Linux Journal

by George Whittaker

Linux kernel developers are renewing efforts to retire the x32 application binary interface (ABI), a little-used compatibility feature that attempted to combine the advantages of 64-bit processors with the smaller memory footprint of 32-bit applications. A revised patch series submitted on October 8, 2026, proposes the first steps toward disabling the interface, potentially ending support for an architecture experiment introduced more than 14 years ago.

The latest proposal comes from Sebastian Andrzej Siewior, a Linux kernel developer at Linutronix who has been working on the removal effort throughout 2026. Rather than immediately deleting every component associated with x32, the proposed approach would first prevent the feature from being enabled through normal kernel configuration. This would give remaining users and distribution maintainers an opportunity to respond before the underlying implementation is removed.

The effort reflects a broader challenge in Linux development: maintaining compatibility with older or rarely used technologies while keeping the kernel manageable, secure, and efficient. Although x32 offered theoretical performance and memory advantages, it never achieved widespread adoption. With conventional x86_64 software dominating modern Linux systems, developers are increasingly questioning whether the additional maintenance burden remains justified.

Understanding the Linux x32 ABI

The x32 ABI was introduced with Linux kernel 3.4 in 2012 as an alternative to conventional 32-bit and 64-bit application environments. Its goal was to provide applications with access to the architectural improvements of x86_64 processors while retaining smaller data types and pointers associated with 32-bit software.

Traditional 32-bit x86 applications use the i386 ABI, which operates with a more limited register set and 32-bit execution conventions. Standard x86_64 applications, meanwhile, benefit from additional general-purpose registers, wider registers, and modern calling conventions, but they normally use 64-bit pointers. Those larger pointers can increase memory consumption in applications that maintain large numbers of pointer-heavy data structures.

The x32 ABI attempted to offer a compromise. Applications would execute using the x86_64 instruction set and its larger register file while retaining 32-bit integers, long values, and pointers. This programming model is commonly described as ILP32, meaning that integers, long integers, and pointers are all 32 bits wide.

The distinction can be illustrated by comparing the expected sizes of common C data types:

Go to Full Article

by George Whittaker

Google is exploring a new approach to Linux kernel security that could significantly change how device drivers interact with the operating system. The experimental project, known as Kage, uses compiler-based sandboxing to isolate drivers inside the kernel, potentially limiting the damage caused by memory corruption, programming errors, and exploitable vulnerabilities without requiring drivers to run as separate user-space processes.

The research was presented at the Linux Plumbers Conference 2026, held October 5–7, with Stanford University and Google researcher Zachary Yedidia discussing how LLVM's Lightweight Fault Isolation (LFI) technology can create restricted execution environments for native kernel code. Unlike conventional isolation techniques, which often depend on separate processes or virtual machines, Kage attempts to preserve the performance advantages of kernel-space execution while reducing the amount of memory individual drivers can access.

Early prototypes have already demonstrated the concept using NVMe storage, networking, and Wi-Fi drivers. However, Kage remains an experimental research project rather than a feature available in mainstream Linux distributions. Its developers are still investigating performance, hardware access, and compatibility with more complicated drivers, including graphics hardware.

Why Device Drivers Remain a Major Linux Security Challenge

Linux device drivers are responsible for connecting the operating system to hardware components, including graphics cards, network adapters, storage controllers, USB devices, and wireless chipsets. Most traditional Linux drivers execute in kernel space, giving them privileged access to system resources and the ability to interact directly with hardware. This architecture is one reason Linux can deliver high performance across such a broad range of devices, but it also creates a significant security challenge.

When an ordinary application encounters a memory error, the operating system can often terminate that process without affecting the rest of the system. Kernel drivers operate under different conditions. Because they typically share the kernel's address space and privileges, an invalid memory access or exploitable vulnerability can affect unrelated kernel components, potentially resulting in a system crash, privilege escalation, or complete compromise of the operating system.

The challenge becomes more complicated when considering the enormous number of drivers supported by Linux. Some are maintained by large organizations with extensive testing infrastructure, while others receive contributions from smaller development teams or individual maintainers. Even carefully reviewed drivers can contain bugs, particularly when they interact with complicated hardware, asynchronous operations, and memory-management mechanisms.

Go to Full Article

by George Whittaker

Linux users have long had a pragmatic relationship with text-to-speech. The classic open-source engines have been available for years, wired into accessibility tools and the occasional script, dependable but unmistakably robotic. They do the job where the job is simply to convert text to some kind of speech, but the mechanical output has kept them out of anything where the voice actually matters. The arrival of high-quality speech synthesis delivered over an API changes what is possible, letting Linux users add genuinely natural voices to scripts, services, and applications without hosting a heavyweight model themselves.

The Familiar Trade-Off

Anyone who has used the traditional Linux speech engines knows the trade-off. They are free, local, and scriptable, which fits the Linux ethos perfectly, but the voices are clearly synthetic. For accessibility and for utilitarian tasks where intelligibility is all that counts, that has been acceptable. For anything user-facing where the quality of the voice shapes the experience, it has not.

