Language Selection

English French German Italian Portuguese Spanish


Syndicate content is a comprehensive source of news and opinions from and about the Linux community. This is the main feed, listing all articles which are posted to the site front page.
Updated: 2 hours 22 min ago

Formatted kernel documentation at

3 hours 7 min ago
For the last couple of release cycles, the kernel's ongoing transition to the Sphinx documentation system has left behind. Thanks to some work by Konstantin Ryabitsev, that situation has now been remedied, and has the formatted documentation generated from the current -rc kernel. The DocBook-generated documents remain available for as long as DocBook stays in use. (For those interested in the linux-next version of the documentation, the version on LWN's server is usually up to date; it currently has the changes that are queued for 4.10.)

A change of lawyers at the FSF

3 hours 15 min ago
The Free Software Foundation has announced that Eben Moglen has stepped down as the organization's general counsel; there is no word on who his replacement will be. "The FSF looks forward to working together in other capacities with Professor Moglen and SFLC on future projects to advance the free software movement and use of the GNU General Public License (GPL)."

Two new stable kernels

3 hours 47 min ago
Greg Kroah-Hartman has released the 4.8.5 and 4.4.28 stable kernels. As usual, they contain fixes throughout the tree and users of those series should upgrade.

[$] Defending against Rowhammer in the kernel

4 hours 19 min ago
The Rowhammer vulnerability affects hardware at the deepest levels. It has proved to be surprisingly exploitable on a number of different systems, leaving security-oriented developers at a loss. Since it is a hardware vulnerability, it would appear that solutions, too, must be placed in the hardware. Now, though, an interesting software-based mitigation mechanism is under discussion on the linux-kernel mailing list. The ultimate effectiveness of this defense is unproven, but it does show that there may be hope for a solution that doesn't require buying new computers.

Friday's security advisories

5 hours 7 min ago

Debian has updated nginx (packaging problem in previous security update).

Debian-LTS has updated tre (code execution).

openSUSE has updated flash-player (13.2: code execution).

Red Hat has updated kernel (RHEL5: two vulnerabilities) and nodejs and nodejs-tough-cookie (RHOSE: two vulnerabilities).

SUSE has updated flash-player (SLE12: code execution).

Ubuntu has updated firefox (two vulnerabilities), , nginx (16.10, 16.04, 14.04: packaging problem in previous security update), and thunderbird (multiple vulnerabilities).

Gregg: DTrace for Linux 2016

Thursday 27th of October 2016 07:02:59 PM
Brendan Gregg celebrates the capabilities of Linux kernel tracing with BPF. "With the final major capability for BPF tracing (timed sampling) merging in Linux 4.9-rc1, the Linux kernel now has raw capabilities similar to those provided by DTrace, the advanced tracer from Solaris. As a long time DTrace user and expert, this is an exciting milestone! On Linux, you can now analyze the performance of applications and the kernel using production-safe low-overhead custom tracing, with latency histograms, frequency counts, and more."

Thursday's security updates

Thursday 27th of October 2016 02:55:12 PM

Arch Linux has updated flashplugin (code execution) and lib32-flashplugin (code execution).

Debian-LTS has updated bash (code execution), graphicsmagick (multiple vulnerabilities), libx11 (denial of service), libxi (code execution), and libxtst (code execution).

openSUSE has updated kernel (11,4: many vulnerabilities, one from 2013, many from 2015), ghostscript (13.2: multiple vulnerabilities, one from 2013), and sssd (42.1: access restriction bypass).

Red Hat has updated flash-plugin (RHEL6&5: code execution), kernel (RHEL6.5; RHEL7.1: privilege escalation), and openstack-manila-ui (RHOSP9.0; RHOSP8.0; RHOSP7.0: cross-site scripting).

[$] Weekly Edition for October 27, 2016

Thursday 27th of October 2016 02:00:21 AM
The Weekly Edition for October 27, 2016 is available.

The initial bus1 patch posting

Wednesday 26th of October 2016 07:55:54 PM
The bus1 message-passing mechanism is the successor to the "kdbus" project; it was covered here in August. The patches have now been posted for review. "While bus1 emerged out of the kdbus project, bus1 was started from scratch and the concepts have little in common. In a nutshell, bus1 provides a capability-based IPC system, similar in nature to Android Binder, Cap'n Proto, and seL4."

Security advisories for Wednesday

Wednesday 26th of October 2016 05:17:16 PM

CentOS has updated kernel (C6: privilege escalation).

Debian has updated asterisk (multiple vulnerabilities) and nginx (privilege escalation).

Debian-LTS has updated nspr (information disclosure), nss (information disclosure), potrace (multiple vulnerabilities), qemu (multiple vulnerabilities), and qemu-kvm (multiple vulnerabilities).

Fedora has updated perl-Image-Info (F24; F23: information disclosure).

