Post Syndicated from daroc original https://lwn.net/Articles/1011263/

Greg Kroah-Hartman has released another four stable kernels:
6.13.4,
6.12.16,
6.6.79, and
6.1.129. As usual, all users are advised to upgrade.

Post Syndicated from daroc original https://lwn.net/Articles/1011262/

Security updates have been issued by AlmaLinux (bind, bind9.16, and mysql:8.0), Debian (chromium, djoser, libtasn1-6, and postgresql-13), Fedora (python3.12 and vim), Red Hat (libpq, postgresql, postgresql:13, postgresql:15, and postgresql:16), Slackware (ark), SUSE (brise, chromium, emacs, google-osconfig-agent, grafana, grub2, helm, kernel, openssh, openssl-1_1, ovmf, postgresql13, postgresql14, postgresql15, and postgresql17), and Ubuntu (gnutls28, libtasn1-6, openssl, python3.10, python3.12, python3.8, and webkit2gtk).

Post Syndicated from daroc original https://lwn.net/Articles/1009509/

Steven Rostedt recently posted

a patch set that could help improve the performance of certain user-space
applications by giving the scheduler more context about when they are safe to
interrupt. The patch set lets programs request a small grace window
before they can be interrupted so that they can relinquish any locks, decreasing the
amount of time that other threads have to spend waiting. Rostedt shared
performance numbers suggesting that the patch might cut the amount of time spent
acquiring locks in half for some programs — although, since his test was
specifically tuned for this case, real-world projects should expect a somewhat
less dramatic improvement. The change received some pushback from scheduler
maintainer Peter Zijlstra, who objected to the patch set’s approach.

Post Syndicated from daroc original https://lwn.net/Articles/1008714/

Kernel developers have been working to convert various internal interfaces to
use

folios; while this process has been progressing, there is still the
occasional regression introduced by the change. In December 2024, it was
discovered that installing a

Flatpak application could trigger a filesystem bug in
the kernel that would cause the software to read incorrect data from the disk.
The problem was quickly fixed — only for an another problem caused by the folio
rewrite to pop up in the same kernel subsystem. This was discovered by an Arch
Linux user, who noticed that selecting files in a Flatpak application was
causing kernel crashes. Now both bugs are fixed, but there may be more bugs to find.

Post Syndicated from daroc original https://lwn.net/Articles/1010352/

Greg Kroah-Hartman has released three more stable kernels:
6.13.3,
6.12.14, and
6.6.78.
There was a bit of confusion that resulted in the patch for
CVE 2025-21687
getting applied twice — but that doesn’t result in any problems for users of the
kernel, just a bit of extra noise in the CVE database, so Kroah-Hartman has
decided to leave the releases as-is instead of rushing another point release.

Post Syndicated from daroc original https://lwn.net/Articles/1010328/

Security updates have been issued by AlmaLinux (container-tools:rhel8, gcc, libxml2, nodejs:18, and nodejs:20), Debian (freerdp2, golang-glog, trafficserver, and tryton-client), Fedora (chromium, krb5, libheif, microcode_ctl, nginx, nginx-mod-fancyindex, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts, and webkitgtk), Mageia (ffmpeg, golang, postgresql13 and postgresql15, and python-zipp), Oracle (container-tools:ol8, gcc, gcc-toolset-13-gcc, gcc-toolset-14-gcc, kernel, libxml2, and nodejs:20), Red Hat (gcc, idm:DL1, and ipa), SUSE (buildah, chromium, glibc, kernel, kernel-firmware-all-20250206, libecpg6, postgresql15, python, python3, python311, and ruby3.4-rubygem-rack), and Ubuntu (intel-microcode).

