Brief items

Domas: Bypassing memory protection with AMD's memory controllers

Christopher Domas has published a proof of concept with a description showing how to use AMD memory controllers' bank swizzle mode to bypass memory protection and read or write arbitrary data, including CPU microcode definitions and memory belonging to the platform security processor. Among other things, this allows code running at the kernel level to directly manipulate the meaning of processor instructions, potentially bypassing other security measures such as memory encryption and virtual machine isolation.

This is not, strictly, unexpected behavior: it is documented in AMD's manual (on page 113 of that PDF). But the fact that it can be used to access arbitrary memory and thereby rewrite supposedly immutable parts of the computer's firmware without crashing the host machine seems like an unintentional side-effect of the design. Fortunately, since enabling bank swizzle mode requires kernel-level privileges, the vulnerability is not an immediate problem for most software. Still, it seems likely that this technique will end up being used for nefarious purposes eventually.

Comments (9 posted)

Kernel release status

The 7.2 kernel is out, released on August 16. Linus said:

Well, this last week of the release was - once again - bigger than I would have wished for, but hey, with the whole "new normal" thing, if I delayed releases for that reason we'd probably never have a release at all.

Significant features in this release include common attributes support in the bpf() system call, cache-aware load balancing for the CPU scheduler, large-folio support in the Btrfs filesystem, further swap subsystem improvements, improvements to the Landlock security module, support for block devices with inline encryption hardware via the dm-inlinecrypt device-mapper target, and much more. See the LWN merge window summaries (part 1, part 2) and the KernelNewbies 7.2 page for more information.

This release has seen 16,418 non-merge changesets from 2,652 developers, 613 of whom were first-time kernel contributors. The release history looks like:

RC	Date	Commits
v7.2-rc1	2026-06-28	14395	14395
v7.2-rc2	2026-07-05	433	433
v7.2-rc3	2026-07-12	475	475
v7.2-rc4	2026-07-19	557	557
v7.2-rc5	2026-07-26	611	611
v7.2-rc6	2026-08-02	615	615
v7.2-rc7	2026-08-09	500	500
(final)	2026-08-16	247	247

See the LWN KSDB v7.2 page for a lot more details.

Stable updates: 7.1.9, 6.18.45, 6.12.104, 6.6.152, 6.1.183, 5.15.216, and 5.10.265 were released on August 19.

Comments (none posted)

Kernel quote of the week

I hate, with the passion of a thousand suns, the pain that LLMs are causing to me and most open source projects right now, BUT I can NOT ignore that they have created, at giant expense, a fuzzy-tool that lies 1/3 of the time while finding and fixing real security bugs. This tool is nothing that anyone will actually pay the real money for, BUT I will begrudgingly deal with it now, to take from their resources in order to make Linux better.

Just like I used these tools recently to find and fix real bugs in rsync over the past months, they can be used to improve the infrastructure we all depend on for making our ecosystems work. And I can point out, there are "semi sane" ways of using them, locally, that circumvent a portion of the atrocities that LLMs cause today (but not all, I agree.)

I have banned their use for some sections of Linux that I maintain, as they make no sense to use there, BUT again, it is a tool, much like a fuzzer, that can be exploited by us to make our software better.

— Greg Kroah-Hartman

Comments (4 posted)

Firefox 154.0 released

Version 154.0 of the Firefox browser has been released. Changes include extending local network access protections to WebSocket connections, more flexible, per-site configuration of cookie and data clearing, and more.

Comments (6 posted)

GNU poke 5.0 released

Version 5.0 of GNU Poke, a binary-data editor, has been released. This release includes a number of improvements to the Poke compiler, additions to the Poke language, as well as runtime and standard library updates. See below for the full list of changes.

Full Story (comments: none)

Go 1.27 released

Go 1.27, the most recent version of the Go programming language, has been released with a number of new tools, the addition of support for the ML-DSA post-quantum algorithm, new JSON-processing packages, language updates, and more.

Comments (1 posted)

Python packaging council candidates announced

The Python Software Foundation (PSF) has announced the candidates running for the Python packaging council that was approved by the Python steering council in April.

This inaugural election fills all five seats on the PPC. The two candidates receiving the highest number of votes shall be designated Cohort A with a two year term, and the three candidates receiving the next highest number of votes shall be designated Cohort B with a one year term.

In future elections, each cohort will be elected for a full two-year term in alternating years, so that roughly half of the PPC turns over each cycle.

There are 17 candidates running for the five open seats. PSF voting-eligible members must affirm their intention to vote in this election by August 25. Voting begins on September 1, and ends on September 15.

Comments (none posted)

rsync 3.5.0 released

Version 3.5.0 of rsync has been released with a huge number of security fixes:

This release fixes 33 security issues found during a focused audit of rsync's path handling and daemon protocol, a companion daemon-protocol fuzzing pass, and reports from external researchers -⁠-⁠ plus several robustness hardenings. CVE IDs were assigned by VulnCheck (CNA); the precise "introduced in" version ranges accompany each advisory, and many are much narrower than "everything before 3.5.0". Every fix ships with a regression test in the test suite that fails on the unfixed tree.

Comments (45 posted)

Tuba 0.11 released

Version 0.11 of the Tuba fediverse client has been released. Notable changes in this release include support for Mastodon collections and quotes, ability to create custom thumbnails for attachments, a new emoji picker, a build for Android, as well as many other enhancements.

Comments (none posted)

Mark J. Wielaard receives Distinguished Service Award in Software Freedom

The Software Freedom Conservancy has announced that Mark J. Wielaard has been honored with the second annual Distinguished Service Award in Software Freedom for his many years of service to software freedom.

Mark is one of many key FOSS developers who has designed his career so that his employers have funded much of his FOSS work. Nevertheless, Mark continues his volunteer work after hours as a key contributor who maintains Sourceware — the oldest FOSS collaboration and developer infrastructure hosting site in history.

In addition to his work on Sourceware, Wielaard is a member of the DWARF Debugging Standard Committee, the maintainer for Valgrind and elfutils, as well as a contributor to various other GNU projects.

Comments (1 posted)