Mageia has updated graphicsmagick (three vulnerabilities), java-1.8.0-openjdk (multiple vulnerabilities), mpg123 (denial of service), and tor (denial of service).

openSUSE has updated GraphicsMagick (Leap42.1; 13.2: multiple vulnerabilities), guile (13.2: two vulnerabilities), guile1 (Leap42.1; 13.2: information disclosure), firefox (Leap42.1, 13.2: two vulnerabilities), qemu (Leap42.1: multiple vulnerabilities), quagga (Leap42.1: stack overrun), and kernel (13.2: multiple vulnerabilities).

Oracle has updated kernel (OL6: privilege escalation).

Red Hat has updated kernel (RHEL6; RHEL6.7: privilege escalation) and kernel-rt (RHEMRG2.5; RHEL7: two vulnerabilities).

Scientific Linux has updated kernel (SL6: privilege escalation).

Ubuntu has updated nginx (16.10, 16.04, 14.04: privilege escalation).

Flatpak 0.6.13

Tuesday 25th of October 2016 06:37:37 PM
Flatpak 0.6.13 has been released. Major changes include a change in command line arguments for install/update/uninstall, application runtime dependencies are checked/downloaded, remote-add and install --from now supports uris, flatpak run can now launch a runtime directly, and more.

Tuesday's security updates

Tuesday 25th of October 2016 04:11:45 PM

Arch Linux has updated linux-grsec (privilege escalation) and ocaml (information leak).

CentOS has updated kernel (C7: privilege escalation).

Debian has updated php5 (multiple vulnerabilities) and virtualbox (end of support).

Debian-LTS has updated ghostscript (multiple vulnerabilities).

Fedora has updated bind (F23: denial of service), bind99 (F23: denial of service), and libass (F24: three vulnerabilities).

Mageia has updated php (multiple vulnerabilities).

openSUSE has updated quagga (13.2: stack overrun) and virtualbox (13.2: multiple unspecified vulnerabilities).

Oracle has updated kernel (OL7: privilege escalation).

Red Hat has updated bind (RHEL6.2, 6.4, 6.5, 6.6, 6.7: denial of service).

Scientific Linux has updated kernel (SL7: privilege escalation).

SUSE has updated quagga (SLE12-SP1: stack overrun).

Ubuntu has updated linux-raspi2 (16.10: privilege escalation), mysql-5.5, mysql-5.7 (multiple unspecified vulnerabilities), and quagga (stack overrun).

[$] Dealing with automated SSH password-guessing

Monday 24th of October 2016 10:41:41 PM
Just about everyone who runs a Unix server on the internet uses SSH for remote access, and almost everyone who does that will be familiar with the log footprints of automated password-guessing bots. Although decently-secure passwords do much to harden a server against such attacks, the costs of dealing with the continual stream of failed logins can be considerable. There are ways to mitigate these costs.

Valgrind-3.12.0 is available

Monday 24th of October 2016 06:22:28 PM
Valgrind 3.12.0 has been released. "3.12.0 is a feature release with many improvements and the usual collection of bug fixes. This release adds support for POWER ISA 3.0, improves instruction set support on ARM32, ARM64 and MIPS, and provides support for the latest common components (kernel, gcc, glibc). There are many smaller refinements and new features. The release notes below give more details." There will be a Valgrind developer room at FOSDEM in Brussels, Belgium, on February 4, 2017. The call for participation is open until December 1.

Security advisories for Monday

Monday 24th of October 2016 05:20:17 PM

Arch Linux has updated chromium (multiple vulnerabilities), kernel (privilege escalation), linux-lts (privilege escalation), python-django (cross-site request forgery), and python2-django (cross-site request forgery).

CentOS has updated bind (C6; C5: denial of service) and bind97 (C5: denial of service).

Debian has updated kdepimlibs (HTML injection).

Debian-LTS has updated kdepimlibs (HTML injection).

Fedora has updated guile (F23: two vulnerabilities), kernel (F24; F23: privilege escalation), php (F24; F23: multiple vulnerabilities), and php-pecl-zip (F24; F23: multiple vulnerabilities).

Mageia has updated 389-ds-base (information disclosure), c-ares (code execution), guile (two vulnerabilities), openjpeg (denial of service), and php-ZendFramework (SQL injection).

openSUSE has updated Chromium (Leap42.1, 13.2: multiple vulnerabilities), dbus-1 (Leap42.1: code execution), gd (13.2: denial of service), kdump (Leap42.1: denial of service), php5 (13.2: three vulnerabilities), kernel (Leap42.1; 13.1: multiple vulnerabilities), tor (Leap42.1, 13.2: denial of service), and X (Leap42.1: multiple vulnerabilities).