The alternative of running a modern, high-quality speech model locally is possible but comes with real costs: significant computational requirements, model management, and the ongoing maintenance of a demanding piece of infrastructure. For many use cases, particularly on servers, embedded systems, or ordinary workstations, that overhead is disproportionate to the need. This is the gap that an API-based approach fills, offering the quality of a large modern model without the burden of hosting one.

The API Approach on Linux

Delivering speech synthesis over an API fits naturally into how Linux users already build things. Rather than installing and maintaining a model, you make a request to a service and receive audio back, which you can then play, save, or pipe into whatever comes next. A text to speech api turns text into natural-sounding audio through a simple network call, which means a script or service can produce high-quality speech with nothing more than the ability to make an HTTP request and handle the response.

This composability is what makes it appealing in a Linux context. The request can come from a shell script, a systemd service, a cron job, a Python program, or any application that can talk to a network endpoint. The returned audio slots into the familiar toolchain of files, pipes, and media players. For users accustomed to assembling capabilities from small, cooperating parts, a speech API is just another well-behaved component that happens to produce audio, and it drops into existing workflows without disturbing them.

Go to Full Article

by George Whittaker

The Arch Linux project has released Archinstall 4.5, the latest version of its guided text-based installer, bringing expanded AArch64 support, new real-time Linux kernel options, additional translations, security improvements, and numerous fixes for installation workflows.

Archinstall 4.5 was released on September 29, 2026, roughly three months after Archinstall 4.4. The new version arrives just ahead of Arch Linux's October installation media refresh and has already been packaged as archinstall 4.5-1 for Arch Linux repositories.

While Archinstall remains optional, it provides users with a guided way to configure an Arch Linux installation without manually performing every step described in the Arch installation guide. Version 4.5 concentrates primarily on hardware support, installer reliability, security, and expanding the range of systems that can use the guided installation process.

AArch64 Support Gets a Major Upgrade

One of the biggest changes in Archinstall 4.5 is improved support for AArch64, the 64-bit ARM architecture.

The installer can now handle GRUB and Limine EFI installations on AArch64 systems. It also gains support for the proper AArch64 root partition type GUID.

Previously, parts of Archinstall's bootloader configuration were more heavily oriented toward x86_64 installations. The latest changes make its guided installation workflow more useful on ARM64 hardware.

AArch64 has become increasingly important throughout the Linux ecosystem. The architecture can now be found in cloud servers, development boards, laptops, workstations, and specialized computing platforms.

Supporting both GRUB and Limine EFI installations gives Archinstall more flexibility when preparing these systems.

GRUB Can Now Be Installed on AArch64

GRUB remains one of the most widely used Linux bootloaders, and Archinstall 4.5 extends its installation logic to AArch64 EFI systems.

This allows ARM64 installations to use a bootloader workflow much closer to what Archinstall already provides on conventional x86_64 UEFI computers.

The change doesn't mean every ARM device will automatically become compatible with Arch Linux. ARM hardware can still have highly platform-specific firmware and boot requirements.

It does, however, remove an important Archinstall limitation for AArch64 machines that provide conventional UEFI environments.

Limine EFI Support Expands to ARM64

The same architectural expansion applies to Limine.

Limine is a modern multiprotocol bootloader supported as one of Archinstall's bootloader choices. Archinstall 4.5 extends its EFI installation support to AArch64 as well.

Go to Full Article

by George Whittaker

The systemd project has officially released systemd 262, delivering another substantial update to the system and service manager used by most major Linux distributions. The final release was tagged on September 22, 2026, following three release candidates earlier in the month.

Systemd 262 introduces improvements across service management, containers, virtualization, encrypted storage, TPM security, networking, journal recovery, system updates, and unattended installations. Among the most interesting additions are the ability to build systemd as a single statically linked PID 1 binary, Intel TDX support in systemd-vmspawn, Live Update Orchestrator integration, improved TPM-backed encryption, and new fallback unit files embedded directly into the systemd manager.

The release also contains a rather unusual development safeguard: an AI/LLM canary intended to help identify code contributions generated by AI that haven't been properly reviewed by a human before submission.

systemd 262 Is Officially Available

The final systemd 262 source was tagged by systemd developer Luca Boccassi on September 22.

The upstream tag identifies commit 8cc40e0c5e9234bf45084751ac53b1fbfe70b492 as systemd v262, following release candidates published throughout September.

The release has already begun reaching Linux distribution development repositories.

Debian accepted systemd 262-1 into Debian Unstable on September 22, while Fedora has prepared systemd 262 packages for Fedora 45.

As usual, the speed at which systemd 262 reaches ordinary users will depend on each distribution's update policy.

systemd Can Now Become a Single Static PID 1 Binary

One of the most interesting changes in systemd 262 is support for building systemd as a single statically linked PID 1 and executor binary.

The feature is primarily intended for extremely small container environments.

Normally, systemd depends on a collection of dynamically linked libraries and supporting components. That architecture makes sense for a complete Linux distribution, but containers sometimes need a much smaller runtime environment.

The new static configuration makes it possible to create a more self-contained systemd executable suitable for minimal container images.

These builds avoid dynamically loading optional libraries and use simplified mechanisms for resolving users and groups rather than relying on the complete Name Service Switch infrastructure.

