Welcome to LWN.net
LWN.net is a reader-supported news site dedicated to producing the best coverage from within the Linux and free software development communities. See the LWN FAQ for more information, and please consider subscribing to gain full access and support our activities.
[$] C++26 contract confusion
The International Organization for Standardization (ISO) has blessed seven C++ language revisions since 1998. The language is mostly developed by ISO's Working Group 21, which considers proposed additions and amendments, integrates them into a document, and then presents that document to the main ISO body to be voted on as a standard. On October 23, for the first time ever, ISO declined to ratify a document presented by Working Group 21, leaving the future of the C++26 standard in doubt. The decision was driven by controversy around a proposed new "contracts" feature that would add pre- and post-conditions to function signatures.
[$] LWN.net Weekly Edition for November 12, 2026
Posted Nov 12, 2026 0:23 UTC (Thu)The LWN.net Weekly Edition for November 12, 2026 is available.
Inside this week's LWN.net Weekly Edition
- Front: Synaptics patent claims; Git LLM policy; Hibernation and lockdown; User namespaces; glibc tunables.
- Briefs: *sshole; Amutable foundations; Asahi Linux 7.3; OpenIndiana 2026.10; Firefox 160; Quotes; ...
- Announcements: Newsletters, conferences, security updates, patches, and more.
[$] Additional hardening for the glibc dynamic linker
The Node.js project recently had a security vulnerability that affected its Brotli decoder. The bug was a buffer overflow, but the particular way that official Node.js binaries are built for Linux meant that one of the main protections against turning a buffer overflow into remote code execution, address space layout randomization (ASLR) could not be turned on. If ASLR had been enabled, the bug would still be exploitable in theory, but much more difficult to exploit in practice. In response, the GNU C Library (glibc) is considering a new set of tunable settings to allow administrators to forbid programs that do not support ASLR. The new settings, while a welcome hardening measure, may not address the root problem.
[$] Synaptics patent claims stop work on DisplayLink drivers
Mike Lothian owns a docking station (or dock) that uses a DisplayLink chipset that had, at least in his opinion, subpar performance on Linux. He decided to try improving the Linux driver, with LLM assistance, but ran into one problem that he could not solve—so he asked for help, hoping that Synaptics's developers would lend a hand. (DisplayLink was acquired by Synaptics in 2022.) Rather than help him in improving the driver, however, the Synaptics legal team responded with patent infringement claims, a demand that he cease unauthorized implementation of DisplayLink technology, and threats of expensive legal penalties. For now, it appears that Linux users of the company's docks will have to continue to live without feature parity with other platforms.
[$] Git considers voting to determine its LLM policy
One of the dominant themes of 2026 has been the debate within development projects about the terms under which LLM-written contributions should be accepted — if, indeed, they should be accepted at all. The Git project has not been immune to this trend; the topic was discussed at the recent Git Contributor's Summit. In this case, the path to a resolution may be somewhat circuitous; the project, which has never been governed as a democracy, is considering adopting a voting process as a way of bringing the discussion to an acceptable conclusion.
[$] Locking down hibernation for the winter
When a computer hibernates, the kernel writes the contents of memory to disk and then shuts the system down. Resuming from hibernation involves reading that data back into memory, and then having the kernel pick up where it left off. Unfortunately, the kernel does not have any way to know that the data it is reading back has not been tampered with, which is why lockdown, an optional kernel feature that attempts to prevent modifications to the running kernel, disables hibernation. Matthew Garrett, who has been working on lockdown for many years, has shared a patch set that aims to fix this problem. His solution must also protect against downgrade attacks (where an attacker reboots the computer with an older kernel version to bypass new protections), which complicates the implementation.
[$] User namespaces + file capabilities = trouble
User namespaces are a key part of the kernel's toolkit for assembling containers; processes within a user namespace can appear to have full root access to the system while gaining no extra privileges in the wider system. At least, that is the intent. In practice, keeping privilege contained within a user namespace has often turned out to be difficult. As an example, consider this small patch series from Josef Bacik, which is intended to address some situations where a process within a user namespace can elevate the privileges of processes outside of it.
LWN.net Weekly Edition for November 5, 2026
Posted Nov 5, 2026 0:42 UTC (Thu)The LWN.net Weekly Edition for November 5, 2026 is available.
Inside this week's LWN.net Weekly Edition
- Front: Kernel cells; Debian LLM reviews; glibc system-call wrappers; Binder in Rust; Kernel CVE flood; Fedora KDE and X11 removal; 7.4 merge window part two; Portable Python.