Post Syndicated from daroc original https://lwn.net/Articles/1009765/

Security updates have been issued by AlmaLinux (doxygen, gcc-toolset-13-gcc, gcc-toolset-14-gcc, kernel, and libxml2), Debian (chromium, postgresql-13, and webkit2gtk), Fedora (krb5, openssl, and python3.13), Mageia (ark, ofono, and perl-Net-OAuth, perl-Crypt-URandom, perl-Module-Build), Oracle (firefox, gcc, gcc-toolset-14-gcc, kernel, openssl, tbb, and thunderbird), Red Hat (libxml2), SUSE (chromium, golang-github-prometheus-prometheus, grafana, kernel, kernel-firmware-ath10k-20250206, kernel-firmware-bnx2-20250206, kernel-firmware-brcm-20250206, kernel-firmware-chelsio-20250206, kernel-firmware-dpaa2-20250206, kernel-firmware-mwifiex-20250206, kernel-firmware-platform-20250206, kernel-firmware-realtek-20250206, kernel-firmware-serial-20250206, kernel-firmware-ueagle-20250206, libtasn1, python312, qemu, SUSE Manager Client Tools, SUSE Manager Client Tools MU 5.0.3, and ucode-intel-20250211), and Ubuntu (activemq and libsndfile).

Post Syndicated from daroc original https://lwn.net/Articles/1007921/

Miguel Ojeda gave

a keynote at

FOSDEM 2025 about the history of the

Rust-for-Linux
project, and the current attitude of people in the kernel community toward the
experiment. Unlike his

usual talks, this talk didn’t focus so much on the current
state of the project, but rather on discussing history
and predictions for the future. He ended up presenting quotes from more than 30
people involved in kernel development about what they thought of the project and
expected going forward.

Post Syndicated from daroc original https://lwn.net/Articles/1008502/

Security updates have been issued by Debian (openjdk-17), Fedora (firefox, FlightGear, java-1.8.0-openjdk, java-11-openjdk, java-latest-openjdk, and SimGear), Mageia (gstreamer), Red Hat (firefox, kernel, kernel-rt, libsoup, and python-jinja2), SUSE (bind, curl, dcmtk, etcd, firefox, google-osconfig-agent, krb5, openssl-1_1, podman, python311-cbor2, thunderbird, wget, and xrdp), and Ubuntu (glibc).

Post Syndicated from daroc original https://lwn.net/Articles/1007689/

Jake Hillion gave

a presentation at

FOSDEM about using

sched_ext, the BPF
scheduling framework that was introduced in kernel version 6.12, to help find
elusive concurrency problems. In collaboration with Johannes Bechberger, he has
built a scheduler that can reveal theoretically possible but unobserved
concurrency bugs in test code in a few minutes. Since their scheduler only
relies on mainline kernel features, it can theoretically be applied to any
application that runs on Linux — although there are a number of caveats since
the project is still in its early days.

Post Syndicated from daroc original https://lwn.net/Articles/1006375/

Jeff Xu has been working on

a patch set that makes certain mappings in a process’s address space
impossible to change, sealing them against tampering. This has some potential
security benefits — mainly, making
sure that someone cannot relocate the
vsyscall and
vDSO mappings — but some kernel developers haven’t
been impressed with the patches.
While the core functionality (sealing the mappings) is sound, some of the
supporting code for enabling and disabling the new feature caused concern by
going against the normal design for such things. Reviewers also questioned
how this feature would interact with checkpointing and with sandboxing.

Post Syndicated from daroc original https://lwn.net/Articles/1007252/

Security updates have been issued by AlmaLinux (libsoup), Debian (debian-security-support and redis), Fedora (expat, java-21-openjdk, lemonldap-ng, and phpMyAdmin), Mageia (chromium-browser-stable and git-lfs), Oracle (bzip2, git-lfs, libsoup, mariadb:10.11, mariadb:10.5, python-jinja2, redis, and unbound), Red Hat (git-lfs, libsoup, python-jinja2, rsync, and unbound), SUSE (buildah, chromium, google-osconfig-agent, govulncheck-vulndb, hauler, ignition, krb5, libxml2, python311-pydantic, SDL2_sound, and trivy), and Ubuntu (jquery, linux-azure, linux-azure-4.15, linux-azure-5.15, linux-hwe-5.4, linux-oracle, and mysql-8.0).

