Post Syndicated from corbet original https://lwn.net/Articles/1074117/
The 7.0.10,
6.18.33,
6.12.91,
6.6.141,
6.1.174,
5.15.208, and
5.10.257
stable kernel updates have all been released. The first four are huge
(the 7.0.10
review version had 1,146 commits) while 6.1.174, 5.15.208, and 5.10.257
are small updates for the “Fragnesia” vulnerability.
Post Syndicated from corbet original https://lwn.net/Articles/1073103/
The kernel’s page cache is charged with maintaining pages (or, more
correctly, folios) containing copies of
data from files in the filesystem; its performance has a big effect on the
performance of the system as a whole. One of the key decisions the kernel
must make is when to evict folios from the page cache. At the 2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit, Tal Zussman ran a
memory-management-track session on how the page cache could be better
customized for specific workloads. It will not be much of a spoiler to say
that it involves BPF.
Post Syndicated from corbet original https://lwn.net/Articles/1073071/
A major page fault occurs when a process attempts to access a page that is
not currently present in RAM; satisfying such faults usually involves I/O, and can thus take some time. When many threads
sharing an address space are generating page faults, the result can be
significant lock contention while that I/O
takes place. During the memory-management track at the 2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit, Barry Song led a session
to try, yet again, to find an enduring solution to this problem.
Post Syndicated from corbet original https://lwn.net/Articles/1074040/
Security updates have been issued by AlmaLinux (firefox), Debian (chromium, nss, openvpn, and thunderbird), Fedora (cockpit, kernel, and linux-firmware), Oracle (gdk-pixbuf2, kernel, and libsndfile), SUSE (container-suseconnect, cpp-httplib, dnsmasq, firefox, glibc, GraphicsMagick, java-1_8_0-openj9, kernel, mozjs115, php8, python-urllib3, rekor, rootlesskit, rsync, tiff, ucode-intel, util-linux, and xz), and Ubuntu (bind9, bubblewrap, libarchive, linux-intel-iot-realtime, postgresql-14, postgresql-16, postgresql-17, postgresql-18, and xdg-desktop-portal).
Post Syndicated from corbet original https://lwn.net/Articles/1073944/
Michael Catanzaro has disclosed a
command-injection vulnerability affecting a number of GTK-based PDF
readers; exploits included:
They contain a script for building malicious polyglot PDFs that are
simultaneously both valid PDF files and also valid ELF
binaries. When the user opens the PDF in the PDF viewer and clicks
on a malicious link embedded in the PDF, the PDF abuses the command
injection vulnerability to load itself as a GTK module using the
`–gtk-module` command line flag. It can then execute arbitrary
code via its library constructor. That flag was removed in GTK 4,
which is why the vulnerability is much less serious for Papers than
it is for Evince, Atril, and Xreader.
Post Syndicated from corbet original https://lwn.net/Articles/1073933/
The OpenBSD 7.9 release is
out, right on schedule. There is the usual long list of new features,
including improved architecture support, CPU scheduling on heterogeneous
systems, the ability to hibernate a suspended system after a configurable
delay, socket splicing, a
__pledge_open()
system call giving special access to the C library, and much more. See the
announcement and the full
changelog for details.
Post Syndicated from corbet original https://lwn.net/Articles/1072881/
Gregory Price started his session in the memory-management track of the
2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit by saying that, in
current kernels, if a NUMA node has memory, the assumption is that anybody can
make use of it. He is trying to implement the opposite policy — to make
some memory off-limits for all processes except those designed specifically
to use it. The session was used to present his goals and to discuss how
they might be implemented.
Post Syndicated from corbet original https://lwn.net/Articles/1073860/
Security updates have been issued by AlmaLinux (kernel, kernel-rt, and libsndfile), Debian (bind9, evince, firefox-esr, openjpeg2, pdns, and rsync), Fedora (erlang-cowlib, evince, expat, firefox, kernel, mingw-expat, mysql8.0, mysql8.4, nss, opencryptoki, pgadmin4, proftpd, python-django5, python-django6, python-dotenv, rsync, rust-nu, rustup, and strongswan), Oracle (nginx, nginx:1.24, ruby, ruby:3.3, and squid), Slackware (bind and rsync), SUSE (buildah, distribution, distribution-registry, docker, firefox-esr, helm, libpainter0, libsdb2_4_2, postgresql-jdbc, runc, and vim), and Ubuntu (gnutls28, gst-plugins-good1.0, jq, linux-nvidia, linux-nvidia-lowlatency, openvpn, rsync, and unbound).
