Post Syndicated from corbet original https://lwn.net/Articles/1074449/

Curl maintainer Daniel Stenberg writes about
the stress of keeping up with the current flood of security reports.

This is a never-before seen or experienced pressure on the curl
project and its security team members. An avalanche of high
priority work that trumps all other things in the project that is
primarily mental because we certainly could ignore them all if we
wanted, but we feel a responsibility, we have a conscience and we
are proud about our work. We feel obliged to fix security problems
in the software we have helped shipped to every device on the
globe. This is personal to us.

With about half the release cycle left until the pending release
ships, we already have twelve confirmed vulnerabilities
meaning twelve pending CVE announcements. That’s a new project
record and it also means we will reach thirty published CVEs
in 2026 even before half the calendar year has passed. The
projected total amount of curl CVEs published through the whole
year is therefore at least double this number!

Post Syndicated from corbet original https://lwn.net/Articles/1073407/

Huge pages can improve performance by increasing translation lookaside
buffer (TLB) utilization and reducing memory-management overhead.
Transparent huge pages (THPs) are supposed to make huge-page usage,
well, transparent, Nico Pache said at the beginning of his session in the
memory-management track of the 2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit. That transparency has
never worked as well as many would like; he has been working on
improvements to make it easier for applications to use huge pages on Linux
systems. A following session, led by David Hildenbrand, was focused on how
THPs could be taken away from processes that are not using them fully.

Post Syndicated from corbet original https://lwn.net/Articles/1073400/

Joshua Hahn began his session in the memory-management track of the 2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit by saying that the memory
controller for control groups is intended to provide resource allocation,
accounting, and protection from interference by other tasks. But
it was not really designed for tiered-memory systems; he is looking for a
way to improve that situation.

Post Syndicated from corbet original https://lwn.net/Articles/1074172/

The 7.1-rc5 kernel prepatch is out for
testing. Quoth Linus:

I’m not entirely happy about it – most of this is totally trivial
stuff to random drivers, which obviously makes it all less scary,
but at the same time I’m really not convinced the churn is worth it
at rc5 time. These things are “fixes”, sure, but at the same time a
lot of them are simply so irrelevant that I think they’d be better
off in a linux-next tree and get merged during the merge window.

So I think I’ll start being a bit more hardnosed about this kind of
unnecessary churn this late in the game. We are supposed to look
for *regressions*. Non-critical fixes to long-standing issues are
simply not appropriate for this late in the release cycle.

End result: this is too big, and this is the heads-up that I’ll be
pushing back on pointless pull requests with fixes that just aren’t
that important. And yes, several of these series were triggered by
AI code review.

Post Syndicated from corbet original https://lwn.net/Articles/1074117/

The 7.0.10,
6.18.33,
6.12.91,
6.6.141,
6.1.174,
5.15.208, and
5.10.257
stable kernel updates have all been released. The first four are huge
(the 7.0.10
review version had 1,146 commits) while 6.1.174, 5.15.208, and 5.10.257
are small updates for the “Fragnesia” vulnerability.

Post Syndicated from corbet original https://lwn.net/Articles/1073103/

The kernel’s page cache is charged with maintaining pages (or, more
correctly, folios) containing copies of
data from files in the filesystem; its performance has a big effect on the
performance of the system as a whole. One of the key decisions the kernel
must make is when to evict folios from the page cache. At the 2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit, Tal Zussman ran a
memory-management-track session on how the page cache could be better
customized for specific workloads. It will not be much of a spoiler to say
that it involves BPF.

Post Syndicated from corbet original https://lwn.net/Articles/1073071/

A major page fault occurs when a process attempts to access a page that is
not currently present in RAM; satisfying such faults usually involves I/O, and can thus take some time. When many threads
sharing an address space are generating page faults, the result can be
significant lock contention while that I/O
takes place. During the memory-management track at the 2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit, Barry Song led a session
to try, yet again, to find an enduring solution to this problem.

Post Syndicated from corbet original https://lwn.net/Articles/1074040/

Security updates have been issued by AlmaLinux (firefox), Debian (chromium, nss, openvpn, and thunderbird), Fedora (cockpit, kernel, and linux-firmware), Oracle (gdk-pixbuf2, kernel, and libsndfile), SUSE (container-suseconnect, cpp-httplib, dnsmasq, firefox, glibc, GraphicsMagick, java-1_8_0-openj9, kernel, mozjs115, php8, python-urllib3, rekor, rootlesskit, rsync, tiff, ucode-intel, util-linux, and xz), and Ubuntu (bind9, bubblewrap, libarchive, linux-intel-iot-realtime, postgresql-14, postgresql-16, postgresql-17, postgresql-18, and xdg-desktop-portal).

