Post Syndicated from daroc original https://lwn.net/Articles/1085896/

Jordan Rife’s work involves writing BPF programs for

Cilium that interface with

Kubernetes
networking. As part of that work, he wants to enable BPF programs with
appropriate permissions to iterate through the sockets of a different network
namespace. He led a session about the idea at the 2026

Linux Storage,
Filesystem, Memory-Management, and BPF Summit where the BPF developers in
attendance were quick to suggest a number of related alternatives.

Post Syndicated from daroc original https://lwn.net/Articles/1087108/

StepSecurity is

reporting the emergence of a new worm affecting npm packages.
The design of the worm is nothing new, but the rapidity with which it is
exploiting captured npm
packager credentials is noteworthy.

TL;DR: A self-propagating worm, which we are calling ChainDrop, is spreading rapidly through the npm ecosystem. So far 435 packages and more than 1,550 compromised versions have been flagged, starting with [email protected]. If you are using any of the packages listed below, assume your environment is compromised. We are still investigating the full scope; check back on this post for updates.

Post Syndicated from daroc original https://lwn.net/Articles/1084869/

Song Liu believes that the way that programmers assemble complex BPF programs
will be changing rapidly in the future.
At a session of the 2026

Linux Storage,
Filesystem, Memory-Management, and BPF Summit, he shared his thoughts on what
that change could look like, though he did not have any concrete proposals for
what, if anything, the BPF maintainers should do. He anticipates an
ecosystem of Rust BPF packages developing, which is significant because BPF
does not really have a package manager at the moment.

Post Syndicated from daroc original https://lwn.net/Articles/1083985/

BPF programs use

BPF type format (BTF) debugging information in order to
determine how to interact with functions in the kernel. Specifically, tracing a
kernel function involves finding its address in the kernel’s BTF section — but
that doesn’t work for functions that have been inlined, and therefore don’t have
a single, specific address. Alan Maguire wants to add information about inlined
functions to BTF in order to allow them to be traced, and led a session on that
topic at the 2026

Linux Storage, Filesystem, Memory-Management, and BPF Summit.

Post Syndicated from daroc original https://lwn.net/Articles/1083202/

The
gccrs project, which is creating a Rust frontend for the GCC compiler, has
spent the first half of 2026 focusing on compiling the Linux
kernel. By testing the compiler against the kernel crates, the
development team has made significant progress toward generating correct code
for other Rust programs. As detailed in the project’s

weekly and

monthly reports, this effort has uncovered and resolved problems
in areas such as
attribute handling (described in the

report for February), name resolution, and resource management (both

detailed in the May report). Currently, the compiler can only handle simple
standalone programs, but that situation could change rapidly in the coming
months.

Post Syndicated from daroc original https://lwn.net/Articles/1083418/

Daniel Borkmann led a session at the 2026

Linux Filesystem, Memory-Management,
and BPF Summit about the progress that has been made with netkit, the subsystem
that allows virtual machines (VMs) running on Linux to perform networking efficiently.
When that did not fill the full time, he went on to discuss his idea for
using BPF to live-patch user-space applications. While netkit is making
progress, and can now support zero-copy receipt of packets into a VM in a
network namespace, the idea of using BPF for patching user-space programs
remains entirely speculative.

Post Syndicated from daroc original https://lwn.net/Articles/1082948/

Tracepoints in the kernel are useful for a variety of purposes: debugging,
active monitoring, and performance measurements, among other things. Previously,
any given BPF program could only be attached to a single tracepoint.
Jiri Olsa has been working to change that, and led a discussion about
his progress at the 2026

Linux Storage, Filesystem, Memory-Management, and BPF
Summit. That work has since been

merged, and can be expected as part of the 7.2
kernel.

Post Syndicated from daroc original https://lwn.net/Articles/1082111/

Since 2020, BPF programs have been able to

act as Linux security modules
(LSMs). Several projects, including systemd, have been working to use
that capability to provide more security to users. Christian Brauner
spoke at the 2026

Linux Storage, Filesystem, Memory-Management, and BPF Summit
about some of the limitations of using BPF in this way, and the changes he
would like to see for systemd’s use. In particular, he would like a way to make
sure that BPF programs cannot be removed or have their private data tampered with.