Post Syndicated from corbet original https://lwn.net/Articles/1072730/
Inside this week’s LWN.net Weekly Edition:
Post Syndicated from corbet original https://lwn.net/Articles/1072866/
“Reclaim” is the task of finding memory that can be taken away from its
current user and put to better uses within the system; it is a core part of
the memory-management picture. The addition of the multi-generational LRU (MGLRU) was meant to
provide a better reclaim implementation than the “traditional LRU” that
preceded it, but MGLRU has complicated the situation instead. No fewer than
three memory-management-track sessions at the 2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit were focused on MGLRU,
with an eye toward integrating it more fully, improving its performance,
and addressing some problems encountered with Android systems.
Post Syndicated from corbet original https://lwn.net/Articles/1073713/
Security updates have been issued by AlmaLinux (kernel, libpng, nginx, nginx:1.24, ruby, and ruby:3.3), Debian (gnutls28 and linux-6.1), Fedora (dnsmasq, kernel, keylime-agent-rust, perl-Net-CIDR-Lite, python-pysam, python-urllib3, rust-cargo-vendor-filterer, rust-ingredients, rust-oo7-cli, rust-rpki, rust-sevctl, and rust-tealdeer), Mageia (bind), Oracle (bind, giflib, gimp:2.8, kernel, libpng, rsync, ruby, and vim), Slackware (haveged and mozilla), SUSE (cockpit, dnsmasq, erlang26, freeipmi, git-bug, glibc, GraphicsMagick, haveged, ImageMagick, iproute2, kernel, openssh, perl-CryptX, perl-HTTP-Tiny, postgresql14, postgresql15, postgresql16, python-Pillow, rsync, tiff, and traefik), and Ubuntu (Highlight.js, linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-fips, linux-gcp,
linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm,
linux-ibm-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm,
linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-oracle,
linux-raspi, linux-realtime, linux, linux-aws, linux-aws-fips, linux-bluefield, linux-fips, linux-gcp,
linux-gcp-5.4, linux-gcp-fips, linux-ibm, linux-ibm-5.4, linux-kvm,
linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-fips, linux-fips, linux-gcp-4.15,
linux-gcp-fips, linux-kvm, linux-oracle, linux, linux-aws, linux-aws-fips, linux-gcp, linux-gcp-fips, linux-gke,
linux-gkeop, linux-ibm, linux-ibm-6.8, linux-lowlatency,
linux-lowlatency-hwe-6.8, linux-raspi, linux-raspi-realtime,
linux-realtime, linux-realtime-6.8, linux, linux-aws, linux-hwe-6.17, linux-oem-6.17, linux-oracle,
linux-raspi, linux-realtime, linux-realtime-6.17, and smarty3).
Post Syndicated from corbet original https://lwn.net/Articles/1073579/
Version
151.0 of the Firefox browser has been released. Significant changes
include the ability to clear and restart a private-browsing session, better
fingerprinting protection, control over the apparent location when using the
Firefox VPN, and more.
Post Syndicated from corbet original https://lwn.net/Articles/1073395/
The kernel’s this_cpu
operations are meant to speed access to per-CPU variables. They are
more optimal on some CPUs than others, though. During a
memory-management-track session at the 2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit, Yang Shi proposed a
fundamental, and somewhat controversial, change to how these operations
work in order to provide better performance on a wider range of architectures.
Post Syndicated from corbet original https://lwn.net/Articles/1072858/
Compute
Express Link (CXL) is a technology intended to enable the provision of
“memory nodes” in data centers that provide (possibly shared) memory to
nearby CPUs. It has, Dan Williams said at the beginning of his
memory-management-track session on the topic at the 2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit, “been making
“. He used the session to
memory-management problems worse since 2021
provide an overview of the ways in which CXL can be expected to extend that
record into the future.
Post Syndicated from corbet original https://lwn.net/Articles/1072840/
There are many places in the kernel where performance can be improved by
using per-CPU data. But, as it turns out, the kernel’s allocator for
per-CPU data has some performance problems of its own. Harry Yoo led a
session in the memory-management track of the 2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit to explore ways to
address those problems and accelerate the allocation and initialization of
per-CPU data.
