section
FOSS
Kernel, distros, and the wider free and open source software world.
491 stories archived
How We Could Have Backdoored Bash (Hacktron blog)
The Hacktron blog documents how the group was able to compromise the GNU Savannah forge and could have pushed malware into any of the projects hosted there. Using Hacktron, we found that an email address like `touch${IFS}/tmp/savane-rce-proof`@attacker.example gave any registered user code execution on its backend. From there, we made our account a superuser, impersonated Bash's maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository. An unpatched kernel gave us root access and access to a GNU backup server. We reported it to the FSF on May 11, 2026.
New Linux 7.4 Feature For Reducing AI Noise Already Reverted Due To A "Crazy Beast"
A new feature merged last week for Linux 7.4 to help reduce AI/LLM generated noise from invalid/irrelevant testing configurations is now reverted due to a "crazy beast" in the VFIO subsystem...
Denmark’s Collabora Pilot Was Never The Microsoft Replacement it Was Made Out to Be
Collabora says a ministry merger paused the test, while the ministry says it was interrupted when the election was called.
KDE Plasma 6.9 Lands Some New Performance Optimizations
I love a good performance optimization and there are several this week in the KDE space with Plasma 6.9 development heating up...
Ceph In Linux 7.4 Adds Global Mount Option For Lazy I/O
The Ceph kernel client changes have been submitted for Linux 7.4 ahead of its merge window expected to wrap up on Sunday...
GNOME Now Has An Established RFC Process, GNOME OS Continues Improving
In recent weeks GNOME developers have been discussing a formal Request For Comments "RFC" process for solving major technical questions and changes to GNOME. This formalized process for succeeding their ad-hoc processes up to now has reached consensus...
DXVK-NVAPI 0.9.3 Brings Nice Improvements For Linux Gamers On Latest NVIDIA Drivers
DXVK-NVAPI 0.9.3 is out this weekend as a new feature update to this NVIDIA NVAPI implementation used by Valve as part of Steam Play with Proton for nicely integrating NVIDIA technologies into various Windows games running on Linux...
CUDA Oxide 0.3 Vastly Improves Rust Support For NVIDIA CUDA Programming
NVIDIA software engineers released CUDA Oxide 0.3 for closing out October. CUDA Oxide as a reminder is their experimental Rust to CUDA compiler that has been seeing a lot of activity in recent months...
Sculpt OS 26.10 Released - Now Powered By Genode's Custom Microkernel
Sculpt OS as the general purpose operating system project born out of the Genode initiative is now using the project's own microkernel rather than a third-party microkernel...
Wine 11.21 Released With Better WoW64 OpenGL Performance
Wine 11.21 is out as the newest bi-weekly development release of Wine and as we near Wine 12.0 stable release happenings getting underway in about one month with the official v12.0 release expected early in the new year...
Ubuntu 27.04 ‘Tenacious T-Rex’ opens for development
Development on Ubuntu 27.04, codenamed ‘Tenacious T-Rex’, has officially begun. The tenacious archive is now open (30 October 2026), with auto-sync from Debian set to pull in a tranche of updated packages since the Ubuntu 26.10 release. Over the course of the next six months, those will be tested, set and form the basis of the final, stable release. Ubuntu 27.04 is scheduled for release on 22 April 2027, with a beta preceding it on 1 April (not a joke). Ubuntu 26.10 saw its beta delayed by a week, but hopefully the new development cycle has fewer hiccups. What to […] You're reading Ubuntu 27.04 ‘Tenacious T-Rex’ opens for development , a blog post from OMG! Ubuntu . Do not reproduce elsewhere without permission.
PostgreSQL 19 Running Behind Schedule Due To AI/LLM Burden
The PostgreSQL database server typically sees its annual feature release every September~October, but it's not coming until at least November if not longer this year. Due to the increased developer burden due to increased bug reporting and patches via AI/LLM activity, the PostgreSQL developers have been overwhelmed...
[$] Removing binder.c
The final talk at Kangrejos 2026 was about the removal of the C implementation of Android's Binder driver , the primary interprocess communication mechanism used on Android devices. Carlos Llamas announced that he had deleted the C code to general applause, and then shared some insights about what went into replacing the C implementation. Alice Ryhl, who has worked on the Rust implementation for some years, added her own thoughts about what the most difficult and interesting parts of the transition were.
