Topic
Kernel & Security
Kernel changes, operating-system security, vulnerabilities, hardening, and the tradeoffs behind them.
TCP MD5 for BGP authentication is thirty years old. TCP-AO is the replacement. Nobody has migrated.
RFC 5925 (TCP Authentication Option) has been in the Linux kernel since 6.7 and is supported by FRR, BIRD, and OpenBGPD. The RFC 2385 TCP MD5 Signature hack has been authenticating BGP sessions since 1996. Two years after the kernel got a working alternative, most operators are still on the old thing.
The listen queue had been five since 2014
Nine years of incrementing connection drops, masked by retry logic added in 2017 and promptly forgotten. The counter was in netstat -s. The backlog was in ss -tlnp. Both said the same thing for nine years.
prctl: the per-process security levers worth knowing
PR_SET_NO_NEW_PRIVS prevents exec from granting new privileges regardless of the binary's setuid bits. PR_SET_DUMPABLE locks /proc/PID from outside readers. PR_SET_PDEATHSIG cleans up orphans when a supervisor dies. Three prctl calls that belong in every daemon that drops privileges.
An ARM engineer let an AI generate hideous code and found a 70% speedup in the Linux kernel build
Lorenzo Stoakes at ARM used an LLM to profile the Linux kernel build system. The generated code was, by his own description, hideous. The bottlenecks it surfaced were real. Patches targeting Linux 7.4 cut allmodconfig build times by 36% and incremental builds by 70%.
memfd_secret: memory the kernel itself cannot read
mlock keeps secrets out of swap. memfd_secret goes further by removing the pages from the kernel's direct map entirely. No kernel module, no ptrace, no /proc/kcore can reach them. The tax is TLB pressure, which is why some distros ship it disabled.
Ubuntu 26.10 finishes what 26.04 started: GNU coreutils is now opt-in
cp, mv, and rm were the last GNU holdouts on Ubuntu. Ubuntu 26.10 ships uutils at 100%, making GNU coreutils optional for the first time on a major distro. An independent audit of uutils found 113 issues and 41 CVEs. Nearly all were fixed before the code landed.
Two years after PKfail, most affected hardware is still booting on a compromised Secure Boot key
In July 2024, Binarly found AMI's development Platform Key in production UEFI firmware across hundreds of devices. The private key is publicly accessible. Secure Boot's trust hierarchy has a root, and on the affected systems, it is cracked open.
cups-browsed held UDP 631 open to the world. Two years after the CVEs, the architecture finally changed.
CVE-2024-47176 let a crafted UDP packet steer cups-browsed into fetching attacker-controlled IPP data and executing arbitrary commands. The patches came fast. The architectural fixes, dropping PPD files and splitting the discovery daemon out of the core, landed in CUPS 3.x.
seccomp-bpf: syscall filtering without pledge
OpenBSD has pledge. Linux has seccomp-bpf. One is three lines of C. The other is a BPF program you write by hand, with architecture checks, and argument masks, and a libseccomp wrapper to keep you from making it worse. Here is how to use it correctly.
bcachefs has been in the kernel for three years. Is it your production filesystem yet?
Kent Overstreet's B-tree copy-on-write filesystem merged into Linux 6.7 in January 2024. Three kernel years of real distributions, real upgrades, real user reports. Here is an honest accounting of where it stands.
getrandom(2) without the syscall: what Linux 6.11 finally shipped
Linux 6.11 added getrandom(2) to the vDSO. The kernel shares RNG state with userspace, ChaCha20 runs in the process, and the syscall disappears from hot paths. BSD got here in the 1990s.
pledge(2) and unveil(2): what OpenBSD figured out that Linux is still catching up to
OpenBSD shipped two syscalls in 2016 and 2018 that let any unprivileged daemon sandbox itself down to exactly the filesystem paths and syscall categories it needs. Linux got there eventually, with seccomp-bpf in 2012, Landlock in 2021, and namespaces throughout. Compare and decide which one you'd rather write.