- Briefs: MTCP RCE; Bash security; XCPE botnet; Bazzite 45; Fedora 45; openSUSE Leap 16.1; Tor Browser 16.0; Quotes; ...
- Announcements: Newsletters, conferences, security updates, patches, and more.
Plasma X11 session removal surprises some Fedora users
The KDE Project announced, in 2025, that Plasma 6.7 would be the last version of the desktop environment that would support X11 sessions. Those who keep up with KDE's announcements no doubt expected it when Plasma 6.8 dropped X11 support as promised. What seems to have come as a surprise, at least to a number of Fedora KDE Plasma Desktop users, is that the Fedora 44 release—which shipped in April with Plasma 6.6—received an update to Plasma 6.8 that swept away the X11 session without much warning. Despite the surprise, it is gone for good: the Fedora Engineering Steering Committee (FESCo) has voted against a request to revert the update for Fedora 44 and the just-released Fedora 45.
Portable Python scripts with dependencies
A basic Python script is portable: it can be copied between machines with little concern about compatibility. A script that depends on third-party packages requires quite a bit more care and consideration, however. In 2023, PEP 723 ("Inline script metadata") introduced a standard for declaring a Python script's dependencies inside the script itself. Several third-party tools can now automatically install and manage those dependencies, but there is still little official support for this standard within Python itself.
Introducing Polo: a Wayland MATE compositor
Kerem Söke has announced the 1.0 release of Polo, a Wayland compositor for the MATE Desktop Environment:
The idea is to keep MATE behaving as closely as possible to how it does on X11, rather than changing the desktop to fit a different compositor. [...]
Window management, metacity, workspaces, tiling, XWayland, clipboard and clipman support, multiple monitors, display scaling, hotplugging, screenshots, screen sharing, and session management are all working.
I've also added desktop effects: fade, zoom, zap, spin, squeemize, magic lamp, desktop cube, expo, and wobbly windows.
Söke is looking for people to test Polo, particularly on multi-monitor setups, and report back with problems.
Stenberg: 30 years of Internet transfers with curl
Daniel Stenberg reflects on the 30th anniversary of the curl project.
libcurl runs in an estimated thirty billion installations today. It is a rough estimate since the majority of all libcurl users never tell us they use it, but we need to find it mentioned in their credit screens, open source license windows or their manuals. A super popular app might use libcurl today and not tomorrow, or vice versa, which can make the numbers shift by several billions overnight. In reality of course, once the pulse raise has calmed down and your ego is content, these numbers do not matter. In our corner of the world, things don't change notably when we go from a thousand installs to billions. We still work with similar people, in similar ways, with similar challenges.
Security updates for Thursday
Security updates have been issued by Debian (aodh, apache2, dnspython, firefox-esr, mutt, octavia, spip, thunderbird, and watcher), Fedora (epiphany, firefox, freerdp, java-25-openjdk, java-latest-openjdk, libsoup3, perl-HTTP-Parser-XS, perl-libnet, php-getid3, pipx, python-crate-ingredients, python-pillow, python-robotframework, python3.9, rsync, rubygem-nokogiri, tpm2-tss, udns, and xorg-x11-server-Xwayland), Gentoo (curl, ImageMagick, libheif, and PCRE2), Mageia (nginx and python-django), Oracle (go-toolset:rhel8, libimobiledevice, nodejs:22, util-linux, and vim), Red Hat (.NET 10.0, .NET 8.0, .NET 9.0, cockpit, freerdp, gdb, go-fdo-client, grafana-pcp, ignition, kernel, kernel-rt, krb5, openssh, openssl, osbuild-composer, rpm, rsync, and webkit2gtk3), Slackware (git, httpd, and tigervnc), SUSE (aliyun-cli, alloy, apache-parent, aqute-bnd, google-gson, logback, maven, maven-artifact-transfer, maven-parent, maven-resolver, methanol, osgi-service- subsystem, slf4j, xmvn, bcel, benchdnn, containerd, distribution, dpdk, efivar, elemental, elemental-register, elemental-system-agent, elemental-toolkit, firefox, kernel, liblldpctl4, libonnxruntime1, openssl-1_0_0, openssl-1_1, openvpn, pcre2, perl-Net-DNS, perl-Plack, perl-Starman, psqlODBC, python-M2Crypto, python-Pillow, python-Twisted, python-urllib3_1, python313-djangorestframework, python313-fpdf2, python313-langgraph-sdk, python313-nltk, rust-keylime, skopeo, traefik, zchunk, and zvbi), and Ubuntu (asyncpg, awl, btrbk, davical, dotnet8, dotnet10, dotnet11, libfcgi, linux-raspi, logback, mysql-8.0, mysql-8.4, mysql-9.7, network-manager-ssh, node-babel, php-pecl-http, prosody-modules, rkhunter, ruby-actionpack-page-caching, ruby-jwt, ruby-kramdown, shiro, snmptt, and yodl).