Post Syndicated from corbet original https://lwn.net/Articles/1073542/
Security updates have been issued by AlmaLinux (libpng and nginx), Debian (erlang, netatalk, and nginx), Fedora (mod_md and SDL2_image), Mageia (perl-libwww-perl, perl-HTTP-Message, perl-WWW-Mechanize-Cached, perl-File-XDG, perl-Path-Tiny, perl-YAML-Syck, postgresql15, and rclone), SUSE (agama, alloy, cacti, cloud-init, dnsmasq, emacs, firefox, glibc, go1.25, go1.26, google-cloud-sap-agent, google-guest-agent, ibus-rime, librime, imagemagick, kernel, libsndfile, nginx, ongres-scram, ongres-stringprep, plexus-testing,, openexr, openssh, PackageKit, perl-Text-CSV_XS, php-composer2, php8, postgresql16, postgresql18, python-lxml, python-python-multipart, python3, python311-urllib3, rmt-server, rsync, tiff, tree-sitter, util-linux, and xen), and Ubuntu (linux, linux-aws, linux-aws-5.4, linux-aws-fips, linux-azure, linux-azure-5.4, linux-azure-fips, linux-bluefield, linux-fips, linux-gcp, linux-gcp-5.4, linux-gcp-fips, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-raspi, and linux-xilinx-zynqmp).
Post Syndicated from corbet original https://lwn.net/Articles/1072657/
The kernel’s swap subsystem is charged with managing anonymous pages in
secondary storage when those pages are (hopefully) not being used and the
memory they occupy is needed elsewhere. This long-unloved subsystem has
seen a resurgence of developer interest in recent times, so it is not
surprising that it was the topic of three separate sessions in the
memory-management track at the
2026 Linux Storage,
Filesystem, Memory Management, and BPF Summit. Two of those sessions
were concerned with improving the performance and maintainability of the
swap code, while one (shared with the storage track) was about how swapping
could be friendlier to solid-state storage devices.
Post Syndicated from corbet original https://lwn.net/Articles/1073356/
Security updates have been issued by AlmaLinux (freerdp, gimp:2.8, jq, kernel, and rsync), Debian (chromium, ffmpeg, firewalld, kernel, nginx, openjpeg2, openssh, php7.4, and redis), Fedora (apptainer, chromium, coturn, dnsmasq, firefox, kernel, libgit2_1.8, libmetal, nginx, nginx-mod-brotli, nginx-mod-fancyindex, nginx-mod-headers-more, nginx-mod-js-challenge, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts, open-amp, perl-Net-CIDR-Lite, pgbouncer, pypy, python-jupytext, python-uv-build, rsync, rust-astral-tokio-tar, uriparser, uv, valkey, and yelp), Mageia (dpkg, firefox, thunderbird, golang, haproxy, and samba), Slackware (dnsmasq and kernel), and SUSE (apache-commons-configuration2, apache2, apptainer, chromedriver, cups-filters, curl, dnsmasq, expat, ffmpeg-4, ffmpeg-7, firebird, firewalld, flux2-cli, glibc, go1.25, go1.26, gosec, grub2, ImageMagick, java-11-openj9, java-17-openj9, java-1_8_0-openj9, java-1_8_0-openjdk, java-21-openj9, java-25-openj9, kdenlive, kernel, kernel-devel, keylime-config, krb5, libIex-3_4-33, mozjs115, mozjs78, nginx, openssh, openvswitch, ovmf, PackageKit, perl-Crypt-URandom, perl-CryptX, perl-libwww-perl, perl-Net-CIDR-Lite, perl-Text-CSV_XS, podman, postgresql17, postgresql18, python-pyOpenSSL, python310, rsync, sed, tekton-cli, valkey, xen, and zypper-docker).
Post Syndicated from corbet original https://lwn.net/Articles/1073193/
The 7.1-rc4 kernel prepatch is out for
testing.
Some of the documentation updates might be worth highlighting: the
continued flood of AI reports has basically made the security list
almost entirely unmanageable, with enormous duplication due to
different people finding the same things with the same
tools. People spend all their time just forwarding things to the
right people or saying “that was already fixed a week/month ago”
and pointing to the public discussion.Which is all entirely pointless churn, and we’re making it clear
that AI detected bugs are pretty much by definition not secret, and
treating them on some private list is a waste of time for everybody
involved – and only makes that duplication worse because the
reporters can’t even see each other’s reports.
(He is referring to this
pull request with patches from Willy Tarreau defining what constitutes a security
bug and responsible
ways to use AI to find bugs).
Post Syndicated from corbet original https://lwn.net/Articles/1073186/
We have received
word that Peter G. Neumann, who, among many other things, ran the RISKS Digest for decades, has
passed away. He will be much missed.