Post Syndicated from corbet original https://lwn.net/Articles/1102060/

The PHP Foundation has put out a
blog entry explaining how the vulnerabilities disclosed today came
about and why they took so long to fix.

To fix the OOM problem, the PHP security team developed several
competing approaches, but each came with its own trade-offs:
backward compatibility breaks, new denial-of-service potential, or
requiring changes to many third-party extensions which seemed
impossible to coordinate. The PHP security team, operating on
consensus, struggled to choose between these and feared the
repercussions of shipping the wrong choice. Combined with the lack
of a known path to remote code execution and the small team of core
developers with the necessary deep knowledge of the engine occupied
with many responsibilities, this decision process caused work on a
fix to stall and restart repeatedly over months. We won’t pretend
otherwise: the delay was a structural failure, caused by both the
security team’s decision process and its lack of resources.

Post Syndicated from corbet original https://lwn.net/Articles/1102024/

The Collabora blog provides
an update on Tyr, a driver for Arm Mali GPUs.

One of our biggest challenges has been developing Tyr while the
Rust kernel abstractions and driver interfaces are also being
developed. As the driver interfaces are naturally revised and
improved, we have rewritten Tyr several times to adapt to the
larger Rust ecosystem. This not only makes progress much slower
than it would be with a mature API, but also stalls progress for
capabilities, such as job scheduling, while the abstraction is
properly designed, reviewed, tested, and merged upstream.

But working in this evolving environment is also precisely where
Tyr is able to provide the most value. As a user of these new Rust
abstractions, Tyr helps to expose their requirements and
limitations.

Post Syndicated from corbet original https://lwn.net/Articles/1101687/

The PHP security team has let it be
known that there is a high-stakes security update coming at
14:00 UTC on October 21. “All PHP users are encouraged to
prepare now so they can upgrade as soon as the release is available“.
Anybody running a PHP site probably needs to be prepared for this one.

Post Syndicated from corbet original https://lwn.net/Articles/1100241/

Linus Torvalds released
the 7.3 kernel, at the end of the usual nine-week development cycle, on
October 18. This cycle, abundantly fueled by LLM-assisted
contributions, broke just about every record imaginable. As usual, we have
compiled some statistics showing how this release, which is expected to be
the next long-term-support (LTS) kernel, came together. Also included is
an attempt to determine whether automated patch review is actually reducing
the number of bugs introduced into the kernel.

Post Syndicated from corbet original https://lwn.net/Articles/1101143/

Linus Torvalds has released the 7.3
kernel, as expected.

It’s Sunday afternoon, and this week I somehow kept my wits
together long enough to keep track of the day of the week, so the
release isn’t randomly delayed. Will wonders never cease?

Anyway, nothing very special seems to have happened this last week,
so as expected the final 7.3 is out, and thus tomorrow the merge
window for 7.4 opens. Except I’m on my annual family vacation, so
instead of merging anything first thing in the morning, I’ll spend
most of the day on a boat and under water. I’ll get back to merging
in the afternoon, but I expect my schedule to be a bit unusual for
a while.

This release is a record-breaker on all fronts; it brought in 18,765
non-merge commits from 3,021 developers, 807 of whom were first-time kernel
developers.

Significant changes in this release include some significant binfmt_misc extensions, some group-scheduling work
aimed at improving performance on large systems, the new failfs
filesystem that fails all operations, the fchroot() system call,
global per-CPU data for BPF programs, the completion of the sched_ext subscheduler feature,
working-set tracking for virtual
machines,
alternative
data-stream support in the ntfs3 filesystem,
a long
list of SMB server improvements,
and much more. See the LWN merge-window summaries
(part 1, part 2) and the KernelNewbies 7.3 page
for details.

Post Syndicated from corbet original https://lwn.net/Articles/1098611/

The NFS network filesystem protocol has a long history on Unix-like
operating systems (and beyond). NFS is still evolving, though, and
implementations need to keep up. At the 2026 Linux Plumbers Conference, NFS developer
Jeff Layton gave an overview of recent enhancements to the Linux
implementation, along with some hints for what will be coming in the near
future.

Post Syndicated from corbet original https://lwn.net/Articles/1101020/

The results
from the 2026 election for members of the Linux Foundation Technical
Advisory Board (TAB) have been announced. Kees Cook, Dave Hansen, Miguel
Ojeda, and Shuah Khan have all been re-elected, and Laurent Pinchart will
be joining the board.

Post Syndicated from corbet original https://lwn.net/Articles/1098493/

Since Android’s inception, the kernels it has used have diverged
significantly from the mainline. While many of those differences have been
resolved over time, and the move to the generic
kernel image has helped to bring Android closer, current devices still
carry a lot of out-of-tree changes. The preferred form for such changes is
by way of vendor
hooks. At the 2026 Linux
Plumbers Conference, Todd Kjos ran a fast-paced session in the Android
track to discuss vendor hooks and how they are used.

Post Syndicated from corbet original https://lwn.net/Articles/1099247/

Inside this week’s LWN.net Weekly Edition:

• Front: 2026 Maintainers Summit; Rust goals; GCC and LLMs; GCC CFI; systemd; C types in Rust; LTTng; Swap showdown; KDE Linux.
• Briefs: 64-day certificates; Nix and Lix security; Asterinas 0.19.0; LineageOS 24; KDE 6.8; Python 3.15; Quotes; …
• Announcements: Newsletters, conferences, security updates, patches, and more.