Zellij 0.46 released
Version 0.46 of the Zellij terminal workspace has been released.
This release includes a major addition in Zellij: Zellij is now also a desktop terminal. To run it: zellij terminal. It works on linux, mac and windows.
Nothing changes for the normal multiplexer - Zellij can still run inside another terminal. Both sessions are the same and can be shared.
Additional features in this release include a GUI settings screen, session previews, and right-click menu. See this walkthrough for more on the 0.46 release.
In Memoriam: Tim Peters 1952–2026
Guido van Rossum conveys the sad (and somewhat delayed) news of the passing of Tim Peters.
It's hard to overestimate Tim's influence on Python. He's probably best known for writing the Zen of Python (PEP 20), but to me he was a mentor and language co-designer long before that.Tim found Python not long after its initial release. His first deed was to convince me that Python should support mixed arithmetic between int and float, because most users would expect them to work that way. And he never stopped contributing.
Security updates for Wednesday
Security updates have been issued by AlmaLinux (edk2), Debian (openexr, rsyslog, and srt), Fedora (alertmanager, dotnet11.0, gdal, mstflint, nextcloud, python-crate-ingredients, rust-ingredients, rust-pore, rust-pulldown-cmark, rust-rbw, rust-sequoia-sq, rust-siguldry-fedora-autopen, tigervnc, unbound, and zchunk), Gentoo (Brotli, git, and libde265), Mageia (mopidy, python-dulwich, rust-similar3, rclone, and sofia-sip), Oracle (dpdk, edk2, firefox, glibc, kernel, kernel-uek, nodejs-nodemon, nodejs22, nodejs:24, patch, ruby, ruby4.0, squid:4, and thunderbird), Red Hat (.NET 10.0, .NET 11.0, .NET 8.0, .NET 9.0, bind, bind9.16, bind9.18, buildah, c-ares, containernetworking-plugins, delve, flatpak-builder, gcc, gcc-toolset-15-gcc, gcc-toolset-16-gcc, go-fdo-client, go-fdo-server, golang-github-openprinting-ipp-usb, grafana, grafana-pcp, gstreamer1-plugins-bad-free, gstreamer1-plugins-good, gvfs, gvisor-tap-vsock, nginx, nginx:1.24, nginx:1.26, oci-delta, podman, python-oauthlib, python3, python3.12, python3.9, qt5-qtbase, qt6-qtbase, rhc, runc, skopeo, squid, squid:4, tesseract, util-linux, xdg-dbus-proxy, and yggdrasil), Slackware (xorg-server), SUSE (aliyun-cli, amazon-cloudwatch-agent, ansible-core, aspell, azure-storage-azcopy, bind, cups, dlib-devel, docker, dolphin, dpdk, evolution, firefox, flannel, fuse-overlayfs, gnome-podcasts, google-cloud-sap-agent, GraphicsMagick, graphicsmagick, haproxy, istioctl, kernel, kubevirt, kured, libvips-devel, libXi, mozilla-nss, nvidia-open-driver-G06-signed-check, okteto, openssl-1_1, pcre2, poppler, poppler-qt, poppler-qt5, poppler, poppler-qt5, proftpd, psqlodbc, python-graphql-core, python-M2Crypto, python-pillow, python-soupsieve, python-urllib3_1, python313-wyoming, qt6-coap, rust-keylime, sbc, scribus, SDL2_image, tar, terraform-provider-susepubliccloud, the linux kernel (live patch 18 for suse linux, vsftpd, xen, xorg-x11-server, and zchunk), and Ubuntu (ca-certificates-java, gst-plugins-good1.0, gst-plugins-base1.0, hplip, linux-azure-fde, linux-nvidia, linux-nvidia-7.0, linux-nvidia-bos, linux-nvidia-lowlatency, python-tornado, rust-coreutils, and unbound).
Three new stable kernels for Tuesday
Greg Kroah-Hartman has released the 7.3.4, 6.18.63, and 6.12.117 stable kernels. The 7.3.4 kernel has more than 1,250 patches, 6.18.63 contains more than 860, and 6.12.117 includes more than 1,530 patches. Users of these kernels are, of course, encouraged to upgrade.
