provides a way for drivers to share memory buffers, usuallyin order to support efficient device-to-device I/O. At the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit, Pavel Begunkov, assistedby Kanchan Joshi, led a joint session of the storage and memory-managementtracks to explore ways to make the use of dma-bufs more efficient yet, andto make them available for read and write operations initiated by userspace.

As a general rule, when developers talk about huge pages, they arereferring to PMD-level pages that are 1MB or 2MB in size, depending on theCPU architecture. Most CPUs can support other huge-page sizes, though. Onx86 systems, PUD-level huge pages hold 1GB of data. Providing such largepages transparently to processes has generally not been considered aseither feasible or desirable, but Usama Arif is trying to change thatassessment. At the 2026 Linux Storage,Filesystem, Memory Management, and BPF Summit, he led a session in thememory-management track on how to make transparent huge pages (THPs) trulyhuge.

Security updates have been issued by AlmaLinux (freerdp, glib2, libsoup3, and openexr), Debian (dnsmasq, p7zip, p7zip-rar, python-authlib, and rails), Fedora (chromium, firefox, httpd, and nss), SUSE (java-25-openj9, krb5, libmodsecurity3, and mcphost), and Ubuntu (imagemagick, linux, linux-aws, linux-aws-fips, linux-aws-hwe, linux-azure-4.15, linux-fips, linux-gcp, linux-gcp-4.15, linux-gcp-fips, linux-hwe, linux-kvm, linux-oracle, linux-azure, linux-azure-fips, linux-oracle, linux-azure-5.15, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, and linux-raspi).

Daniel Stenberg has published a lengthyarticle on his thoughts on Anthropic's Mythos, which the companydecided was too dangerous for wide public release.

Greg Kroah-Hartman has released the 7.0.6 and 6.18.29 stable kernels with HyunwooKim's patchfor the second vulnerability (CVE-2026-43500)reported with DirtyFragand CopyFail2. Allusers are advised to upgrade.

Some CPU architectures are able to run with a number of different base-pagesizes; using a larger size can often result in better performance at thecost of increased memory use. Other architectures are more limited. Atthe 2026 LinuxStorage, Filesystem, Memory Management, and BPF Summit, two sessions inthe memory-management track explored options for letting processes run with64KB page sizes when the underlying kernel does not. The first was focusedon letting each process have its own page size, while the second concernedbringing 64KB pages to x86 systems.

Paul Gevers has slipped an interesting bit of news into a "bits from the releaseteam" message:

Security updates have been issued by AlmaLinux (corosync, freeipmi, kernel, and kernel-rt), Debian (corosync, firefox-esr, kernel, lcms2, libpng1.6, linux-6.1, php8.2, php8.4, postorius, pyjwt, and tor), Fedora (dotnet10.0, exim, gnutls, kernel, nextcloud, nodejs22, php, proftpd, prosody, python-pulp-glue, python-requests, rclone, and SDL3_image), Mageia (firefox, nss, rootcerts, openvpn, thunderbird, and vim), Oracle (corosync, freeipmi, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good, kernel, libpng, and mingw-libtiff), Slackware (kernel and mozilla), SUSE (build, product-composer, c-ares, cairo, copacetic, distribution, firefox, firefox-esr, frr, glibc, go1.25, google-cloud-sap-agent, iproute2, java-11-openj9, java-17-openj9, java-17-openjdk, java-1_8_0-openj9, java-21-openj9, java-21-openjdk, java-25-openjdk, kernel, libexif-devel, libpcp-devel, libtpms, libtree-sitter0_26, Mesa, micropython, mozjs128, nginx, opencc, openCryptoki, php-composer2, podman, postfix, python-pytest, python311-Django, python311-Django4, redis, semaphore, strongswan, terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provid, tor, valkey, vim, and wireshark), and Ubuntu (linux-nvidia-tegra, linux-raspi, linux-raspi-5.4, and nasm).

Linus has released 7.1-rc3 for testing."I think this answers the 'is 7.1 continuing the larger size patternthat we saw with 7.0?' question, and the answer is yes: that wasn't a flukebrought on by a .0 release - it simply seems to be the new normal."

Greg Kroah-Hartman has released the 6.1.171, 5.15.205, and 5.10.255 stable kernels, quicklyfollowed by 6.1.172 and 5.15.206 kernels. This is another roundof stable kernels to provide fixes for one of the CVEs (CVE-2026-43284)assigned following the DirtyFrag and CopyFail2security disclosures. There is not, yet, a stable kernel with a fixfor CVE-2026-43500,though apatch to fix the second half is in the works.

An unusual, some might say hostile, approach to disclosing an allegedremote-code-execution (RCE) flaw in the Forgejo software-collaboration platform hassparked a multifaceted conversation. A so-called"carrot disclosure" in April has raised questions about theresearcher's methods of unveiling a security problem, Forgejo'ssecurity policies, and the project's overall security posture.