Ubuntu 27.04 "Tenacious T-Rex" Opens For Development
Following this month's release of Ubuntu 26.10, Ubuntu 27.04 development formally got underway today...
Haas: Postgres 19 is late, and it's AI's fault
PostgreSQL developer Robert Haas writes about the struggles the project has encountered in putting together its next release. In the end, I don't think that the delay in shipping PostgreSQL 19 is particularly concerning. It is not a long delay in the grand scheme of things, and it emerges directly from the project's concern for quality. The long-term picture is less clear and in some ways more troubling: given that we have forty years of bugs that humans were unable to find but LLMs are quite capable of discovering, how are we ever going to catch up, and how will PostgreSQL continue to innovate? Right now, I'm not sure. What I do know is that I, and many others, are working really hard to figure it out. LWN looked at the PostgreSQL 19 release and its challenges in September.
Remote code execution on Linux systems with multipath TCP
On October 27, LLM provider Anthropic reported on a remotely exploitable use-after-free bug affecting systems with multipath TCP listeners open. The bug works by triggering a response to a retransmitted SYN packet at the same moment that the TCP connection is established in another thread, causing the first thread to access the connection's options structure after the second thread has freed it. The first thread can then disclose kernel memory or cause a buffer overflow, writing an attacker-controlled payload. The fix was to only free the structure after an RCU grace period . On October 29, the Go security team advised that all programs written in Go use multipath TCP by default , so many systems may be unknowingly vulnerable. And, of course, there is always the possibility of related bugs in other sections of the TCP stack. Users may be wise to update to a patched kernel as soon as one becomes available for their distribution.
AMD Ryzen Zen 6 Looks Like It Will Be In Good Shape With Linux 7.4, Laptop Improvements
The x86 platform driver changes were merged this week to the Linux 7.4 kernel ahead of the merge window closing this weekend...
[$] System-call wrappers for glibc
In a followup to his session at the 2025 Linux Plumbers Conference (LPC), Carlos O'Donell returned to the topic of system-call wrappers for the GNU C library (glibc) at this year's event. This time around, he was joined by Florian Weimer, who is another glibc maintainer. The idea was to give an update on what has happened over the last year with regard to Linux system calls that lack a glibc wrapper, thus are only accessible via syscall() . In addition, they wanted to hear from attendees about their needs in this area.
Eight more stable kernel updates
Greg Kroah-Hartman has announced the release of the 7.3.1 , 7.2.14 , 6.18.60 , 6.12.115 , 6.6.161 , 6.1.191 , 5.15.224 , and 5.10.273 stable kernels. As usual, he advises all users to update—advice that seems especially wise given the increased number of security-relevant bug fixes that the kernel is seeing these days. [Edit: the 7.2.15 stable release is already in review as well.]
Another Week, Another Vibe Coded OS; Closed-Source In The Name Of Security
With today's AI/LLM capabilities, there is almost a new operating system heard about each week "coded from scratch" predominantly via AI agents. This week was no exception with another project hitting our email inbox. Though most of them are open-source, this one is closed-source in the name of security...
AMD PerfOpt Makes it Into Linux 7.4 As A Nice Performance Boost For AMD iGPUs
As anticipated, the AMD PerfOpt feature was picked up for the Linux 7.4 kernel. As shown already in multiple Phoronix benchmarks, AMD PerfOpt makes for a nice performance boost for AMD integrated graphics, especially for AI workloads...
Apple Silicon Linux Driver Adapted To Help Older Intel-Powered Macs
The Linux kernel's "macsmc" driver was developed for supporting the system management controller (SMC) on Apple Silicon Macs for supporting the light sensor, fan control, and other sensors. That macsmc driver now is seeing work to extend it for better supporting older Intel-powered Macs...
Vulkan 1.4.367 Released With VK_KHR_maintenance12
Vulkan 1.4.367 is out this morning as the newest spec revision for this high performance graphics and compute API...
I3C Hub & HDR-DDR Support Merged For Linux 7.4
The I3C changes for Linux 7.4 were submitted this week by Bootlin's Alexandre Belloni and subsequently merged...