Then Thursday hit with the networking pull. And then on Friday
everybody else decided to send in their work for the week, with a
few more trickling in over the weekend. End result: what had for a
short few days looked like a nice calm week turned into another
“bigger than usual” release candidate.
To be fair, that “almost everything comes in at the end of the
week” is 100% normal, and none of this is surprising. I was
admittedly hoping that things would start to calm down, but that
was not to be.
I no longer really believe that it was the one extra week we had
last release cycle: I’m starting to suspect it’s the psychological
result of “hey, new major number”, and people are just being a bit
more active as a result.
Reddit user “Ok_Lingonberry3296” has posted the
results of an extensive investigation into the companies that are
pushing US state legislatures to enact age-verification bills.
I’ve been pulling public records on the wave of “age verification”
bills moving through US state legislatures. IRS 990 filings, Senate
lobbying disclosures, state ethics databases, campaign finance
records, corporate registries, WHOIS lookups, Wayback Machine
archives. What started as curiosity about who was pushing these
bills turned into documenting a coordinated influence operation
that, from a privacy standpoint, is building surveillance
infrastructure at the operating system level while the company
behind it faces zero new requirements for its own platforms.
(See also this article for a look at the
California law.)
Qualys has sent out a
somewhat breathless advisory describing a number of vulnerabilities in
the AppArmor security module, which is used in a number of Debian-based
distributions (among others).
This “CrackArmor” advisory exposes a confused-deputy flaw allowing
unprivileged users to manipulate security profiles via
pseudo-files, bypass user-namespace restrictions, and execute
arbitrary code within the kernel. These flaws facilitate local
privilege escalation to root through complex interactions with
tools like Sudo and Postfix, alongside denial-of-service attacks
via stack exhaustion and Kernel Address Space Layout Randomization
(KASLR) bypasses via out-of-bounds reads.
One of the first changes merged for the upcoming 7.0 release was nullfs,
an empty filesystem that cannot actually contain any files. One might
logically wonder why the kernel would need such a thing. It turns out,
though, that there are places where a null filesystem can come in handy.
For 7.0, nullfs will be used to make life a bit easier for init
programs; future releases will likely use nullfs to increase the isolation
of kernel threads from the init process.
Linus has released 7.0-rc3 for testing.
“So it’s still pretty early in the release cycle, and it just feels a
bit busier than I’d like. But nothing particularly stands out or looks
bad.“
NTP operates in the clear, and it is often the case that the
servers used by a client are not local. This provides an
opportunity for an adversary to disrupt an NTP session, by
masquerading as a NTP server, or altering NTP payloads in an effort
to disrupt a client’s time-of-day clock. Many application-level
protocols are time sensitive, including TLS, HTTPS, DNSSEC and
NFS. Most Cloud applications rely on a coordinated time to
determine the most recent version of a data object. Disrupting time
can cause significant chaos in distributed network environments.
While it can be relatively straightforward to secure a TCP-based
protocol by adding an initial TLS handshake and operating a TLS
shim between TCP and the application traffic, it’s not so
straightforward to use TLS in place of a UDP-based protocol for
NTP. TLS can add significant jitter to the packet exchange. Where
the privacy of the UDP payload is essential, then DTLS might
conceivably be considered, but in the case of NTP the privacy of
the timestamps is not essential, but the veracity and authenticity
of the server is important.
NTS, a secured version of NTP, is designed to address this
requirement relating to the veracity and authenticity of packets
passed from a NTS server to an NTS client. The protocol adds a NTS
Key Establishment protocol (NTS-KE) in additional to a conventional
NTPv4 UDP packet exchange (RFC 8915).
Version
25.12.0 of the OpenWrt router distribution is available; this release
has been dedicated to the memory of Dave Täht. Changes include a switch to
the apk package manager, the integration of the attended
sysupgrade method, and support for a long list of new targets.
Version
1.94.0 of the Rust language has been released. Changes include array
windows (an iterator for slices), some Cargo enhancements, and a number
of newly stabilized APIs.
The grith.ai blog reports
on an LLM prompt-injection vulnerability that led to 4,000 installations of
a compromised version of the Cline utility.
For the next eight hours, every developer who installed or updated
Cline got OpenClaw – a separate AI agent with full system access –
installed globally on their machine without consent. Approximately
4,000 downloads occurred before the package was pulled.
The interesting part is not the payload. It is how the attacker got
the npm token in the first place: by injecting a prompt into a
GitHub issue title, which an AI triage bot read, interpreted as an
instruction, and executed.
Chardet
is a Python module that attempts to determine which character set was used
to encode a text string. It was originally written by Mark Pilgrim, who is
also the author of a number of Python books; the 1.0 release happened in
2006. For many years, this module has been under the maintainership of
Dan Blanchard. Chardet has always been licensed under the LGPL, but, with
the 7.0.0
release, Blanchard changed the terms to the permissive MIT license.