This doesn't mean normal Linux distributions will suddenly replace their standard systemd packages with a giant static executable. The capability is specifically useful for specialized container and minimal-system deployments.

Go to Full Article

by George Whittaker

Ubuntu administrators running containerized workloads have a new Linux kernel security problem to watch closely. Public exploit code is now available for CVE-2026-80521, a Linux kernel use-after-free vulnerability that can allow an unprivileged process inside a container to escape and obtain root privileges on the underlying host.

Security firm DepthFirst published its research and exploit on September 22, 2026, demonstrating the attack against Ubuntu 26.04 LTS. The underlying Linux kernel vulnerability had already been fixed upstream on August 6, but as of September 23, Ubuntu's security tracker still lists the main kernel package in Ubuntu 26.04 LTS as "Vulnerable, work in progress," while Ubuntu 24.04 LTS is also listed as vulnerable.

The situation is particularly important for Docker, Kubernetes, cloud infrastructure, and other environments that run potentially untrusted workloads because the vulnerable kernel functionality can be reached through ordinary operations available inside standard containers.

There is currently no confirmed evidence that CVE-2026-80521 is being actively exploited in real-world attacks, and the vulnerability isn't listed in CISA's Known Exploited Vulnerabilities catalog. The availability of working public exploit code nevertheless makes the patch gap considerably more important.

CVE-2026-80521 Is a Linux Kernel Vulnerability

Although Ubuntu is receiving much of the attention because the newly published exploit specifically targets it, CVE-2026-80521 is fundamentally a Linux kernel vulnerability.

The problem exists in the kernel's AF_UNIX socket subsystem, specifically within its garbage collection mechanism.

AF_UNIX sockets, commonly called Unix-domain sockets, provide local inter-process communication between applications running on the same system.

Unlike conventional network sockets, they don't need to communicate across a network. They are widely used by Linux applications and services for fast communication between local processes.

They also support passing file descriptors between processes through SCM_RIGHTS messages, and it is the kernel's management of these references that creates the conditions for CVE-2026-80521.

A Race Condition Leads to Use-After-Free

At the technical level, CVE-2026-80521 involves a race condition inside the AF_UNIX garbage collector.

The kernel needs to track references between Unix sockets when file descriptors are passed between processes. Circular references can develop, where one socket effectively references another while that socket references something else in the same group.

Linux represents these relationships internally and periodically determines which references can safely be removed.

Go to Full Article

by George Whittaker

The Fedora Project has officially released Fedora Linux 45 Beta, giving users an early look at the technologies expected to form the foundation of the final Fedora 45 release. The beta became available on September 15, 2026, after Fedora's Quality team approved Release Candidate 1.3 for publication.

Fedora 45 Beta brings significant changes throughout the operating system, including Python 3.15, GCC 16.2, glibc 2.44, GNU Binutils 2.47, Go 1.27, LLVM 23, Podman 6, stricter RPM signature verification, improved DNF5 protections, a new userspace virtual console, standardized desktop secret storage, and substantial installer improvements.

The release is available across Fedora Workstation, KDE Plasma Desktop, Server, Cloud, IoT, Atomic Desktops, Spins, and Labs, although a few prerelease images are excluded.

Fedora 45 Beta Is Now Available

Fedora Linux 45 Beta represents the final major public testing milestone before Fedora 45 reaches stable status.

Fedora describes its beta releases as code-complete previews that closely represent what users should expect from the final version. Development isn't finished, however, and bugs or incomplete migrations can still be discovered during real-world testing.

Fedora 45 Beta is currently available in several major editions:

• Fedora Workstation 45 Beta
• Fedora KDE Plasma Desktop 45 Beta
• Fedora Server 45 Beta
• Fedora Cloud 45 Beta
• Fedora IoT 45 Beta
• Fedora Atomic Desktops
• Fedora Spins
• Fedora Labs

Existing Fedora installations can also be upgraded to the beta using Fedora's DNF system-upgrade process.

Fedora's official Workstation download page confirms Beta 1.3 images for both x86_64 and AArch64 systems.

A New Virtual Console with kmscon

One of Fedora 45's more unusual system-level changes is the replacement of the traditional in-kernel console with kmscon.

Fedora describes kmscon as a modern userspace virtual terminal implementation that provides smoother rendering, better internationalization and font handling, improved visual integration, and security improvements compared with the older console infrastructure.

This affects the virtual terminals users encounter outside their normal graphical desktop session.

Most desktop users spend relatively little time interacting directly with these consoles, but they remain important for troubleshooting, system administration, servers, recovery operations, and systems running without a graphical environment.

Moving that functionality into userspace also gives Fedora more flexibility for future development instead of relying entirely on the legacy kernel console implementation.

Go to Full Article

by George Whittaker

The Thunderbird team has officially released Thunderbird 156, bringing another round of new features, security improvements, authentication enhancements, and reliability fixes to the popular open-source email client. Released on September 15, 2026, the update is available for Linux alongside Windows and macOS.