FreeBSD 14.5 ships: forty-three advisories patched, inotify in base
FreeBSD 14.5-RELEASE landed September 8. The security backlog is real and addressed. SA-26:08 is the advisory that should drive upgrades, not the inotify headline.
Eighteen years of wrong arithmetic in fragment reassembly: CVE-2026-80590
An undersized socket buffer in __ip6_append_data() since Linux 2.6.27 lets an unprivileged container process corrupt the host kernel and get root. Public PoC is out. Eight stable kernels have the fix.
Linux 7.2.4, 6.18.50, 6.12.109: SMACK had a use-after-free
Three stable kernels dropped September 7 with roughly 1,650 commits. UAF fixes concentrated in MediaTek's mt76 Wi-Fi 7 driver and SMACK, a Linux Security Module, which is a sentence worth sitting with.
fanotify(7): watch and block file opens at the VFS layer
fanotify has been in the kernel since 2.6.36 and is how file integrity monitors and endpoint-detection daemons actually hook into the VFS. Unlike inotify, it hands you an open fd to the accessed file and can block opens before the calling process gets control. Here is the API and a working example.
SplitSSHell: a comma in a cert principal has been root in OpenSSH since 2011
CVE-2026-35414 put a 15-year-old logic bug in OpenSSH's certificate principal matching code back on the advisory circuit. If you run cert auth with authorized_keys cert-authority entries, you needed 10.3 in April. You probably didn't get it.
userfaultfd(2): handle your own page faults from userspace
userfaultfd() has been in the kernel since 4.3 and is how CRIU implements post-copy live migration. A dedicated thread holds a file descriptor that wakes on page faults in a registered memory range; it responds with UFFDIO_COPY to inject page content before the faulting thread resumes. Here is the actual API and a working example.
Seven kernel LTS releases drop with USB/IPsec fixes and AI in the commit log
Greg Kroah-Hartman pushed seven stable kernel releases this week covering 5.10.269 through 7.1.13, with use-after-free and IPsec out-of-bounds fixes backported across every active branch. The more interesting thing is what showed up in the commit metadata. Rod has thoughts about that.
futex(2): the syscall your mutex is too polite to mention
pthread_mutex_lock is a polite wrapper over a brutal two-operation kernel interface. Here is how futex(2) actually works, how to build a correct mutex with it, and why FUTEX_REQUEUE exists to prevent pthread_cond_broadcast from being a thundering herd.
glibc 2.44 enables FORTIFY_SOURCE=3 by default and your struct tricks are now fatal
glibc 2.44 shipped last week with FORTIFY_SOURCE=3 on by default for GCC 12+ builds. It catches real buffer overflows. It also catches thirty years of creative struct-boundary memcpy that technically worked until it didn't. Here is what changed and what is now crashing.
The process that wouldn't die
kill -9 is supposed to be final. You send it, the process is gone. Then one morning you send it and nothing happens, and you send it again, and the process is still sitting there in ps, and you have to go rebuild an assumption you've had for twenty years.
SO_REUSEPORT: each worker gets its own accept queue, and then the migration problem hits
Linux 3.9 added SO_REUSEPORT. Bind N sockets to the same address:port, the kernel hashes connections across them. Linux 4.5 added eBPF dispatch so you control the routing. The part nobody explains is what happens when one of those sockets disappears while connections are in flight.
FreeBSD 14.5-RC1 has a sound ioctl UAF and a hardware counter that ignored your credentials
FreeBSD 14.5-RC1 dropped August 29 with three security fixes. The use-after-free in SNDCTL_DSP_SYNCSTART is local privilege escalation. The HWPMC credential-transition bug is subtler and more interesting. Here is what they fixed and why the HWPMC one matters more than it sounds.
The conntrack table was full
Connections to services behind our firewall started failing intermittently. The iptables rules were correct, the NICs were clean, the routing was fine. The problem was a kernel table we had never configured, silently dropping packets when it ran out of room.