Post Syndicated from daroc original https://lwn.net/Articles/1006691/

Security researcher RyotaK

has shared a series of vulnerabilities that all have to do with how Git
interfaces with external
credential managers. In short, while Git guards against newline characters
(\n) being injected into a repository’s URL, some programming languages
also treat carriage return characters (\r) as being newlines. Adding a
carriage return to a repository’s URL can cause Git and the credential manager
to disagree on how the URL should be parsed, ultimately resulting in Git
credentials being sent to the wrong host. Malicious repositories could include
Git submodules with malformed URLs, triggering the bug. Only password-based authentication
with an external credential manager is
vulnerable to this attack; SSH-based authentication remains secure. The Git project
has chosen to consider this a vulnerability in Git, given the large amount of
external software affected. The project has fixed the bug on its end by

releasing updates for all supported versions that ban
carriage returns in URLs entirely.

Affected software includes GitHub Desktop, Git LFS, and possibly other Git utilities:

Since Git itself doesn’t use .lfsconfig file, specifying the URL that contains
the newline character in .lfsconfig causes Git LFS to insert the newline character
into the message, while bypassing […] Git’s validation.

Post Syndicated from daroc original https://lwn.net/Articles/1005639/

Earthstar is a privacy-oriented,
offline-first, LGPL-licensed database intended to support distributed
applications. Unlike other distributed storage libraries, it
focuses on providing mutable data with human-meaningful names and modification
times, which gives it an interface similar to many non-distributed
key-value databases.
Now, the developers are looking at switching to a new synchronization
protocol — one that is general enough that it might see wider adoption.

Post Syndicated from daroc original https://lwn.net/Articles/1002456/

Last year, LWN examined the changes lined up for
Rust’s 2024 edition. Now, with the edition

ready to be stabilized in February,
it’s time to look back at the edition process and see what was
successfully adopted, which new changes were added, and what still remains to
work on. A surprising amount of new work was proposed, implemented, and
stabilized during the year.

Post Syndicated from daroc original https://lwn.net/Articles/1006103/

Security updates have been issued by Debian (chromium and python-django), Fedora (git-lfs and pam-u2f), Mageia (golang), Red Hat (java-11-openjdk with Extended Lifecycle Support, java-17-openjdk, and java-21-openjdk), SUSE (cheat, dante, docker-stable, grafana, and kernel), and Ubuntu (cacti, cyrus-imapd, HTMLDOC, and PCL).

Post Syndicated from daroc original https://lwn.net/Articles/1005302/

On January 14, Nick Tait

announced the discovery of six vulnerabilities in

rsync, the popular file-synchronization tool. While software vulnerabilities are
not uncommon, the

most serious one he announced allows for remote code execution
on servers that run rsyncd — and possibly other configurations.
The bug itself is fairly simple, but this event provides a nice opportunity to
dig into it, show why it is so serious, and consider ways
the open-source community can prevent such mistakes in the
future.

Post Syndicated from daroc original https://lwn.net/Articles/1004893/

The idea of adding None-aware operators to Python has sprung up once
again. These would make traversing structures with None values in them
easier, by short-circuiting lookups when a None is encountered. Almost
exactly a year ago, LWN covered the previous attempt to bring
the operators to Python, but there have been periodic discussions stretching back to
2015 and possibly before. This time Noah Kim has taken up the cause. After some debate, he
eventually settled on redrafting the existing PEP to have a more limited scope,
which might finally see it move past the cycle of debate, resurrection, and abandonment that
it has been stuck in for most of the last decade.

Post Syndicated from daroc original https://lwn.net/Articles/1005380/

The
6.12.10,
6.6.72, and
6.1.125 stable kernels have been released on
the expected schedule.

Post Syndicated from daroc original https://lwn.net/Articles/1005433/

Security updates have been issued by Debian (rsync and tomcat9), Fedora (chromium, mingw-python-jinja2, redict, and valkey), Gentoo (GIMP and pip), Oracle (.NET, fence-agents, ipa, kernel, python-virtualenv, raptor2, and rsync), Red Hat (.NET 8.0 and .NET 9.0), SUSE (apache2-mod_jk, git, git-lfs, kernel, python-Django, thunderbird, and xen), and Ubuntu (audacity, bcel, dotnet8, dotnet9, gimp-dds, harfbuzz, libxml2, poppler, rsync, and tqdm).