Thunderbird 156 is not a dramatic redesign of the desktop mail client. Instead, it concentrates on improving areas that matter to everyday users and system administrators, including OAuth authentication, OpenPGP, POP3, IMAP, Exchange Web Services, SMTP, attachments, calendars, enterprise policies, and security.

For Linux users in particular, the release delivers several fixes affecting common mail protocols and account configurations while retaining support for Linux environments using GTK+ 3.14 or newer.

Thunderbird 156 Arrives on Linux

Thunderbird 156 follows version 154, which arrived in August with features including optional system tray operation and Microsoft Graph support for Microsoft 365.

Version 156 continues the project's monthly release cycle with a more targeted collection of authentication, security, compatibility, and reliability improvements.

According to Thunderbird's official release notes, version 156 requires:

• Linux: GTK+ 3.14 or newer
• Windows: Windows 10 or newer
• macOS: macOS 10.15 or newer

Thunderbird 156 was officially released on September 15.

Linux distribution availability will vary because distributions can package Thunderbird according to their own schedules. Users receiving Thunderbird through another packaging channel may therefore see version 156 at a different time.

Custom OAuth Support Expands

One of the most significant areas of development in Thunderbird 156 is OAuth authentication.

Thunderbird now supports custom OAuth configurations containing an issuer ID and client secret for IMAP and POP3 accounts. Custom OAuth support has also been extended specifically to POP3.

OAuth has become increasingly important as email providers move away from conventional username-and-password authentication toward token-based authentication.

For Thunderbird, broader custom OAuth support means users and organizations have greater flexibility when connecting the client to mail services that don't fit Thunderbird's predefined provider configurations.

This can be particularly useful in enterprise environments, self-hosted infrastructure, and organizations operating their own identity systems.

Exchange Custom OAuth Setup Fixed

Exchange users receive an important related correction.

Go to Full Article

by George Whittaker

The KDE Project has officially released KDE Plasma 6.7.5, delivering another round of bug fixes and stability improvements for the Plasma 6.7 desktop series. Released on September 8, 2026, the update contains roughly a month of fixes and updated translations contributed since Plasma 6.7.4 arrived in early August.

Unlike a major Plasma release, version 6.7.5 doesn't introduce a large collection of new desktop features. Instead, KDE has focused on fixing problems affecting Discover, KWin, Wayland, networking, System Monitor, Plasma Desktop, RPM-OSTree systems, Snap updates, HDR rendering, and several other components.

For users already running Plasma 6.7, this makes version 6.7.5 primarily a maintenance upgrade intended to make the desktop more dependable ahead of the next major Plasma series.

KDE Plasma 6.7.5 Arrives as the September Bugfix Release

KDE describes Plasma 6.7.5 as its September bugfix release for the Plasma 6 desktop.

The broader Plasma 6.7 series originally arrived in June 2026, followed by a succession of maintenance releases:

• Plasma 6.7.1 on June 23
• Plasma 6.7.2 on June 30
• Plasma 6.7.3 on July 14
• Plasma 6.7.4 on August 4
• Plasma 6.7.5 on September 8

KDE's official download infrastructure confirms that the Plasma 6.7.5 source packages became available on September 8.

This slower maintenance cadence later in a Plasma series is normal. Once the most urgent post-release problems have been addressed, KDE generally shifts more development attention toward the next feature release while continuing to provide important fixes for the current branch.

Discover Receives Several Important Fixes

KDE's Discover software center receives some of the most noticeable improvements in Plasma 6.7.5.

One particularly annoying problem could cause Discover to become stuck while checking for updates when its Snap backend was installed but no Snap applications actually had updates available.

That problem has now been corrected.

Discover also behaves more reliably when fwupd, the Linux firmware update service, is unavailable. Previously, a broken or intentionally masked fwupd service could interfere with Discover's normal operation. Plasma 6.7.5 allows the rest of the application to continue functioning correctly in that situation.

This is useful for systems where firmware updating isn't supported, where administrators intentionally disable the service, or where fwupd encounters a configuration problem.

Firmware Updates No Longer Incorrectly Require Reboots

Another Discover correction addresses a regression involving firmware updates.

Go to Full Article

by George Whittaker

One of Linux's oldest surviving distributions is moving closer to its next major release. Slackware 16 Alpha 1 became available on September 5, 2026, marking the first formal alpha milestone on the road toward Slackware Linux 16. The release follows a major rebuild of Slackware-current using a substantially newer GNU toolchain and brings together several upgrades that have accumulated since Slackware 15.0 arrived more than four years ago.

The alpha combines Linux 6.18 LTS, GCC 16.2.0, glibc 2.44, GNU Binutils 2.47, KDE Plasma 6, and numerous updated user-space packages while retaining much of the deliberately traditional architecture that has distinguished Slackware for decades.

For longtime Slackware users, Alpha 1 is particularly significant because it provides the clearest indication yet that the lengthy Slackware 16 development cycle is moving toward an eventual stable release.

Slackware 16 Finally Reaches Alpha

Slackware doesn't operate according to the predictable six-month or annual release schedules used by many other Linux distributions.

Instead, development takes place continuously through the Slackware-current branch. Patrick Volkerding and other contributors update that development tree until it reaches a state considered suitable for a stable release.