SCM_RIGHTS: send an open file descriptor to another process over a Unix socket
You can pass a live, open file descriptor to another process via Unix domain socket ancillary data. Not a path, not a number — the actual kernel file description, with whatever offset and flags it already has. The mechanism is POSIX, predates Linux, and almost nobody uses it directly.
Linux 7.3-rc1 dropped Saturday. One thousand two hundred and fifty memory management patches.
Linus tagged 7.3-rc1 on August 30 after a two-week merge window. The highlights are 1,250 MM patches, a 21-commit NTFS3 security overhaul that also adds Alternative Data Streams, Rust on PowerPC, and a KVM restructure. Here is the triage.
splice and tee: zero-copy data movement, 2.6.17 edition
splice(2) and tee(2) have been in Linux since 2006. They move data through the kernel page cache without a userspace copy. How to use them for log fanout, network sends, and pipeline work that does not belong in the era of read/write loops.
The xz backdoor was 28 months ago. Here is what the supply chain security scoreboard actually reads.
March 2024 was supposed to be the wake-up call that fixed open source supply chain security. It is August 2026. Here is the honest accounting of what improved, what did not, and why the underlying economics that made the attack possible have not fundamentally changed.
openat2: enforce path resolution constraints at the syscall level
Linux 5.6 added openat2(), a superset of openat that lets you express RESOLVE_BENEATH, RESOLVE_NO_SYMLINKS, and RESOLVE_IN_ROOT as kernel-enforced constraints. No chroot, no CAP_SYS_CHROOT, no userspace reimplementation of path canonicalization.
You can write a CPU scheduler in BPF now. Most of you shouldn't. Some of you really should.
sched_ext merged into Linux 6.12 and it's in your distro's kernel if you're running anything recent. You can load a custom CPU scheduler as a BPF program at runtime, no kernel recompile, with a verifier and a watchdog that catches you when you screw it up. This is either the most irresponsible feature in recent kernel history or a genuinely correct architectural decision. I've landed on the latter.
landlock: sandbox your process without root
Since Linux 5.13, landlock lets an unprivileged process restrict its own filesystem and network access using three new syscalls. No SELinux policy, no AppArmor profile, no root. Chrome uses it for renderer isolation. Here is how to wire it up.
Your vulnerability scanner quietly switched sources. The NVD isn't the primary feed anymore.
NVD fell behind on CVE enrichment in 2024 and the scanner toolchain migrated to OSV-format data without making a press release about it. If your patching workflow assumes NVD is still the single source of truth, it's running on an outdated mental model.
memfd_create and file sealing: an anonymous file nobody can modify (including you)
memfd_create() gives you a file descriptor backed by anonymous memory, with no filesystem, no path, no name. Add F_SEAL_WRITE and the kernel refuses all future write access. Pass it across process boundaries via SCM_RIGHTS or pidfd_getfd. It's the right way to share immutable data between processes.
OpenSSL 3.0 EOL is two weeks out. If you pinned it, that's your problem now.
OpenSSL 3.0 LTS hits end-of-life on September 7, 2026. Five years of LTS support ends, security patches end, and every system still pinned to 3.0 starts the clock on unpatched CVEs. The upgrade path exists. Use it.
io_uring: why Jens Axboe's ring buffer is annoying to disagree with
io_uring landed in Linux 5.1 with a deceptively simple idea, two lock-free ring buffers shared between kernel and userspace. No syscall per operation. Zero copy. You can hate how many CVEs it's generated and still use it correctly. Here's the model.
Six years of WireGuard in the Linux kernel. I was wrong to be skeptical.
WireGuard landed in Linux 5.6 in April 2020. Six years later, it's in every major OS, every cloud provider's toolbox, and the cryptography audit held. The 4,000-line kernel module that was supposed to be too opinionated turned out to be the right kind of opinionated.
