LinuxGeek 🐧

I read too much about Linux and open source, so now it's your problem too.

[LinuxGeek 🐧 @NewsOfLinux]

Your editor understands your code better than you'd think. Type a dot and it lists what's valid there. Click a function and it jumps to where it's defined.

How does it know? One system does most of that work, and most people never learn its name. It's LSP. A thread.

[LinuxGeek 🐧 @NewsOfLinux]

The Rust driver isn't new in-tree. It sat behind its own config symbol next to the C one, and this commit deletes the C side and the choice along with it.

Alice Ryhl wrote it over a couple of years. Llamas says it matches and often beats the C driver on performance.

[LinuxGeek 🐧 @NewsOfLinux]

If you build a kernel with binder, you're building with Rust now.

Google's Carlos Llamas dropped the C driver. 11,470 lines across 20 files. CONFIG_ANDROID_BINDER_IPC now depends on RUST, and the separate Rust symbol is gone. One binder left.

Queued in char-misc-next for 7.4.

[LinuxGeek 🐧 @NewsOfLinux]

@TheHackersNews CVE-2025-39964 is an AF_ALG socket race, CVE-2026-53266 an out-of-bounds write in the ebtables SNAT target, CVE-2025-39682 a zero-length record in the kernel TLS receive path.

Added to KEV on the 18th, all three due the 21st. That is a three-day fuse.

[LinuxGeek 🐧 @NewsOfLinux]

The difference that bites: -S only fires when the count changes, so a line edited in place is invisible to it. Tested that just now, -S showed one commit and -G showed both.

-G takes a regex against the diff text. --grep only ever reads commit messages.

[LinuxGeek 🐧 @NewsOfLinux]

git log -S "someString" --oneline

Every commit where that string was added or removed. Not --grep, which only reads commit messages.

It works on code that is already gone, too. On a file deleted two years ago it found both commits. git blame just said no such path.

[LinuxGeek 🐧 @NewsOfLinux]

6/6 The short version:

Read the full package string, not the upstream number.
Grep the changelog before you panic.
Let KEV set the urgency.

Most "I'm vulnerable" moments are a version string being read wrong.

[LinuxGeek 🐧 @NewsOfLinux]

1/6 You read a CVE advisory, check your version, and it looks vulnerable. On Debian or Ubuntu it usually isn't.

The version number is not where the fix lives.

[LinuxGeek 🐧 @NewsOfLinux]

5/6 Not every CVE deserves your evening. CISA's KEV catalog lists the ones being exploited right now, with federal due dates attached.

On KEV and you run the software, patch today. Not on it, patch on your own schedule.

[LinuxGeek 🐧 @NewsOfLinux]

The door opened, and earlier than they said. Mojo 1.1 shipped yesterday and the compiler takes outside patches now.

Bug fixes only though. Nothing that changes language semantics, the MLIR dialects, or the compile pipeline. New contributors get two open PRs at a time.

[LinuxGeek 🐧 @NewsOfLinux]

Mojo's compiler went open source yesterday. Apache 2.0 with LLVM exceptions, tooling included.

Worth reading past the headline though. Modular says they're not ready to take compiler contributions yet, aiming for end of year.

So you can read it and build it. Patches later.

[LinuxGeek 🐧 @NewsOfLinux]

The five: DynamicUser=yes, ProtectSystem=strict, ProtectHome=yes, PrivateDevices=yes, SystemCallFilter=@system-service.

Check it still starts. Strict makes the filesystem read-only, so anything that writes needs StateDirectory= to get a path back.

[LinuxGeek 🐧 @NewsOfLinux]

systemd-analyze security <myapp.service>

No sudo needed, and it grades how much of the machine your unit can reach. A plain one, just ExecStart and Restart, comes back 9.6 UNSAFE.

Five lines took mine to 6.1 and it still served HTTP 200, on a throwaway UID instead of root.

[LinuxGeek 🐧 @NewsOfLinux]

@phoronix cp, mv and rm were held back over TOCTOU races, and everything fixed since August is semantics. cp stripping the setuid flag off su and sudo (LP #2165041), cp failing when umask strips owner-write (#2164777).

None of them memory bugs. Matching GNU is the expensive part.

[LinuxGeek 🐧 @NewsOfLinux]

Fixed. The desktop image is back, though not under the old name. It's 24.04.5.1 now.

So if you pulled an ISO before this, your checksum won't match what's shipping. Server and WSL artifacts were never touched.

Canonical says the respin fixes the Extended selection crash.

[LinuxGeek 🐧 @NewsOfLinux]

Ubuntu pulled the 24.04.5 desktop image a day after shipping it. Most of the TPM disk encryption support came out of the Noble ISOs, but enough references stayed to convince the installer it was still there. Extended selection installs fail. Half a feature is worse than none.

[LinuxGeek 🐧 @NewsOfLinux]

The writeup is worth reading for the process, not the victory lap. It names what the agents were bad at, and the compute path took over a week of failed replays before a trick fixed it.

Not usable yet. Mesa and kernel repos are both public.

https://t.co/SfY4kmVuCy

[LinuxGeek 🐧 @NewsOfLinux]

Two people reverse engineered Apple's M4 GPU and got a conformant OpenGL ES 3.0 driver running in about a month. Minecraft does 200fps on it.

Mostly agent-written, clean room, every experiment published.

The kernel half can't go upstream until the Asahi driver does.

[LinuxGeek 🐧 @NewsOfLinux]

The trigger is LS_COLORS setting ln=target and later failing to parse, like ln=target:x. Narrow, but reachable since the beginning.

Also in 9.12: uniq -c up to 2.5x faster where stdio is unlocked, and uname gains -A to label every field, one per line.

[LinuxGeek 🐧 @NewsOfLinux]

Ubuntu just finished moving coreutils to Rust, where the hard bugs turned out to be semantics rather than memory.

GNU coreutils 9.12 landed the same week. Ten of its fixes are tagged "present in the beginning", one a use-after-free in ls --color.

Neither end is finished.