The previous major version, Slackware 15.0, was released in February 2022. More than four and a half years later, Slackware-current has now officially reached the first alpha milestone for version 16.

Volkerding marked the milestone following a complete rebuild of the distribution with its newly upgraded compiler, C library, and binary utilities.

The short changelog announcement even suggested there might finally be "a light at the end of the tunnel," a promising indication for Slackware users waiting for version 16.

The Entire Distribution Was Rebuilt

One of the most consequential changes behind Alpha 1 is a complete package rebuild.

Slackware's development toolchain has moved to:

• GCC 16.2.0
• glibc 2.44
• GNU Binutils 2.47

After introducing those components, Slackware rebuilt the distribution's packages against the updated environment.

A full rebuild is much more significant than simply replacing three packages.

GCC is responsible for compiling much of the software distributed with Slackware, glibc provides fundamental C library functionality used throughout Linux user space, and Binutils supplies essential development utilities including the GNU assembler and linker.

Rebuilding the distribution against these versions gives Slackware 16 a considerably newer foundation than its predecessor.

Go to Full Article

by Malana VanTyler

These platforms help teams monitor how technical content appears in AI-generated answers, from brand mentions and citations to accuracy and referral traffic.

Search is splitting into two experiences: one built around ranked pages and another around generated answers. As AI platforms summarize Linux tutorials, open-source project documentation, API references and technical guidance, teams need ways to measure whether their content is mentioned, cited and accurately represented.

An AEO platform provides that visibility. They help writers, maintainers, developers, and content teams examine how pages appear in generated answers, which sources receive citations, and whether AI platforms send traffic to the intended documentation.

Top AEO Tools for Technical Content

AEO and AI visibility platforms vary greatly. Some are mostly about tracking mentions, while others combine AI visibility with citations, referral traffic, competitor data or content recommendations. Below is a selection of tools, both popular and niche, that can be used by technical and content teams responsible for developer portals, Linux resources and open-source projects.

1. Similarweb AI Search Intelligence

Best for: Measuring AI visibility, citations and resulting website traffic in one platform.

Similarweb AI Search Intelligence gives teams a broad view of how brands and websites appear across AI-generated search experiences. It can be used to monitor brand mentions, citation frequency, prompt-level visibility and share of voice while comparing results with competitors. Similarweb also connects those measurements with its wider web and traffic intelligence, helping teams examine whether visibility and citations are producing visits to particular pages.

For technical content teams, this combination can make it easier to trace the path from an AI answer to its cited source and then to referral traffic. Teams can identify prompts where documentation is absent, determine which domains are being cited instead, and investigate whether AI-referred visitors reach the intended technical

pages. For example, an open-source project could examine whether prompts about installation on Ubuntu, package dependencies or command-line configuration lead users to its current documentation rather than an outdated forum post.

Standout feature: Similarweb combines AI visibility, citation analysis and traffic intelligence, reducing the need to examine those signals in separate platforms.

2. Rankscale.ai

Best for: Tracking technical content across a wide selection of AI engines.

Go to Full Article

by Malana VanTyler

AI security means hardening everything around the model, not just the model itself.

AI workloads have moved out of the research sandbox and into production, which means they now carry the same operational weight as any other critical service. If you want to understand what is AI security in practical terms, start here. It's not a 

separate discipline bolted onto your existing stack. It's an extension of it. The systems around a model matter as much as the model itself, and for teams running Linux and open-source infrastructure, that means applying familiar discipline to some new risks.

AI Security Is Becoming Part of the Linux Infrastructure

Treat AI workloads like production infrastructure, not side projects. A model doesn't run in isolation. It depends on an operating system, a container runtime, storage, APIs, identity systems, and a pile of dependencies. If any of those layers are weak, prompt filtering or output moderation won’t be enough.

Security teams that only look at the model may miss much of the actual attack surface. The work starts with the same questions you'd ask about any service. What's exposed? Who can reach it? What happens if it's compromised? 

The AI Attack Surface Extends Beyond the Model 

Model-serving APIs, embeddings, retrieval systems, vector databases, plugins, and CI/CD pipelines all now sit inside the perimeter. A vector database that holds proprietary documents is a data store like any other and needs the same access controls. An inference endpoint that accepts arbitrary text input is a public-facing service, and it needs rate limits and authentication like any other. Plugins and tool integrations expand what a model can touch, which also expands what an attacker can touch. It’s the same threat modeling you’d apply to a web application. 

Go to Full Article

by George Whittaker

Why security buyers are rethinking what matters most.

Security teams typically don’t struggle to find vulnerabilities as much as they have in the past. The harder part usually begins after the report arrives, once dozens of findings land in front of engineering teams already juggling patch schedules, production deadlines, and internal disagreements about urgency. Platforms like XBOW, OffSec, and Cobalt have entered that environment as organizations started rethinking what they actually need from pentesting vendors beyond annual compliance exercises.

A vulnerability may look severe inside a dashboard, while no one internally agrees whether it creates meaningful exposure or simply adds another item to an already crowded queue. Infrastructure also changes too quickly for static testing cycles to answer every operational question.