That has led to an extensive (and ongoing) discussion on when code can be
relicensed against the wishes of its original author, and whether using a
large language model to rewrite code is a legitimate way to strip copyleft
requirements from code.
The multi-generational LRU (MGLRU) is an
alternative memory-management algorithm that was merged for the 6.1 kernel
in late 2022. It brought a promise of much-improved performance and
simplified code. Since then, though, progress on MGLRU has stalled, and it
still is not enabled on many systems. As the 2026 Linux Storage,
Filesystem, Memory-Management and BPF Summit (LSFMM+BPF) approaches,
several memory-management developers have indicated a desire to talk about
the future of MGLRU. While some developers are looking for ways to improve
the subsystem, another has called for it to be removed entirely.
This
404 Media article looks at how the US Customs and Border Protection
agency (CBP) is using location data from phones to track the location of
people of interest.
Specifically, CBP says the data was in part sourced via real-time
bidding, or RTB. Whenever an advertisement is displayed inside an
app, a near instantaneous bidding process happens with companies
vying to have their advert served to a certain demographic. A side
effect of this is that surveillance firms, or rogue advertising
companies working on their behalf, can observe this process and
siphon information about mobile phones, including their
location. All of this is essentially invisible to an ordinary phone
user, but happens constantly.
We should note that the minimal advertising shown on LWN is not delivered
via this bidding system.
Matthew Garrett examines
the factors that go into the decision about whether to install a
firmware update or not.
I trust my CPU vendor. I don’t trust my CPU vendor because I want
to, I trust my CPU vendor because I have no choice. I don’t think
it’s likely that my CPU vendor has designed a CPU that identifies
when I’m generating cryptographic keys and biases the RNG output so
my keys are significantly weaker than they look, but it’s not
literally impossible. I generate keys on it anyway, because what
choice do I have? At some point I will buy a new laptop because
Electron will no longer fit in 32GB of RAM and I will have to make
the same affirmation of trust, because the alternative is that I
just don’t have a computer.
There are many applications that need to be able to write multi-block
chunks of data to disk with the assurance that the operation will either
complete successfully or fail altogether — that the write will not be
partially completed (or “torn”), in other words. For years, kernel
developers have worked on providing atomic writes as a way of satisfying
that need; see, for example, sessions from the Linux Storage, Filesystem,
Memory Management, and BPF (LSFMM+BPF) Summit from 2023, 2024,
and 2025 (twice). While atomic directI/O is now supported by some filesystems, atomic bufferedI/O still is not. Filling
that gap seems certain to be a 2026 LSFMM+BPF topic but, thanks to an early
discussion, the shape of a solution might already be coming into focus.
Since the memory is being copied directly from userspace to the
network device, the userspace application has to keep it around
unmodified, until it has finished sending. The sendmsg()
syscall itself is asynchronous, and will return without waiting for
this. Instead, once the memory buffers are no longer needed by the
stack, the kernel will return a notification to userspace that the
buffers can be reused.
Motorola has announced
that it will be working with the GrapheneOS Foundation, a producer of a
security-enhanced Android distribution. “Together, Motorola and the
GrapheneOS Foundation will work to strengthen smartphone security and
collaborate on future devices engineered with GrapheneOS
compatibility.“. LWN looked at
GrapheneOS last July.
The 7.0-rc2 kernel prepatch is out for
testing. According to Linus:
So I’m not super-happy with how big this is, but I’m hoping it’s
just the random timing noise we see every once in a while where I
just happen to get more pull requests one week, only for the next
week to then be quieter.
Version 1.24.0 of the groff text-formatting system has been released.
Improvements include the ability to insert hyperlinks between man pages, a
new polygon command for the pic preprocessor, various
PDF-output improvements, and more.
The International Image Interoperability
Framework, or IIIF (“triple-eye eff”), is a small set of standards that
form a basis for serving, displaying, and reusing image data on the web. It
consists of a number of API definitions that compose with each other to
achieve a standard for providing, for example, presentations of
high-resolution images at multiple zoom levels, as well as bundling multiple images
together. Presentations may include metadata about details like authorship,
dates, references to other representations of the same work, copyright
information, bibliographic identifiers, etc. Presentations can be further
grouped into collections, and metadata can be added in the form of
transcriptions, annotations, or captions. IIIF is most popular with
cultural-heritage organizations, such as libraries, universities, and
archives.
The stated support periods for the 6.6, 6.12, and 6.18 kernels has been extended.
The 6.6 kernel will be supported with stable updates through the end of
2027 (for four years of support total), while 6.12 and 6.18 will get
updates through the end of 2028, for four and three years of support.
The collective thoughts of the interwebz
Manage Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.