Your process doesn't need 400 syscalls. seccomp-BPF lets you say so.
seccomp-BPF loads a classic BPF filter into the kernel that runs on every syscall your process makes. Give it a whitelist, everything else gets EPERM or SIGKILL. Here's how the filter model works, how libseccomp makes it tolerable, and how to audit what a real binary actually needs.
iptables is a shim now. The shim has edge cases. Rewrite your rules.
Debian 13 Trixie completed the transition; iptables the binary now calls the nftables backend across every major Linux distro. The legacy xt_* kernel path still exists, but it's not the default and it's on the removal list. Twelve years after nftables landed, the ecosystem caught up.
ftrace has been on your machine since 2.6.27. Here's how to actually use it.
ftrace is Linux's built-in kernel function tracer, accessible directly via /sys/kernel/debug/tracing/. No compiler, no LLVM, no kernel headers: write to files, read call graphs. Here's the workflow for function tracing, call-graph timing, IRQ latency, and isolated trace instances.
`sudo` wrote its last heap overflow in C. The Rust rewrite shipped.
sudo-rs is production-ready for most deployments. A setuid-root binary sitting at uid 0, accumulating privilege-escalation CVEs for four decades, is exactly the right target for a memory-safe rewrite. This one is hard to argue with.
`getrandom()` skips the kernel now. Took long enough.
Linux 6.11 shipped vDSO support for getrandom(). Every TLS handshake, UUID, and ephemeral key in your system is now getting random bytes from userspace without a syscall trap. The syscall was added in 2014. The optimization arrived a decade later. The implementation is correct. Both things are true.
The OOM killer was doing its job
A slow memory leak ran undetected for five weeks because the kernel's out-of-memory killer, executing its heuristic correctly, kept choosing the monitoring agent over the leaking service. The pager never fired. The monitoring gaps were there in the data the whole time.
ps lies about memory. /proc/smaps_rollup does not.
RSS from ps aux double-counts shared pages and makes every process look more expensive than it is. PSS from /proc/PID/smaps_rollup gives you actual per-process memory ownership. Here is how to read it.
ss -i shows you what netstat never could: TCP internals live
Everyone knows ss -tulnp. Almost nobody uses ss -i, which surfaces congestion window size, RTT, retransmit counts, and send/receive buffer fill, directly from the kernel, no tool required.
nohup, disown, setsid: what each actually does and which one you want
Three tools for keeping a process alive after you close the terminal. They do not do the same thing. Here is the kernel-level difference, and when each one applies.
Linux 7.2 ships. The AI noise finally cleared the kernel's basement.
Linux 7.2 stable lands today with cache-aware scheduling, MGLRU gains that doubled MongoDB throughput in benchmarks, and a pile of driver removals nobody asked for, except the LLMs, who wouldn't stop filing bugs about them.
bpftrace gives Linux what FreeBSD had in 2005. The one-liners are worth the wait.
dtrace showed up on Solaris in 2004, shipped in FreeBSD 7 in 2008, and Linux users spent the next decade pretending strace was sufficient. bpftrace is the real answer, doing dynamic kernel tracing, histograms, stack walks, zero overhead when idle.
FreeBSD 16 evicted the last GPL tenant from base. The kernel has thoughts.
FreeBSD replaced dialog with bsddialog and declared its base system GPL-free. Then someone looked at the kernel. Thirty years of license hygiene, and it ends with "oops, still some in there."
Your kernel ships a CPU profiler. perf(1) is the key.
perf stat hands you hardware performance counters (cycles, cache misses, branch mispredictions) in seconds. perf record samples call stacks at full speed. Both are already installed and beat any SaaS APM for understanding CPU-bound problems.
Your container is six clone(2) flags. nsenter gets you back in.
Containers are six kernel namespaces and nothing else. nsenter gets you inside from the host without docker exec, without touching the image, and without whatever tooling the vendor decided to ship.