APIs update mid-quarter, contractors receive temporary access that lingers longer than expected, and cloud permissions change quietly during routine development work. Buyers evaluating vendors now spend more time asking whether testing accurately reflects the systems employees use every day.

Pentesting Vendors Now Face Different Expectations

Long reports stopped carrying the same weight years ago. Security teams already know modern environments contain weaknesses. What many organizations want now is clearer evidence showing which findings deserve immediate attention and which ones can wait without creating major operational exposure. That distinction became harder to ignore as remediation timelines stretched across larger environments.

Go to Full Article

by George Whittaker

Linux kernel developers are considering a new “steal governor” designed to improve performance when multiple virtual machines compete for limited physical CPU resources. The proposal uses the amount of CPU steal time observed inside a guest to dynamically reduce or expand the number of virtual CPUs on which that VM prefers to schedule work.

The feature is primarily aimed at heavily virtualized servers where administrators deliberately assign more virtual CPUs than the host can physically execute at once. Under heavy load, that overcommitment can lead to frequent vCPU preemption, lock-holder delays, cache disruption, and ultimately lower overall throughput.

The latest v11 patch series was posted on August 25, 2026, and its developer has proposed consideration during the Linux 7.3 development cycle, potentially targeting Linux 7.4 for inclusion. This means the feature is still under review and is not part of a stable Linux kernel yet.

What Is CPU Steal Time?

CPU steal time is a concept specific to virtualization.

Imagine a virtual machine has eight vCPUs. From inside that VM, the operating system behaves as though those eight CPUs are available. But those virtual CPUs ultimately need to run on the host's physical processors.

If several VMs are competing for the same physical CPU resources, the hypervisor may temporarily prevent one VM's vCPU from running so another VM can use the processor.

The time during which the guest wanted to execute but couldn't because the hypervisor was using the underlying CPU elsewhere is known as steal time.

High steal time is therefore a useful indication that the physical host is experiencing CPU contention.

The “Noisy Neighbor” Problem

The steal governor is designed primarily to address what virtualization engineers commonly call the noisy neighbor problem.

Consider a server hosting several VMs:

• VM A has 32 vCPUs.
• VM B has 32 vCPUs.
• VM C has 32 vCPUs.
• The physical server has only 64 CPU threads available to those workloads.

That configuration can work perfectly well when the VMs aren't simultaneously busy.

If all three suddenly become heavily loaded, however, they may collectively request more CPU time than the physical machine can provide.

The hypervisor then has to constantly switch between vCPUs.

Those interruptions can become particularly expensive if a vCPU is preempted while holding a lock or executing another latency-sensitive section of code. Other threads may then wait for a vCPU that isn't currently being allowed to run.

The result can be counterintuitive: giving the VMs more virtual CPUs can sometimes make the combined workloads slower.

Go to Full Article

by George Whittaker

The Thunderbird team has officially released Thunderbird 154, delivering several useful new features alongside a substantial collection of fixes for email, calendars, address books, authentication, and stability. Released on August 18, 2026, Thunderbird 154 is now the latest monthly release of the popular open-source email client.

For Linux users, one of the most interesting additions is a new optional system tray mode, while Microsoft 365 users gain Microsoft Graph support. The release also improves global search, attachment handling, IMAP reliability, Exchange authentication, and CalDAV synchronization.

New Optional System Tray Mode

One of Thunderbird 154's most welcome additions is an optional system tray mode.

When enabled, closing Thunderbird's last window no longer needs to completely terminate the application. Instead, Thunderbird can remain running in the background through the system tray.

This can be particularly useful for users who want Thunderbird available throughout the day without keeping its main window open.

For Linux desktop users, the feature could make Thunderbird feel more like a traditional background email client, especially on desktops where tray-based applications remain part of the normal workflow.

Microsoft Graph Enabled for Microsoft 365

Thunderbird 154 also enables Microsoft Graph for Microsoft 365.

Microsoft Graph is Microsoft's API platform for accessing Microsoft 365 services and data. Its integration is particularly important as Thunderbird continues improving its support for Exchange and Microsoft-hosted email environments.

Thunderbird has been steadily expanding its Microsoft ecosystem compatibility, making the open-source client increasingly practical for users who need to access workplace Microsoft 365 accounts from Linux.

Global Search Gets a Useful New Option

Thunderbird's global search functionality also receives an improvement.

Users can now configure global search results to open in list view by default, providing another option for people who prefer a more traditional message-list workflow when reviewing search results.

It's a relatively small addition, but one that can make repeated searches more convenient for users managing large mailboxes.

Better Attachment Management

Thunderbird 154 introduces several improvements for handling email attachments.

A new "Copy To" folder context menu has been added for message/rfc822 attachments, and these attached messages can now be dragged directly into Thunderbird's folder tree.

These changes should make it easier to organize attached email messages without having to use additional steps or workarounds.

Go to Full Article

by George Whittaker

Linux creator Linus Torvalds has officially released Linux Kernel 7.2, opening another chapter in the development of the world's most widely deployed open-source kernel. The final release arrived on August 16, 2026, following seven release candidates and roughly two months of development. Kernel.org now lists Linux 7.2 as the latest mainline release.