It seems that we are in for an extended period of the disclosure ofvulnerabilities before fixes become available. One possible way of copingwith this flood might be the killswitchproposal from Sasha Levin. In short, killswitch can immediately disableaccess to specific functionality in a running kernel, essentially blastinga vulnerable path (and its associated functionality) out of existence untila fix can be installed. "For most users, the cost of 'this socketfamily stops working for the day' is much smaller than the cost of runninga known vulnerable kernel until the fix land."

The kernel's DAMON subsystemprovides user-space monitoring and management of system memory. DAMON isdeveloping rapidly, so an update on its progress has become a regularfeature of the annual Linux Storage,Filesystem, Memory Management, and BPF Summit. This traditioncontinued at the 2026 gathering with an update from DAMON creator SeongJaePark covering a long list of new capabilities - tiering, data attributesmonitoring, transparent huge pages, and more - being added to this subsystem.

Security updates have been issued by AlmaLinux (libsoup and mingw-libtiff), Debian (apache2, chromium, lcms2, libreoffice, and prosody), Fedora (openssl and perl-Starman), Oracle (git-lfs, libsoup, and perl-XML-Parser), Slackware (libgpg, mozilla, and php), SUSE (389-ds, cairo, cf-cli, chromedriver, cri-tools, freeipmi, gnutls, grafana, java-11-openjdk, java-17-openjdk, jetty-minimal, libmariadbd-devel, librsvg, mesa, mozjs52, mutt, nix, opencryptoki, python-Django, python-django, python-pytest, rmt-server, thunderbird, traefik, webkit2gtk3, wireshark, and xen), and Ubuntu (civicrm, dpkg, htmlunit, lcms2, libpng1.6, linux, linux-*, linux-azure, linux-azure-fips, linux-raspi, linux-xilinx, lua5.1, nasm, opam, openexr, openjpeg2, owslib, postfix, postfixadmin, and vim).

Greg Kroah-Hartman has announced the release of the 7.0.5, 6.18.28, 6.12.87, and 6.6.138 stable kernels. These kernelscontain a partial fix for the DirtyFrag and CopyFail2security flaws. Kroah-Hartman has confirmedthat a second patch is required, but it is still in development and has not yet been merged.

Hyunwoo Kim has announcedthe DirtyFrag security flaw, alocal-privilege-escalation (LPE) vulnerability similar to therecently disclosed Copy Failflaw:

On April 21, Andrew Morton letit be known that he intends to begin stepping away from themaintainership of kernel's memory-management subsystem - a responsibilityhe has carried since before memory management was even seen as its ownsubsystem. At the 2026 Linux Storage, Filesystem, Memory Management, andBPF Summit, one of the first sessions in the memory-management track wasdevoted to how the maintainership would be managed going forward. Thereare a lot of questions still to be answered.

Arjen Hiemstra has publishedan article on the status of the Union project: asingle system to support all of KDE's technologies used for stylingapplications.

Security updates have been issued by AlmaLinux (dovecot, fence-agents, freeipmi, git-lfs, image-builder, kernel, libsoup, osbuild-composer, and python-tornado), Debian (apache2, libdatetime-timezone-perl, lrzip, tzdata, and wireshark), Fedora (dovecot, forgejo-runner, gh, gnutls, krb5, nano, pdns, pyOpenSSL, squid, vim, and xorg-x11-server-Xwayland), Mageia (graphicsmagick, kernel-linus, krb5-appl, libexif, libtiff, nano, nginx, ntfs-3g, opam, perl-Net-CIDR-Lite, perl-Starlet, perl-Starman, tcpflow, and virtualbox), Oracle (dovecot, fence-agents, freeipmi, image-builder, kernel, libcap, LibRaw, libsoup, openssh, osbuild-composer, python, python-tornado, python3, systemd, thunderbird, and tigervnc), SUSE (containerd, curl, erlang, flatpak, java-11-openjdk, java-21-openjdk, java-25-openjdk, liblxc-devel, libpng12, libthrift-0_23_0, openCryptoki, openexr, openssl-3, python3, python311-social-auth-core, rclone, skim, and thunderbird), and Ubuntu (apache2, coin3, editorconfig-core, insighttoolkit, linux, linux-aws, linux-aws-6.17, linux-gcp, linux-gcp-6.17, linux-hwe-6.17, linux-oracle, linux-realtime, linux-realtime-6.17, linux-azure, linux-azure-6.17, linux-oem-6.17, linux-azure-5.15, linux-gcp-6.8, nghttp2, python-dynaconf, slurm-wlm, swish-e, and webkit2gtk).

The7.0.4,6.18.27, and6.12.86stable kernels have been released; each contains another set of importantfixes.

Inside this week's LWN.net Weekly Edition:

Predictions that LLM tools would cause a surge in reports of security vulnerabilitieshave, unquestionably, borne out. As expected, maintainers are having to wadethrough more security reports than ever before; in addition, LLM tools aredisrupting traditional-coordinated disclosure practices as well. The method of Copy Fail's disclosure, in particular, leftvendors, projects, and users scrambling. In addition, maintainers are seeingparallel discovery of the same security flaws within the embargo window. Bothof these developments mean that coordinated security disclosures may become athing of the past.