Rust in the Linux kernel is not failing. I need to update my priors.
When Linus merged Rust support in 6.1, I gave it eighteen months before the borrow-checker arguments turned into flame wars and the whole experiment got ripped out. Real drivers are shipping. I was wrong about the trajectory.
pledge() turns 10. Linux still doesn't have anything half as clean.
OpenBSD's pledge(2) landed in 5.9 in 2016. Ten years later, Linux has Landlock (good) and seccomp-bpf (powerful and painful) and still nothing that lets a process sandbox itself in a single readable line. RodHat on why API simplicity is a security property.
systemd wants to replace sudo. I hate that they're not wrong about why.
run0 has been in systemd 256+ for over two years now and distros are starting to actually ship it. The scope creep argument is real. The security critique of sudo is also real. Holding both is annoying.
Unprivileged eBPF is getting locked out by default. It's five years overdue.
The Linux kernel project is landing a config change that makes kernel.unprivileged_bpf_disabled permanent by default. RodHat on why unprivileged BPF was always an attack surface in a trenchcoat, and why your bpftrace workflow is fine.
Upgrade like you can undo it, because with bectl you can
A ZFS boot environment is a bootable clone of your root dataset. Make one before every upgrade and a wrecked kernel becomes a reboot, not a recovery-media evening. The bectl walk, and the loader trick that saves you when the new one won't boot.
The scary FreeBSD advisory this week isn't an RCE; it's a privilege check that slipped
FreeBSD-SA-26:53.ktrace is a regression in how ktrace is gated inside jails. No dramatic exploit, just an isolation boundary that quietly stopped meaning what you thought it meant.
"We'll just stay on LTS" stopped being a strategy when LTS became two years
Linux kernel long-term support dropped from six years to two, and the reason given was honest: almost nobody was testing the old branches. Stability was never a property of the version number. It was a property of somebody doing the work.
io_uring keeps producing the same class of CVE and it's time to call that structural
Another batch of privilege-escalation bugs in io_uring dropped this week. RodHat explains why the design keeps generating the same vuln class, and what to actually do about it in your container environments.
OpenSSH is finally done pretending your 2009 SSH config was acceptable
The OpenSSH project continues ripping out legacy cryptography: DSA keys gone, SHA-1 gone, post-quantum key exchange on by default. RodHat runs through what breaks and what you should have burned years ago anyway.
CISA wants a body count on your malloc() calls. They're not entirely wrong.
Federal agencies are now demanding memory-safety roadmaps from software vendors. RodHat runs through what the mandate gets right, what it gets delusional, and what happens when bureaucrats discover that C is load-bearing.
Another wave of typosquat packages hit a major registry, and the fix everyone proposes still won't ship
The same typosquatting attack pattern, the same registry, the same 'we should really fix this' thread. RodHat's seen this loop enough times to name it.
Everything is a critical CVE now, which means nothing is
CVSS score inflation has gotten bad enough that a 9.8 barely raises RodHat's eyebrow anymore. That's the actual crisis.
Get a real disk latency histogram in one line of bpftrace
iostat gives you an average, and averages hide the tail that's actually hurting you. A four-line bpftrace program prints a log2 histogram of block I/O latency per device, live, on a production box, with no agent and no restart.
The hard part of Rust in the kernel was never the Rust
The compiler works. The bindings work. The drivers work. What nearly stalled the whole effort was thirty years of maintainer culture meeting a rule about who has to maintain what, and that's a governance problem no language solves.
Find out which syscall is actually eating your latency with one dtrace one-liner
A real dtrace/bpftrace one-liner for finding the syscall responsible for tail latency, plus why strace -T won't get you there.
Charging extra for SSO is charging extra for not getting breached
Single sign-on sits behind the enterprise tier at a suspicious number of vendors, at a markup that has nothing to do with what it costs to implement. It's not a feature. It's the control you need to offboard someone the day you fire them.