TRÄW🤟

I click buttons for a living. Somehow it works. @sysxplore & @fswlinux

[TRÄW🤟 @thatstraw]

Just found out something neat by accident 😂
Turns out, if an IP address has a 0 in one of its octets (like 10.20.0.2), you can omit the zero and still reach the same host!

So 10.20.2 works the same as 10.20.0.2

[sysxplore @sysxplore]

Fedora 45's release notes promised a Rust keyring on every desktop. KDE users found it was never installed.

oo7 is a Rust implementation of the Secret Service, the API apps use to store passwords. Fedora 45 made it the default, replacing GNOME Keyring.

On Fedora Discussion this weekend, a user found oo7 missing from a fresh Fedora 45 KDE install, though the notes said it replaced "GNOME Keyring and KWallet." Docs contributor Flo called it "a mistake in the Release Notes" and opened a fix. Neal Gompa had deferred KDE in September "due to lacking time to deal with integration issues."

The bigger debate is trust. Change owner Fabio Valentini said the team is "not … enthused" about AI-assisted commits in oo7, but gnome-keyring "appears to be on its way to unmaintained / obsolete status."

Upstream, maintainer Bilal Elmoussaoui just declared oo7-daemon "officially stable" with release 0.7.

[sysxplore @sysxplore]

France's cybersecurity agency just posted a fix for a hole in Linux TCP authentication, and every 32-bit kernel built with MD5 signing is exposed.

TCP-MD5 (RFC 2385) is the old signature scheme that protects BGP sessions between routers. Its successor is TCP-AO.

Jérémy Jean of ANSSI posted the v2 fix to netdev on Saturday. With TCP_MD5SIG=y and TCP_AO=n, a packet carrying a junk AO option hits a stub that returns success, so a socket requiring MD5 accepts unauthenticated data. The reverse config has the same bug.

Eric Dumazet's review was blunt: an attacker able to hit the window of an MD5-protected session "can therefore inject RST or data with a junk AO option, which is exactly what RFC 2385 is supposed to prevent."

TCP-AO depends on 64BIT, so "every 32-bit kernel with TCP_MD5SIG=y is in the vulnerable configuration." The fix is tagged for stable, reviewed by Dumazet and Kuniyuki Iwashima.

[sysxplore @sysxplore]

So when is the Year of the Linux Desktop?

[TRÄW🤟 @thatstraw]

Reverse engineers worried about being reverse-engineered? 😅

[sysxplore @sysxplore]

Asahi Linux is moving everything from the MIT licence to GPLv2-or-later.

Asahi is the volunteer project that reverse-engineers Apple Silicon Macs so they can run Linux. In today's Linux 7.3 progress report, developer James Calligeros explains why: people have been using the permissive licence to take the team's work. "In some extreme cases, in-development feature code was being lifted straight out of our personal forks and published without attribution or lazily rewritten with LLM assistance to obfuscate its origin."

The report points to WINE, which switched from MIT to LGPL in 2002 for the same reason: "Those who do not learn from history are doomed to repeat it."

The same report brings real wins too. M3 Macs now install without the EXPERT flag, Thunderbolt support (USB3 and networking for now) is shipping to users, and the team got GTA IV and Fallout: New Vegas running outside the muvm VM using Google's per-process page size patches.

[ThePrimeagen @ThePrimeagen]

mit to gpl is funny

[sysxplore @sysxplore]

Firecracker was supposed to keep the guest in a box.

PWN researcher Paulos Yibelo just published PwnEscape Part 2. It takes CVE-2026-99999, a critical Linux IPv4 checksum bug (CVSS 9.3), and turns a host memory read/write primitive into code execution inside the Firecracker process on the host.

The bug isn't in Firecracker. It's in the host kernel's networking stack. The deferred checksum fields (csum_start / csum_offset) weren't validated before skb_checksum_help ran, so a guest could rewrite IPv4 header bytes the kernel had already parsed. Michael S. Tsirkin's upstream fix (commit 6785011f8b16) adds a check before checksum completion. Greg Kroah-Hartman's CVE note put it plainly: bad checksum metadata "can corrupt the network header and cause a bunch of mischief."

For the demo they ran Firecracker v1.16.1 as root with no jailer on host kernel 7.0.0-1011-aws. They hijacked the vCPU thread's saved registers on return from KVM_RUN and made the VMM write "N8V23M2" to its own stderr, then restored state so the VM stayed alive over SSH.

Kernels since 2.6.27 are affected. The fix is in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11. Patch the host kernel, because guest updates do nothing here, and use Firecracker's jailer in production.

[sysxplore @sysxplore]

Asahi Linux is moving everything from the MIT licence to GPLv2-or-later.