Firefox 160 released
Version 160 of the Firefox web browser has been released. Notable features in this release include the ability to block sites from asking to handle "mailto:" links, ability to play Matroska files with FLAC, MP3, or PCM audio, playback speed controls in the picture-in-picture video player, and a new Mini Window feature that is in early development.
Security updates for Tuesday
Security updates have been issued by AlmaLinux (curl, dpdk, glibc, kernel, nodejs-nodemon, nodejs22, nodejs24, nodejs:18, nodejs:22, patch, qt5, qt5-qtdeclarative, ruby, ruby4.0, ruby:3.3, ruby:4.0, squid:4, tomcat, util-linux, and webkit2gtk3), Debian (symfony and tomcat10), Fedora (bind, dnf5, kernel, kernel-headers, libmodulemd, maturin, perl-CGI, perl-Net-IDN-Encode, perl-Starlet, python-jiter, python-pydantic-core, python-pysequoia, python3-docs, python3.14, python3.15, ruff, rust-afterburn, rust-astral_async_zip, rust-clearscreen, rust-jiter, rust-lzma-rust2, rust-mailparse, rust-pyo3-introspection, rust-python-pkginfo, rust-serde_json, rust-testresult, rust-zip, selenium-manager, ty, and uutils-coreutils), Mageia (glibc, packages, php-smarty, python-aiohttp, and thunderbird), Oracle (curl, firefox, gdb, glibc, kernel, oVirt 4.5 ovirt-engine-wildfly, perl-YAML:1.24, and tesseract), Slackware (krb5), SUSE (ansible-core, apr-util, aspell, buildpacks-cli, dpdk22, firefox, git-bug, glib2, google-cloud-sap-agent, haproxy, jsoup, kernel, krb5, libjxl, librsvg, libruby4_0-4_0, libunbound8, libXtst, nodejs24, nvidia-open-driver-G07-signed, PackageKit, perl-XS-Parse-Keyword, poppler, python, python-Brotli, rsyslog, tekton-cli, tomcat, tomcat10, tomcat11, trivy, udisks2, xen, zchunk, and zk), and Ubuntu (apache2, ca-certificates, fetchmail, freerdp3, kernel, libgphoto2, libheif, libnfs, libsoup3, linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-azure, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips, linux-gcp, linux-gcp-5.15, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-oracle, linux-oracle-5.15, linux-realtime, linux, linux-aws, linux-aws-fips, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-azure-fips, linux-fips, linux-gcp, linux-gcp-4.15, linux-gcp-fips, linux-hwe, linux-kvm, linux-oracle, linux, linux-aws, linux-aws-fips, linux-azure, linux-azure-5.4, linux-azure-fips, linux-bluefield, linux-fips, linux-gcp, linux-gcp-5.4, linux-gcp-fips, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-azure, linux-azure-fips, linux-gcp, linux-gke, linux-ibm, linux-lowlatency, linux-oracle, linux-vmware, linux, linux-aws, linux-gcp, linux-ibm, linux-oem-7.0, linux-oracle, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-aws, linux-aws-5.4, linux-raspi, linux-raspi-5.4, linux-aws-6.8, linux-gcp-6.8, linux-ibm-6.8, linux-lowlatency-hwe-6.8, linux-nvidia, linux-realtime-6.8, linux-aws-7.0, linux-azure-fde, linux-azure-fde-7.0, linux-gcp-7.0, linux-gke, linux-oracle-7.0, linux-realtime, linux-aws-fips, linux-gcp-fips, linux-gkeop, linux-realtime, linux-azure, linux-azure-6.8, linux-azure-fde-6.8, linux-azure-fde, linux-oracle-6.8, linux-raspi, linux-raspi-realtime, linux-raspi, openjdk-17, openjdk-21, openjdk-25, openjdk-27, openjdk-8, openjdk-lts, perl, and pyasn1).
Kernel prepatch 7.4-rc2
Linus Torvalds has released the 7.4-rc2
prepatch and it will come as no surprise that it is a large one ("a
big -rc2 to go with the largest ever -rc1
"). Much of the size was made
up of some automated Coccinelle updates that were spread out all over the
tree; once those are factored out, the rest looks fairly normal:
When masking that noise out from the diffstat, the shape of it changes - not spread out over thousands of files any more. But it does not look unusual: a third is drivers (gpu, networking and sound account for most of it, but there's a bit of everything), another third is networking and bpf, and the final third is "the rest" (mostly filesystems, mm, arch updates).And yes, much of this was driven by various AI fixes. I think I'll stop repeating that, and we can just take it for granted. But this time around Alexei [Starovoitov] claims that on the bpf side at least the fixes are now coming in faster than the new reports, and that sounds lovely if true.