Brief items

Many old shim versions are still accepted by secure boot

The CMU CERT Coordination Center has put out an advisory that many exploitable versions of the shim binary, used to boot Linux on systems with UEFI secure boot enabled, were never added to the revocation list.

An attacker with administrative privileges or the ability to modify the boot process could use one of the vulnerable shim bootloaders to bypass Secure Boot protections and execute arbitrary code before the operating system loads. Code executed during this early boot phase may achieve persistent compromise of the platform, including the ability to load unsigned or malicious kernel components that can survive system reboots and, in some cases, operating system reinstallation.

The advisory contains a list of vulnerable shims.

Comments (6 posted)

Local DoS attack vectors in seunshare 3.10 (SUSE Security Team Blog)

The SUSE Security Team Blog has a post with an analysis of seunshare, which is used by SELinux to confine untrusted programs. During a review of version 3.10 of the program, the team identified two local Denial-of-Service (DoS) vectors.

Since seunshare is supposed to run on SELinux-enabled systems, it is important to understand what kind of privilege escalation can be achieved when vulnerabilities are exploited in a setuid-root binary like this. Many SELinux-enabled systems, such as Fedora and openSUSE, ship with the "targeted" SELinux policy by default. This policy is focused on confining well-known system services, but assigns an unconfined SELinux context to interactive users by default to achieve a balance between security and usability.

There is currently no domain transition from the unconfined domain to the more restricted seunshare_t defined in the SELinux policy for seunshare. This means the execution of seunshare continues in the unconfined domain. Thus in the context of attacks carried out by interactive users, the impact of the vulnerabilities below will be a root-like privilege escalation despite the system running in SELinux enforced mode.

See the post for the full write-up of the team's discoveries and timeline. The vulnerabilities have been fixed in version 3.11.

Comments (6 posted)

Security quote of the week

As for AI itself, the concentration of power and wealth in these tech companies is the greatest existential risk facing society today. This means we must limit corporate power, especially corporations' ability to exploit the public and manipulate our political system.

Opposing data centers should be just a starting point. We can advocate for states to regulate AI, to reject irresponsible uses of the technology, and shape corporate behavior. We can fight for AI computation to be taxed, so that the public can capture some of the profit of AI use while also forcing AI companies to internalize more of the energy and environmental consequences associated with its use. And we all can join the global movement for Public AI, an alternative ecosystem for AI that is developed under public control with an incentive structure to create public benefit rather than private profit.

— Bruce Schneier and Nathan E. Sanders

Comments (none posted)

Kernel release status

The current development kernel is 7.2-rc3, released on July 12. Linus said: "Things continue to look normal (the 'new normal' with slightly higher rates of commits, although I do get the feeling that we're seeing that slightly balanced out by people starting to go on summer vacation)".

This release has seen 14,229 non-merge changesets from 2,261 developers, 448 of whom were first-time kernel contributors. The release history looks like:

RC	Date	Commits
v7.2-rc1	2026-06-28	14395	14395
v7.2-rc2	2026-07-05	433	433
v7.2-rc3	2026-07-12	475	475

See the LWN KSDB v7.2 page for a lot more details.

Stable updates: none have been released in the last week.

Comments (none posted)

Call for topics for the 2026 Maintainers Summit

The Maintainers Summit is an annual, invitation-only gathering of kernel developers and maintainers to discuss development-process issues; see LWN's 2025 Maintainers Summit coverage for an example. The call for topics for the 2026 gathering (Prague, October 8) has gone out. One of the best ways to obtain an invitation to the Summit is with a good topic proposal. For best consideration, topics should be submitted before July 24.

Comments (none posted)

Quotes of the week

Thanks again for helping with NOMMU. I'd like to give you a medal, but you'll have to settle for an overstuffed inbox.

— Andrew Morton

I realize that some people really dislike AI, but this is an area where I'm willing to absolutely put my foot down as the top-level maintainer.

Linux is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it.

Or just walk away.

AI is a tool, just like other tools we use. And it's clearly a useful one.

— Linus Torvalds

Linus is doubling down on his bullshit because he's not having to deal with the AI slop basically :)

I agree with him that AI is useful when used sensibly and tastefully. That bit is fine and saying the kernel isn't anti-AI is fine.

But just a tool, come on man.

It's wreaking havoc on reviewers and maintainers because now dickheads can send a massive about of bullshit and maintainers don't scale to that.

I guess it's a tool in the same way a nuclear bomb is just a tool...

— Lorenzo Stoakes

Is there really no acceptable option beside forcing everybody to swallow the generative AI pill ? No option for people with ethics concern to be still considered part of the kernel community ? No option but complete surrender and pledging allegiance ? This is how I increasingly feel being treated, and I know I'm not alone.

— Laurent Pinchart

Comments (37 posted)

Final normal Debian bookworm release

Debian has announced the final normal update for Debian 12 ("bookworm"). Long-term-support updates will continue until 2028. As may be expected from a stable version, the update is mostly limited to security fixes. Still, it may be time for Debian users to look into upgrading to a more recent version. Conveniently, Debian 13 ("trixie") also received an update this weekend, with many of the same security fixes.

Comments (none posted)

Distributions quotes of the week

If you want to see copyleft software succeed, the best way to do that is contribute to make it better. Not to try to force or gatekeep users to using software that isn't best suited for them just because of the license --- that way only lies the death of our credibility.

— Ted Ts'o

Copyleft is not some magic spell that protects us from corporations. It's just a tool, which is useful in some situations and not in others.

But perhaps I'm wrong and copyleft is more important than I think it is. If so, you're going to have to find ways to recruit more people to work on copyleft software, and will probably need to fight political fights in broader society to reduce the currently substantial intrinsic legal advantages for other models.

Do you know what will not help in any way with that fight? "Come use our copyleft software; it's poor quality and we rarely write code, but we have lots of moralizing scolds who will lecture you on what software you should be using until you die of old age."

— Russ Allbery

Comments (10 posted)

Rust 1.97.0 released

Version 1.97.0 of the Rust programming language has been released. Changes include using a new symbol-mangling scheme by default, support for denying warnings in Cargo, and an end to the practice of hiding the linker's output after a successful build.

Comments (13 posted)

The Linux.org story

Rob Kennedy has posted the story of the birth of Linux.org — one of the earliest Linux-related web sites — and its more recent rebirth.

The site was founded in May 1994 by Michael McLagan, at a time when Linux itself was barely three years old. Linus Torvalds had only just released it to the world, there was no real way for a newcomer to find their footing, no search engines, no Wikipedia, none of the infrastructure people take for granted now for figuring out a new piece of technology. Michael built linux.org to fill that gap, a place for people to learn about Linux and follow the movement as it grew.

Comments (5 posted)