Linux 7.2 is a substantial update with improvements spanning CPU scheduling, storage performance, AMD and Intel hardware support, graphics, networking, virtualization, RISC-V, and Apple Silicon. Among its biggest additions are Cache-Aware Scheduling, USB4STREAM, AMD ISP4 support, and initial AMDGPU HDMI 2.1 FRL functionality.

Cache-Aware Scheduling Lands in Linux

One of the most interesting performance additions in Linux 7.2 is Cache-Aware Scheduling (CAS).

Modern processors frequently contain multiple last-level caches shared between groups of CPU cores. Traditional scheduling decisions don't always account optimally for those cache relationships, potentially moving tasks between cores in ways that increase cache misses.

Cache-Aware Scheduling gives the Linux scheduler additional information about cache topology so it can make smarter decisions about where workloads should run.

Early testing during development produced particularly impressive results for some server workloads, including major gains in certain MySQL configurations. The improvement varies significantly by hardware and workload, so users shouldn't expect similarly dramatic gains everywhere.

For modern AMD and Intel systems with increasingly complex CPU topologies, however, CAS provides another tool for extracting better performance from existing hardware.

USB4STREAM Enables High-Speed Connections Between Computers

Linux 7.2 also introduces USB4STREAM, an interesting new capability for transferring data directly between computers over USB4 or Thunderbolt connections.

Rather than treating USB primarily as a traditional host-to-device interface, USB4STREAM can facilitate high-speed communication between systems.

Potential applications include:

• Large file transfers
• Development environments
• High-speed system-to-system networking
• Debugging
• Specialized workstation workflows

With USB4 and Thunderbolt increasingly common on laptops and desktops, this could eventually become a useful option for moving large amounts of data between Linux machines.

AMD ISP4 Finally Reaches the Mainline Kernel

AMD users receive another important addition with the arrival of the AMD ISP4 driver.

ISP stands for Image Signal Processor, hardware responsible for processing camera data before it reaches applications.

Go to Full Article

by George Whittaker

Linux kernel developers made a significant last-minute graphics change for Linux 7.2, reverting the DRM GPU scheduler back to its previous FIFO policy by default after the newer fair scheduling implementation caused serious performance regressions. The revert was submitted just before the final Linux 7.2 release after users reported severe slowdowns and desktop freezes under sustained GPU workloads.

The decision demonstrates the kernel community’s conservative approach to regressions: when a new feature causes problems this late in a development cycle, restoring known-good behavior can be safer than rushing an incomplete fix.

What Changed in Linux 7.2?

Earlier in the Linux 7.2 development cycle, the DRM subsystem switched its default GPU scheduling policy to a new fair scheduler.

The goal was to distribute GPU execution time more fairly between competing workloads. Instead of relying on the established FIFO scheduling behavior, the new implementation uses a fairness-oriented approach designed to prevent one workload from dominating GPU resources.

However, real-world testing exposed problems that had not appeared during earlier development.

The final DRM fixes for Linux 7.2 therefore:

• Revert the fair scheduler changes
• Restore FIFO as the default
• Restore selectable scheduling policies
• Mark the fair scheduling policy as experimental

DRM maintainer Dave Airlie acknowledged that developers may have moved too aggressively when switching to the new scheduler.

AMD Radeon Gaming Exposed the Regression

The problem became particularly noticeable during gaming on an AMD Radeon RX 9070 XT.

A regression report described severe performance degradation when the GPU remained close to 100% utilization. A game running through Proton could drop to roughly 10 FPS or freeze, while audio continued playing normally.

The problem could become severe enough that the entire KDE Plasma Wayland session stopped responding, sometimes requiring the compositor to be killed or the computer to be rebooted.

Interestingly, reducing GPU load—such as by opening an in-game menu or switching away from the game—could immediately stop the stuttering.

FIFO Worked, FAIR Did Not

Testing provided strong evidence that the new scheduling policy was responsible.

The reporter compared Linux 7.2 release candidates using FAIR against configurations using the previous FIFO policy. Under otherwise similar conditions:

FAIR: reproduced the performance problem.

FIFO: survived extended stress testing without the regression.

Linux 7.1.x also behaved normally.

Go to Full Article

by George Whittaker

Intel’s open-source Linux graphics stack has taken another step forward with hardware-accelerated AV1 encoding through Vulkan Video. New code merged for Mesa’s ANV Vulkan driver enables the VK_KHR_video_encode_av1 extension on Intel’s DG2/Alchemist graphics hardware, including Arc A-Series GPUs.

The development expands Intel’s Vulkan Video capabilities on Linux and gives applications another standardized way to access the dedicated video encoding hardware found in modern Intel GPUs.

AV1 Encoding Arrives in Intel ANV

The key change is support for the Vulkan extension VK_KHR_video_encode_av1 in Mesa’s open-source Intel ANV driver.

The extension was finalized by the Khronos Group in 2024 and provides a standardized Vulkan interface for hardware-accelerated AV1 encoding. It complements Vulkan Video’s existing AV1 decoding support and means Vulkan can provide both encoding and decoding interfaces for AV1, H.264, and H.265.