Version7.0 of the Incus container andvirtual-machine management system has been released. Notable changes in thisrelease include the inclusion of a low-level backup API, the additionof basic S3 operations directly in Incus to replace the now-unmaintainedMinIO project, as well as the removal of support forcgroups v1 and xtables (iptables/ip6tables/ebtables). This is along-term-support (LTS) release, with support through June 2031.

Security updates have been issued by AlmaLinux (corosync, dovecot, image-builder, python-tornado, resource-agents, and systemd), Debian (openjdk-11, openjdk-17, and pyjwt), Fedora (pdns, pyOpenSSL, and squid), Slackware (hunspell), SUSE (alloy, avahi, bubblewrap, cmctl, coredns, curl, dpkg, firefox, golang-github-prometheus-prometheus, grafana, libpng12, PackageKit, sed, and xen), and Ubuntu (docker.io-app, nghttp2, python-django, and python-mako).

A recentpatch set from Steffen Eiden and others has set the groundwork for allowinghardware-assisted emulation of Arm CPUs on s390 CPUs.Version two of the posting fixes a handful of smaller problems, but does notdiffer much.The patches were welcomedby the Arm maintainers, pending some discussion of how the collaboration between thearchitectures could be structured to prevent maintainability problems on the Armside. When those details are resolved, the patches could pave the way fortransparently running Arm-based virtual machines (VMs) on s390 hosts at native ornear-native speeds.

Security updates have been issued by AlmaLinux (kernel, kernel-rt, libcap, LibRaw, openssh, thunderbird, and tigervnc), Debian (libarchive and lxd), Fedora (chromium, insight, nodejs20, rust-sequoia-git, and uriparser), Mageia (kernel, kmod-virtualbox), Oracle (kernel, libcap, thunderbird, and uek-kernel), Red Hat (.NET 10.0, .NET 8.0, .NET 9.0, fence-agents, sudo, and systemd), Slackware (httpd), SUSE (freerdp, hauler, helm, himmelblau, kernel, libspectre, thunderbird, trivy, and xen), and Ubuntu (curl, exim4, and sed).

The PHP project has long shipped under its own license - except forthe parts under the Zend Engine License. The PHP project has now announcedthat the PHP license has been retired, and the PHP code has been relicensedunder the three-clause BSD license. See thisblog entry for more details.

The Alpine Linux account on fosstodon.org reportsthat all systems hosted at Linode, including its GitLab instance,"are suspended at the moment due to some billing issue". Theyare working to get it resolved, but in the meantime all of theirservices appear to be down.Update: Alpine Linux's servers are back online.

For a number of years, users submitting bugs reports against GNOME packages in Fedora havereceived an auto-reply saying that the reports were not activelymonitored; users were encouraged to file bugs with GNOME upstream instead. However,that practice seems to be in conflict with the Fedora Engineering SteeringCommittee (FESCo) policythat package maintainers "deal with reported bugs in a timely manner". OnApril 28, FESCo discussed the disconnect between practice and policy; so far,it has only opted to tweak the wording of the automatic response.

Version 5.0.0of the NetHackdungeon-exploration game, a distant relative of Rogue andHack, has been released. NetHack's code is now compliant with theC99 standard, and the release includes more than3,100bug fixes and changes, detailed in doc/fixes5-0-0.txt(may contain game spoilers). Saved games from previous versions willnot work with NetHack5.0.0.

Security updates have been issued by AlmaLinux (kernel, libcap, libtiff, sudo, and thunderbird), Debian (dovecot, imagemagick, incus, kernel, libexif, linux-6.1, openjdk-25, pyasn1, python-aiohttp, and thunderbird), Fedora (chromium, firefox, GitPython, glibc, insight, krb5, nano, nss, openssh, openvpn, perl-CryptX, python3.14, rust-openssl, rust-openssl-sys, rust-sequoia-git, and xen), Oracle (dtrace, fence-agents, grafana-pcp, libcap, libtiff, sudo, and xorg-x11-server-Xwayland), Red Hat (buildah, fence-agents, firefox, java-11-openjdk with Extended Lifecycle Support, LibRaw, nodejs24, nodejs:24, openssh, python-pyasn1, resource-agents, thunderbird, tigervnc, xorg-x11-server, and xorg-x11-server-Xwayland), Slackware (mozilla), and SUSE (avahi, curl, freeipmi, freerdp, google-guest-agent, google-osconfig-agent, gvim, helm, himmelblau, java-1_8_0-openjdk, kernel, krb5-appl-clients, libsodium, libssh, libtiff-devel-32bit, ntfs-3g_ntfsprogs, openCryptoki, openexr, ovmf, PackageKit, python-jwcrypto, python-Mako, python-PyNaCl, python311, python311-pypdf, sed, trivy, and vim).