Post Syndicated from corbet original https://lwn.net/Articles/1100449/

At the recently concluded Maintainers
Summit, Linus Torvalds said that he had been using a large language
model to work on a patch series addressing a longstanding problem; he has
now posted
that series for review.

The fairly short series of ten patches basically enhances folio
lookup by noticing when folios are hot, and setting a “delay
releasing this folio until after a RCU period”, and then using that
RCU delay it does not just the folio lookup itself under RCU (which
we’ve done forever), but also the actual folio data accesses
themselves under RCU. No refcount taking needed for the fastpath
where we can just read the data from the folio entirely in an
RCU-protected region when the user copy doesn’t cause page faults.

The end result is an order-of-magnitude speedup for a read()-heavy
benchmark. Review has already identified a race
condition in the code, though, so further work will be needed.

Post Syndicated from corbet original https://lwn.net/Articles/1098672/

After much deliberation, the GCC project recently came up with a policy on the use of large
language models for development of the compiler suite. It is somewhat
restrictive, but still leaves room for LLMs in the development process. At
the 2026 GNU Tools Cauldron,
Jeff Law and Kyrill Tkachov discussed how these tools have been useful for
them.

Post Syndicated from corbet original https://lwn.net/Articles/1100055/

Asterinas is a project to build
a new operating-system kernel in Rust; it was covered here in 2025. Version
0.19.0 of the Asterinas kernel has been released; changes include a new
graphics subsystem capable of running X.org, “minimal but usable”
64-bit Arm support, better virtualization support, and more.

Post Syndicated from corbet original https://lwn.net/Articles/1099594/

The Maintainers Summit is a one-day, invitation-only gathering of about 30
kernel developers; it is held once each year to discuss policy-related issues
that are not always amenable to resolution via email. The 2026 event was
scheduled for October 8 in Prague, Czechia. Unsurprisingly, the discussion
there was dominated by large language models (LLMs) and their effect on the
development community, but some time was also found to talk about security
bugs and long-term succession planning.

Post Syndicated from corbet original https://lwn.net/Articles/1099798/

The 7.3-rc7 kernel prepatch is out for
testing. According to Linus: “As always, I would have preferred to see a smaller
rc, but it’s not like anything in here looks like a reason to delay
the final release. So that’s still set for next weekend unless
something new comes up.”

One notable change that slipped into the mainline this week is the deprecation
of the ext4 data=journal mode; it will be removed entirely at the
beginning of 2028.

Post Syndicated from corbet original https://lwn.net/Articles/1099764/

The 7.2.10 and 6.18.56 stable kernels have been released.
Each contains another several hundred important fixes.

Post Syndicated from corbet original https://lwn.net/Articles/1098670/

While many developers are struggling to keep up with the flood of
vulnerability reports, others are still focused on preventing those reports
from happening in the first place. Control-flow integrity (CFI) is the
term for preventing (or at least detecting) exploits that divert the flow
of control from its intended paths. At the 2026 GNU Tools Cauldron, Kees Cook
presented his changes to the GCC compiler suite to support forward-edge CFI
for the kernel.

Post Syndicated from corbet original https://lwn.net/Articles/1098399/

The kernel’s swap layer has undergone some
significant changes over the course of the last year and a number of
longstanding problems have been addressed. One problem that has not
yet been solved in the mainline is the direct tie between slots in the swap
cache and space in persistent swap files, which can cause highly
inefficient resource use. There are two competing solutions for this
problem, neither of which has, as yet, reached readiness for merging; a
lengthy discussion on possible paths forward shows ongoing disagreement
over the best path forward.

Post Syndicated from corbet original https://lwn.net/Articles/1097859/

Inside this week’s LWN.net Weekly Edition:

• Front: Kernel bugs; Gentoo’s Chromium package; Rust smart pointers; Sashiko; Charon; LAVD scheduler; Python random-number modules.
• Briefs: OpenSSH 10.6; RustConf recordings; Rust 1.99.0; Picard 3.0; Zig 0.17; Quotes; …
• Announcements: Newsletters, conferences, security updates, patches, and more.

Post Syndicated from corbet original https://lwn.net/Articles/1097209/

The extensible scheduler class, which
enables the creation of custom CPU schedulers with BPF, has led to a burst
of innovation in this area; the
LAVD scheduler has, perhaps, been one of the most noteworthy schedulers
to emerge. Though it was originally designed
for gaming applications, the LAVD scheduler has since grown to serve
other types of workloads as well. At the 2026 edition of Kernel Recipes, Changwoo Min
and Gavin Guo presented an overview of this scheduler and how it has
evolved over time.

Post Syndicated from corbet original https://lwn.net/Articles/1096963/

Patch review has long been one of the limiting constraints for the kernel
project (and most others); there just aren’t enough people to properly
review all of the code that is submitted for inclusion. The Sashiko
system, which uses a large language model (LLM) to generate reviews
automatically, offers the prospect of some relief, and has already become
an important part of the kernel’s development process. At the 2026 edition
of Kernel Recipes, Roman
Gushchin, the maintainer of Sashiko, provided an overview of how
the system works and what is being done to improve it.