Intel had previously stated that its Arc graphics products would support Vulkan Video AV1 encoding through a future software update.

Initially Targeting Intel Arc Alchemist

The newly enabled Linux support specifically targets DG2, better known commercially as Intel’s Arc Alchemist GPU generation.

These GPUs already contain dedicated hardware capable of AV1 encoding, so the Mesa update does not add AV1 capability through software. Instead, it provides Vulkan applications with another way to access the GPU’s existing hardware video engine.

That distinction is important because hardware encoding can deliver much better performance and efficiency than encoding AV1 entirely on the CPU.

Why AV1 Matters

AV1 has become increasingly important for streaming, screen recording, video conferencing, and online video distribution.

The codec can provide high image quality at relatively low bitrates, making it attractive for applications where bandwidth and storage efficiency matter. It is also royalty-free, which has helped encourage adoption throughout the open-source ecosystem.

Hardware AV1 encoding can be particularly useful for:

• Game streaming

• Desktop recording

• Live broadcasting

• Video conferencing

• Video transcoding

• Content creation

For Linux users with supported Intel Arc hardware, Vulkan Video now has the potential to provide a common API for these workloads.

Building on H.264 and H.265 Support

The AV1 work follows recent improvements to Intel’s Vulkan Video encoding support for other codecs.

Go to Full Article

by George Whittaker

A newly proposed patch for the Linux kernel's AMD P-State CPU frequency scaling driver is showing impressive gaming performance improvements, potentially delivering a noticeable boost for Ryzen users without requiring new hardware. Early benchmarks indicate that the optimization can significantly improve frame rates in CPU-bound games by allowing processors to respond more quickly to changing workloads. (phoronix.com)

Although the patch has not yet been merged into the mainline Linux kernel, the initial results have generated considerable excitement among Linux gamers and kernel developers alike.

What Is AMD P-State?

AMD P-State is the modern CPU frequency scaling driver for AMD Ryzen processors on Linux. Rather than relying on the older ACPI CPUFreq driver, AMD P-State communicates directly with the processor to adjust clock speeds based on workload demands.

Its goals include:

• Faster frequency scaling
• Improved power efficiency
• Better responsiveness
• Higher performance during demanding workloads
• Lower power consumption when the system is idle

Most modern Linux distributions already support AMD P-State on compatible Ryzen processors. (kernel.org)

A Focus on Gaming Performance

The new patch specifically targets how quickly AMD P-State responds when a game suddenly demands additional CPU performance.

Many games rapidly alternate between light and heavy CPU workloads. If the processor takes too long to increase its clock speed, short performance dips can occur.

The proposed optimization reduces that delay, allowing the CPU to boost more aggressively when needed and helping maintain smoother gameplay. (phoronix.com)

Promising Benchmark Results

According to early testing, the patch delivers meaningful improvements across several Linux gaming workloads.

Reported benefits include:

• Higher average frame rates
• Better 1% low FPS performance
• Faster CPU frequency response
• Improved responsiveness during gameplay
• More consistent frame delivery

The biggest gains appear in CPU-limited games where processor performance has a greater impact than GPU performance. Systems that are already GPU-bound may see smaller improvements. (phoronix.com)

Designed for Modern Ryzen CPUs

The patch targets systems using the AMD P-State driver, which supports many recent Ryzen processors.

Compatible platforms generally include:

Go to Full Article

by George Whittaker

Linux kernel developers are moving forward with plans to remove the crypto_rng API layer, a long-standing component of the kernel's cryptographic subsystem. The proposed change is part of a broader effort to simplify the kernel's internal architecture by eliminating redundant code paths and encouraging developers to rely on the kernel's modern random number generation interfaces instead. (phoronix.com)

Although the change happens entirely behind the scenes, it reflects the Linux kernel community's ongoing commitment to reducing technical debt, improving maintainability, and modernizing core infrastructure.

What Is the crypto_rng Layer?

The crypto_rng framework is an API within the Linux kernel's Crypto API that provides random number generation services for kernel components.

Historically, it allowed different kernel subsystems and drivers to request random data through a generic cryptographic interface. Over time, however, the kernel's dedicated random number generator has matured considerably, making much of the crypto_rng abstraction unnecessary. (kernel.org)

Today, developers generally recommend using the kernel's built-in random number generation functions directly instead of routing requests through the older crypto layer.

Why Developers Want to Remove It

According to discussions on the Linux kernel mailing list, the crypto_rng layer has become largely redundant.

Modern kernel code already relies on well-established interfaces such as:

• get_random_bytes()
• get_random_u32()
• get_random_u64()

These functions are maintained as part of the kernel's primary random number generation subsystem and are widely used throughout Linux. Maintaining an additional abstraction layer increases code complexity without providing significant practical benefits. (phoronix.com)

Removing unnecessary infrastructure also makes the kernel easier to maintain and audit over the long term.

Simplifying the Crypto API

The Linux Crypto API has evolved significantly over the years as new algorithms, hardware accelerators, and security features have been introduced.

Kernel maintainers have increasingly focused on:

Go to Full Article