Post Syndicated from daroc original https://lwn.net/Articles/1081696/

Tetragon, the BPF-based security monitoring tool,
uses BPF to monitor different aspects of a running kernel and
enforce user-specified policies. It sends its data to a user-space process,
which forwards the data to a central monitoring service elsewhere in the
network, however. This
presents a point of vulnerability: if an attacker can kill Tetragon’s user-space
agent, it won’t be able to properly report on the situation. Song Liu, Mahé
Tardy, and Liam Wiseheart spoke about their work removing the need for the
user-space agent at the 2026

Linux Storage, Filesystem, Memory-Management, and
BPF Summit.

Post Syndicated from daroc original https://lwn.net/Articles/1082832/

Security updates have been issued by AlmaLinux (389-ds:1.4, buildah, freeipmi, freerdp, gegl, gimp, golang, kernel, libreoffice, maven:3.9, openexr, perl-DBI, plexus-utils, podman, tomcat, tomcat9, xorg-x11-server, and xorg-x11-server-Xwayland), Debian (imagemagick, p7zip, and redis), Fedora (breezy, calibre, and golang-github-openprinting-ipp-usb), Mageia (ffmpeg, gzip, haproxy, libheif, libtiff, libxml2, packages, perl-List-SomeUtils-XS, and perl-Socket), SUSE (alsa, chromedriver, curl, dhcpcd, docker-compose, glibc, haproxy, ImageMagick, jq, kernel, kubernetes, libpng15, libredwg-devel, libslirp, nghttp2, php8, python-Pillow, python313-Django, python313-weasyprint, qemu, rust-keylime, sccache, and systemd), and Ubuntu (cifs-utils, libexif, libreoffice, libssh2, openssh, and pipewire).

Post Syndicated from daroc original https://lwn.net/Articles/1081546/

Cisco has some unusual challenges when it comes to deploying security patches
across the company’s many devices running custom kernels. John Fastabend spoke
about his work preventing exploits with BPF at the 2026

Linux Storage,
Filesystem, Memory-Management, and BPF Summit.
The technique could substantially reduce the time necessary to respond to kernel
vulnerabilities, but it will not be fully effective unless more hooks are added
to the kernel.

Post Syndicated from daroc original https://lwn.net/Articles/1082647/

Debian has
announced the final normal update for Debian 12 (“bookworm”). Long-term-support updates will continue until 2028. As may be expected from a stable version, the update is mostly limited to security fixes. Still, it may be time for Debian users to look into upgrading to a more recent version. Conveniently, Debian 13 (“trixie”) also
received an update this weekend, with many of the same security fixes.

Post Syndicated from daroc original https://lwn.net/Articles/1082642/

Security updates have been issued by Debian (chromium, libxfont, mesa, opam, and wireless-regdb), Fedora (acl, attr, chromium, cjson, composer, docker-compose, jfrog-cli, librabbitmq, libssh2, libXfont2, log4cxx, OpenImageIO, openssh, p11-kit, perl-Crypt-DSA, perl-HTML-Gumbo, prometheus, python-dulwich, python-idna, python-pillow, python-tornado, sssd, tmux, upower, webkitgtk, xorg-x11-server, and xorg-x11-server-Xwayland), Mageia (libarchive and vim), Oracle (389-ds:1.4, buildah, cups, edk2, freerdp, golang, grafana, gstreamer1-plugins-bad-free, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, kernel, libexif, libsolv, libtasn1, libxml2, nginx:1.24, nginx:1.26, nodejs:22, nodejs:24, oci-seccomp-bpf-hook, podman, postgresql:18, python-urllib3, tigervnc, tomcat, unbound, and xorg-x11-server), Slackware (p11-kit), and SUSE (agama, dash, dracut, flannel, go1.26, gsasl, gstreamer-plugins-good, ImageMagick, imagemagick, kernel, krb5, krb5, krb5-mini, libIex-3_4-33, libmbedtls23, libxfont2, nasm, nghttp2, perl-CGI-Session, perl-dbi, perl-List-SomeUtils-XS, python-pillow, python-social-auth-app-django, python-urllib3, python313-Django4, python313-Django6, python313-pytest-html, python313-sqlparse, python313-websockets, rclone, rust-keylime, rustup, sccache, spectre-meltdown-checker, sssd, terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provid, thunderbird, tiff, traefik2, xorg-x11-server, and xwayland).