Asahi is the volunteer project that reverse-engineers Apple Silicon Macs so they can run Linux. In today's Linux 7.3 progress report, developer James Calligeros explains why: people have been using the permissive licence to take the team's work. "In some extreme cases, in-development feature code was being lifted straight out of our personal forks and published without attribution or lazily rewritten with LLM assistance to obfuscate its origin."

The report points to WINE, which switched from MIT to LGPL in 2002 for the same reason: "Those who do not learn from history are doomed to repeat it."

The same report brings real wins too. M3 Macs now install without the EXPERT flag, Thunderbolt support (USB3 and networking for now) is shipping to users, and the team got GTA IV and Fallout: New Vegas running outside the muvm VM using Google's per-process page size patches.

[sysxplore @sysxplore]

948 working paths to root — and the hard part is still the humans.

OpenAI’s Cyber team published “A thousand fewer paths to root”: an autonomous discovery → exploit → patch pipeline, run mid-October against a stock desktop kernel with an upcoming cyber model. Scout agents narrowed to ~2.8M LOC (~7% of the tree); analysts produced 2,308 candidates; 1,724 were dynamically reproduced; 948 distinct local privilege-escalation exploits landed, with candidate patches. API cost: $1,213,430 ($1,279 per LPE).

They report at least 10 novel exploitation techniques (details withheld). Within 10 days of the scan, maintainers and the wider community had already patched or staged 104 LPEs, with ~300 more in public discussion. Following kernel guidance, OpenAI started with critical reports via Patch the Planet partners.

Their takeaway for operators: “For the near and medium term, having access to a low-privileged account on an operating system that isn’t up-to-date on its latest available patches should be considered functionally equivalent to root access for a well-resourced threat actor.”

[sysxplore @sysxplore]

The definition has been Alpine SSH root password

[sysxplore @sysxplore]

She already knew the root password for SSH on Alpine

[sysxplore @sysxplore]

If you run Alpine, OpenWrt, or musl Docker images with SSH password auth still on, patch today.

Özgün Kültekin of Wakefield found that OpenSSH on musl Linux without PAM accepts any password of 257 to 1024 characters for accounts locked with a lone "*" in /etc/shadow. That covers key-only users and, on Alpine's official AWS and Azure images, the default user that has passwordless doas, so a long bogus password can become root.

OpenSSH developer Damien Miller shipped 10.6p2 a day after they learned of it:

"If you operate a Linux system that uses musl libc without PAM (Alpine Linux is one example) then stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY."

glibc distros, PAM setups, Dropbear, and OpenBSD are fine. Alpine is backporting the fix back to 3.16. No CVE ID yet; fixed version is OpenSSH 10.6p2.

[sysxplore @sysxplore]

This is a serious bug on Alpine Linux, OpenWrt or musl Docker images…if you type a password with 257 to 1024 characters you get root… yes any characters

[TRÄW🤟 @thatstraw]

@dantu_007 😅

[TRÄW🤟 @thatstraw]

Network engineers working at McDonals after AI too their jobs.😅

[sysxplore @sysxplore]

7 Books to Help You Master Linux

From your very first command to running production servers, these books will take you there:

1. First Steps With Linux
2. The Linux Command Line
3. Linux Pocket Guide
4. Linux Basics for Hackers
5. How Linux Works
6. UNIX and Linux System Administration Handbook
7. The Linux Programming Interface

Beginner to intermediate to advanced. Save this for your reading list and share it with a friend learning Linux.

[sysxplore @sysxplore]

What's the first Linux book you've read?

[sysxplore @sysxplore]

Caption this😅

[TRÄW🤟 @thatstraw]

The reboot is the hard part.
Everyone is telling you to disable MPTCP.
Most of them

[sysxplore @sysxplore]

openSUSE Leap 16.1 is out, and Leap Micro is gone. It's now just a mode you pick in the installer.

Leap is openSUSE's stable, community-built distro, made from the same sources as SUSE Linux Enterprise Server. Leap Micro was its separate immutable server edition, with a read-only root filesystem and snapshot-based updates you can roll back.

With 16.1, that becomes "Immutable Mode" in the Agama installer, and there will be no Leap Micro 6.3 or 7.0. Release manager Lubos Kocman: "The Leap Micro experience people relied on is still here, but now it shares the same release, the same life cycle and the same maintenance updates as the rest of Leap."

It's also the first Leap to ship the same day as its enterprise twin, SLES 16.1. Desktop users get KDE Plasma 6.6, LibreOffice 26.2 and GIMP 3.2 on a Linux 6.12 kernel. Annual minor releases are planned through Leap 16.6 in 2031.