Post Syndicated from corbet original https://lwn.net/Articles/1073944/

Michael Catanzaro has disclosed a
command-injection vulnerability affecting a number of GTK-based PDF
readers; exploits included:

They contain a script for building malicious polyglot PDFs that are
simultaneously both valid PDF files and also valid ELF
binaries. When the user opens the PDF in the PDF viewer and clicks
on a malicious link embedded in the PDF, the PDF abuses the command
injection vulnerability to load itself as a GTK module using the
`–gtk-module` command line flag. It can then execute arbitrary
code via its library constructor. That flag was removed in GTK 4,
which is why the vulnerability is much less serious for Papers than
it is for Evince, Atril, and Xreader.

Post Syndicated from corbet original https://lwn.net/Articles/1073933/

The OpenBSD 7.9 release is
out, right on schedule. There is the usual long list of new features,
including improved architecture support, CPU scheduling on heterogeneous
systems, the ability to hibernate a suspended system after a configurable
delay, socket splicing, a
__pledge_open()
system call giving special access to the C library, and much more. See the
announcement and the full
changelog for details.

Post Syndicated from corbet original https://lwn.net/Articles/1072881/

Gregory Price started his session in the memory-management track of the
2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit by saying that, in
current kernels, if a NUMA node has memory, the assumption is that anybody can
make use of it. He is trying to implement the opposite policy — to make
some memory off-limits for all processes except those designed specifically
to use it. The session was used to present his goals and to discuss how
they might be implemented.

Post Syndicated from corbet original https://lwn.net/Articles/1073860/

Security updates have been issued by AlmaLinux (kernel, kernel-rt, and libsndfile), Debian (bind9, evince, firefox-esr, openjpeg2, pdns, and rsync), Fedora (erlang-cowlib, evince, expat, firefox, kernel, mingw-expat, mysql8.0, mysql8.4, nss, opencryptoki, pgadmin4, proftpd, python-django5, python-django6, python-dotenv, rsync, rust-nu, rustup, and strongswan), Oracle (nginx, nginx:1.24, ruby, ruby:3.3, and squid), Slackware (bind and rsync), SUSE (buildah, distribution, distribution-registry, docker, firefox-esr, helm, libpainter0, libsdb2_4_2, postgresql-jdbc, runc, and vim), and Ubuntu (gnutls28, gst-plugins-good1.0, jq, linux-nvidia, linux-nvidia-lowlatency, openvpn, rsync, and unbound).

Post Syndicated from corbet original https://lwn.net/Articles/1072730/

Inside this week’s LWN.net Weekly Edition:

• Front: OpenSUSE site age restrictions; Lots of LSFMM+BPF coverage; The tenth OpenPGP email summit.
• Briefs: Firefox 151.0; pgBackRest funding; RIP Peter G. Neumann; Quotes; …
• Announcements: Newsletters, conferences, security updates, patches, and more.

Post Syndicated from corbet original https://lwn.net/Articles/1072866/

“Reclaim” is the task of finding memory that can be taken away from its
current user and put to better uses within the system; it is a core part of
the memory-management picture. The addition of the multi-generational LRU (MGLRU) was meant to
provide a better reclaim implementation than the “traditional LRU” that
preceded it, but MGLRU has complicated the situation instead. No fewer than
three memory-management-track sessions at the 2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit were focused on MGLRU,
with an eye toward integrating it more fully, improving its performance,
and addressing some problems encountered with Android systems.