Post Syndicated from daroc original https://lwn.net/Articles/1080519/

QBE, a compact compiler backend developed by Quentin Carbonneaux, is a
lightweight alternative to larger compiler backends such as LLVM and GCC.
Designed to be small enough for a single developer to understand, QBE uses a

static single-assignment (SSA) intermediate representation (IR), supports the C ABI,
and serves as the backend for projects such as Hare and
the cproc C11 compiler. Frontends
emit the textual form of QBE’s IR directly; QBE then takes care of register allocation,
optimization, and native-code generation, producing assembly for the target
architecture.

Post Syndicated from daroc original https://lwn.net/Articles/1081009/

Puranjay Mohan shared some of the

work he’s been doing recently on improving the
performance of read-copy-update (RCU) at the 2026

Linux
Storage, Filesystem, Memory-Management, and BPF Summit; his talk would have
been nice context to have earlier in the day when Harry Yoo and Alexei
Starovoitov led a session about the

new kmalloc_nolock() function that
allows for lockless allocation from any kernel context, and which interacts with
the RCU subsystem to allow that. This article therefore covers the two sessions
together and in the reverse order, to provide that missing context.

Post Syndicated from daroc original https://lwn.net/Articles/1078968/

When a BPF program is used to filter or redirect packets in the networking
subsystem, the program will often want to associate data with each packet as it
moves through the kernel. The kernel’s

local BPF storage API, which
associates extra data with some kernel objects, provides a way to do that. (See also
the BPF map types that end
in STORAGE.)
Amery Hung and Jakub Sitnicki led two sessions
at the 2026

Linux Storage, Filesystem, Memory-Management, and BPF Summit
about how to make accesses to local storage data more efficient. Hung spoke
about general performance problems related to locking, while Sitnicki examined
the use of local storage in the networking subsystem in particular.

Post Syndicated from daroc original https://lwn.net/Articles/1079001/

Lisp-like languages have historically led the world in metaprogramming and
flexibility. While many modern languages have adopted the idea of macros,
Lisp-like languages such as

Racket have continued pushing the envelope,
attempting to make macros as easy as possible to incorporate into everyday
programs. On the other hand, Lisp’s minimal, parenthesis-based syntax can be hard
to adapt to — to the point that Lisp is sometimes said to stand
for “Lots of Irritating Silly Parentheses”.

Rhombus is a new programming
language that aims to have the best of both worlds, marrying Racket’s
metaprogramming capabilities to a simple Python-like syntax and reasonable
standard-library defaults.

Post Syndicated from daroc original https://lwn.net/Articles/1078526/

BPF arenas are areas of memory (potentially shared with user space)
where programs have free reign to build their
own data structures, unburdened by the verifier’s bounds checks. Many of those
data structures are potentially usable in multiple programs. Emil Tsalapatis
brought his work on libarena, a library containing generic utilities for use in
BPF arenas, to the 2026

Linux Storage, Filesystem, Memory-Management, and BPF
Summit. Although the library is already available as part of the kernel, it
is still in its early stages and he has more work planned.

Post Syndicated from daroc original https://lwn.net/Articles/1077740/

Alexis Lothoré has been working to add support for the kernel’s memory-access
checker,

KASAN, to just-in-time-compiled BPF code. He spoke about that work at
the 2026

Linux Storage, Filesystem, Memory-Management, and BPF Summit.
KASAN support is needed, he said, to help catch bugs in the BPF just-in-time (JIT)
compiler. KASAN is a great tool for catching memory-management problems in the
kernel, but only in code that can be monitored by it.

Post Syndicated from daroc original https://lwn.net/Articles/1076210/

BPF programs can be used to extend many aspects the Linux kernel, but
BPF programs must run to completion in the same context that they began.
Kumar Kartikeya Dwivedi is working on changing that by
allowing BPF programs to be expressed as coroutines. He spoke about his work at
the 2026

Linux Storage, Filesystem, Memory-Management and BPF Summit. While
still experimental, the change promises to make long-running BPF tasks
significantly easier to write.