Oracle has updated bind (OL6; OL5: denial of service), bind97 (OL5: multiple vulnerabilities), and kernel 4.1.12 (OL7; OL6: privilege escalation), kernel 3.8.13 (OL7; OL6: privilege escalation), kernel 2.6.39 (OL6; OL5: privilege escalation).

Red Hat has updated kernel (RHEL7: privilege escalation).

SUSE has updated Chromium (SPH for SLE12: multiple vulnerabilities), qemu (SLE12-SP1: multiple vulnerabilities), and kernel (SLE12-SP1; SLE12; SLE11-SP4; SLE11-SP3; SLE11-SP2: privilege escalation).

The Linux Foundation Technical Advisory Board election

Monday 24th of October 2016 02:36:01 PM
The Linux Foundation's Technical Advisory Board provides the development community (primarily the kernel development community) with a voice in the Foundation's decision-making process. Among other things, the TAB chair holds a seat on the Foundation's board of directors. The next TAB election will be held on November 2 at the Kernel Summit in Santa Fe, NM; five TAB members (½ of the total) will be selected there. The nomination process is open until voting begins; anybody interested in serving on the TAB is encouraged to throw their hat into the ring.

Kernel prepatch 4.9-rc2

Monday 24th of October 2016 01:08:12 AM
The second 4.9 prepatch is out for testing, and Linus is asking for people to test one feature in particular: "My favorite new feature that I called out in the rc1 announcement (the virtually mapped stacks) is possibly implicated in some crashes that Dave Jones has been trying to figure out, so if you want to be helpful and try to see if you can give more data, please make sure to enable CONFIG_VMAP_STACK."

More stable kernel updates

Saturday 22nd of October 2016 03:33:46 PM
The 4.8.4, 4.7.10, and 4.4.27 stable updates are out. These would appear to contain the usual fixes. Note that 4.7.10 is the end of the line for the 4.7.x series.

[$] Dirty COW and clean commit messages

Friday 21st of October 2016 05:08:07 PM
We live in an era of celebrity vulnerabilities; at the moment, an unpleasant kernel bug called "Dirty COW" (or CVE-2016-5195) is taking its turn on the runway. This one is more disconcerting than many due to its omnipresence and the ease with which it can be exploited. But there is also some unhappiness in the wider community about how this vulnerability has been handled by the kernel development community. It may well be time for the kernel project to rethink its approach to serious security problems.

Friday's security updates

Friday 21st of October 2016 02:50:26 PM

Debian-LTS has updated bind9 (denial of service).

Fedora has updated libgit2 (F23: two vulnerabilities).

Mageia has updated kernel (three vulnerabilities), libtiff (multiple vulnerabilities, two from 2015), and openslp (code execution).

openSUSE has updated dbus-1 (13.2: code execution), ghostscript-library (42.1: three vulnerabilities, one from 2013), roundcubemail (42.1: two vulnerabilities), and squidGuard (42.1: cross-site scripting from 2015).

Red Hat has updated bind (RHEL6&5: denial of service) and bind97 (RHEL5: denial of service).

Scientific Linux has updated bind (SL6&5: denial of service) and bind97 (SL5: denial of service).

Ubuntu has updated bind9 (12.04: denial of service).

More in Tux Machines

Linux Devices

Linux Graphics

Fedora News

  • The Bugs So Far Potentially Blocking The Fedora 25 Release
    Adam Williamson of the Fedora QA team has sent out a list of the bugs currently outstanding that could block the Fedora 25 release from happening on its current schedule should they not be fixed in time.
  • Updated Fedora 24 ISO Respins Now Available with Dirty COW-Patched Linux Kernel
    It looks like a new set of updated Live ISO images for the Fedora 24 GNU/Linux operating system were published by Ben Williams, founder of the Fedora Unity Project and a Fedora Ambassador. Dubbed F24-20161023, the updated Live ISOs a few days ago and include up-to-date components from the official Fedora 24 Linux software repositories, with which was fully syncronized as of October 23, 2016. Of course, this means that they also include the latest Linux kernel update fully patched against the "Dirty COW" bug.
  • PHP version 5.6.28RC1 and 7.0.13RC1
  • Flock Stories 2016, Episode 1: Redon Skikuli
    Flock Stories by Chris WardIf you were wondering where Flock 2018 might be, today’s guest Redon Skikuli might just have your answer! Redon is not just a Fedora community contributor, he’s a Fedora community creator. I ask Redon what he’s up to these days and why he thinks we should also consider joining future Flocks.

New KNOPPIX Release, LibreOffice 5.1.6, Rosa Down

In Linux news today KNOPPIX 7.7.1 was released to the public based on Debian with GNOME 3.22, KDE 5.7.2, and "Everything 3D." The Rosa project is experiencing network issues and folks may experience problems trying to connect to their services the next few days. LibreOffice 5.1.6 was announced today by The Document Foundation, the sixth update to the Still branch for stable users, and a new vulnerability was disclosed in GNU Tar. Read more