Post Syndicated from corbet original https://lwn.net/Articles/1073713/

Security updates have been issued by AlmaLinux (kernel, libpng, nginx, nginx:1.24, ruby, and ruby:3.3), Debian (gnutls28 and linux-6.1), Fedora (dnsmasq, kernel, keylime-agent-rust, perl-Net-CIDR-Lite, python-pysam, python-urllib3, rust-cargo-vendor-filterer, rust-ingredients, rust-oo7-cli, rust-rpki, rust-sevctl, and rust-tealdeer), Mageia (bind), Oracle (bind, giflib, gimp:2.8, kernel, libpng, rsync, ruby, and vim), Slackware (haveged and mozilla), SUSE (cockpit, dnsmasq, erlang26, freeipmi, git-bug, glibc, GraphicsMagick, haveged, ImageMagick, iproute2, kernel, openssh, perl-CryptX, perl-HTTP-Tiny, postgresql14, postgresql15, postgresql16, python-Pillow, rsync, tiff, and traefik), and Ubuntu (Highlight.js, linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-fips, linux-gcp,
linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm,
linux-ibm-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm,
linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-oracle,
linux-raspi, linux-realtime, linux, linux-aws, linux-aws-fips, linux-bluefield, linux-fips, linux-gcp,
linux-gcp-5.4, linux-gcp-fips, linux-ibm, linux-ibm-5.4, linux-kvm,
linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-fips, linux-fips, linux-gcp-4.15,
linux-gcp-fips, linux-kvm, linux-oracle, linux, linux-aws, linux-aws-fips, linux-gcp, linux-gcp-fips, linux-gke,
linux-gkeop, linux-ibm, linux-ibm-6.8, linux-lowlatency,
linux-lowlatency-hwe-6.8, linux-raspi, linux-raspi-realtime,
linux-realtime, linux-realtime-6.8, linux, linux-aws, linux-hwe-6.17, linux-oem-6.17, linux-oracle,
linux-raspi, linux-realtime, linux-realtime-6.17, and smarty3).

Post Syndicated from corbet original https://lwn.net/Articles/1073579/

Version
151.0 of the Firefox browser has been released. Significant changes
include the ability to clear and restart a private-browsing session, better
fingerprinting protection, control over the apparent location when using the
Firefox VPN, and more.

Post Syndicated from corbet original https://lwn.net/Articles/1073395/

The kernel’s this_cpu
operations are meant to speed access to per-CPU variables. They are
more optimal on some CPUs than others, though. During a
memory-management-track session at the 2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit, Yang Shi proposed a
fundamental, and somewhat controversial, change to how these operations
work in order to provide better performance on a wider range of architectures.

Post Syndicated from corbet original https://lwn.net/Articles/1072858/

Compute
Express Link (CXL) is a technology intended to enable the provision of
“memory nodes” in data centers that provide (possibly shared) memory to
nearby CPUs. It has, Dan Williams said at the beginning of his
memory-management-track session on the topic at the 2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit, “been making
memory-management problems worse since 2021“. He used the session to
provide an overview of the ways in which CXL can be expected to extend that
record into the future.

Post Syndicated from corbet original https://lwn.net/Articles/1072840/

There are many places in the kernel where performance can be improved by
using per-CPU data. But, as it turns out, the kernel’s allocator for
per-CPU data has some performance problems of its own. Harry Yoo led a
session in the memory-management track of the 2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit to explore ways to
address those problems and accelerate the allocation and initialization of
per-CPU data.

Post Syndicated from corbet original https://lwn.net/Articles/1073542/

Security updates have been issued by AlmaLinux (libpng and nginx), Debian (erlang, netatalk, and nginx), Fedora (mod_md and SDL2_image), Mageia (perl-libwww-perl, perl-HTTP-Message, perl-WWW-Mechanize-Cached, perl-File-XDG, perl-Path-Tiny, perl-YAML-Syck, postgresql15, and rclone), SUSE (agama, alloy, cacti, cloud-init, dnsmasq, emacs, firefox, glibc, go1.25, go1.26, google-cloud-sap-agent, google-guest-agent, ibus-rime, librime, imagemagick, kernel, libsndfile, nginx, ongres-scram, ongres-stringprep, plexus-testing,, openexr, openssh, PackageKit, perl-Text-CSV_XS, php-composer2, php8, postgresql16, postgresql18, python-lxml, python-python-multipart, python3, python311-urllib3, rmt-server, rsync, tiff, tree-sitter, util-linux, and xen), and Ubuntu (linux, linux-aws, linux-aws-5.4, linux-aws-fips, linux-azure, linux-azure-5.4, linux-azure-fips, linux-bluefield, linux-fips, linux-gcp, linux-gcp-5.4, linux-gcp-fips, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-raspi, and linux-xilinx-zynqmp).