Tencent Zhuque Lab's Corvus AI system found a memory corruption bug in Linux's vhost subsystem that spans nearly a decade of kernels and breaks both the user/root and guest/host boundaries.
Citrix disclosed CVE-2026-88779, a SAML-triggered memory overflow in NetScaler ADC and Gateway, on October 4. CISA added it to the KEV catalog the same day and gave federal agencies until October 7 to mitigate.
Linux 7.3-rc7 shipped on October 12 with half the patch made up of selftests and an ext4 data=journal deprecation on board, keeping the stable release on track for October 18.
Linus Torvalds released Linux 7.3-rc5 on September 27, 2026, with an unusual diffstat where drivers account for less than a third of changes and selftests make up roughly a quarter.
Qualcomm used Snapdragon Summit 2026 to commit to official Debian and Ubuntu support on its X2-series ARM chips, with a working Debian build by year-end and Ubuntu certification on select laptops in early 2027.
CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, citing active exploitation and setting a tight federal patching deadline.
Canonical has moved Ubuntu 26.10 'Stonking Stingray' from the Linux 7.2 kernel to Linux 7.3, with the newer kernel now rolling into the beta archive ahead of schedule.
Security researcher Asim Manizada publicly disclosed four local root exploits, dubbed DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, affecting Linux kernel networking code for 10 to 21 years. Fixes have landed in stable branches, while on the same day, CISA cited active exploitation of three different Linux kernel CVEs.
The third release candidate for Linux kernel 7.3 has been deployed, featuring a substantial set of patches focused on file system integrity and hardware driver enhancements.
Grml 2026.09, the Debian-based rescue live system codenamed Hättiwaritätti, ships with Linux 7.1.8, exFAT boot support, and grml-live changes that drop 32-bit i386.
Linus Torvalds released Linux 7.3-rc1 after a two-week merge window containing 15,267 commits, the second-highest total in kernel history, pushing the codebase to nearly 41 million lines.
Maintainers say a third to half of the net-next patches for the Linux 7.3 development cycle appear to be low-priority AI-generated fixes.
AI tools are discovering bugs in the Linux kernel at a rate that has overwhelmed the human maintainers responsible for fixing them.
Linux kernel 7.2 officially released with cache-aware scheduling, USB4STREAM support, Apple M3 boot capability, RISC-V expansion, AMD ISP4 driver improvements, and NVIDIA Nova infrastructure
Canonical's August 13 Ubuntu HWE kernel release patches critical XFRM ESP-in-TCP logic flaws that enable local privilege escalation and container escape, alongside network stack hardening across the broader Linux ecosystem.
OpenAI has released a worldwide preview of its ChatGPT desktop application for Linux on August 11, 2026, adding x64 and ARM64 support via RPM and Debian packages while completing official native client coverage across all major operating systems.
Manjaro 26.1 "Bian-May" arrives with Linux 7.1, GNOME 50, KDE Plasma 6.7, and a hardware compatibility change that will catch some NVIDIA users off guard.
Linus Torvalds released Linux 7.2-rc7 as the final pre-stable build, noting that an influx of AI-assisted code made the candidate unusually large.
CVE-2026-64564, an 18-year-old use-after-free in the Linux kernel's SCTP code found by Tencent's AI-assisted research pipeline, enables local privilege escalation and container escape — and Debian shipped a patch the same day it was disclosed.
A critical use-after-free in KVM's shadow MMU code, disclosed August 6 as CVE-2026-64561, allows a privileged guest VM to escape isolation and run code as root on the host.
The Linux kernel 7.2-rc6 prepatch release contains 537 non-merge commits, the largest RC6 by volume in years according to Linus Torvalds.
Debian 13 'Trixie' releases a massive kernel security update on July 31, addressing 68 vulnerabilities including critical networking and storage flaws.
Linux gaming's Steam share rebounded to 4.01% in July 2026 after dipping to 3.69% in June, with SteamOS Holo leading all Linux distros at over 22% of the Linux breakdown.
Arch Linux ships kernel 7.1 by default for the first time in its August 2026 monthly ISO, bundling fresh system libraries, updated desktop profiles, and a refreshed installer to validate upstream changes before they hit the rolling channels.
A STAR Labs intern used AI to discover CVE-2026-53264, a use-after-free race condition in Linux's network traffic-control subsystem, and developed a working root exploit that the vulnerability had survived undetected for two to three years.
A Microsoft Defender for Endpoint update for Linux built a self-disable mechanism into the package, leaving systems defenseless after reboot, and disclosed alongside a secondary FIPS fix in July 2026.
Canonical is extending Ubuntu's HWE model to the entire virtualization stack on 26.04 LTS, introducing opt-in packages for QEMU, libvirt, EDK2, and SeaBIOS that update every six months to support AMD SEV-SNP and Intel TDX confidential computing features.
A fifth Linux Kernel 7.2 release candidate dropped July 26, 2026 with networking drivers absorbing over a third of the patches due to conference delays, though Linus Torvalds reported no alarming issues in the patch set.
Nebula Security disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw in futex priority-inheritance code that grants unprivileged users root access and container escape.
Linus Torvalds declared Linux is not an anti-AI project and told critics they can fork or leave, drawing a line under LLM code review tools like Sashiko amid a shift from his previous skepticism toward AI-driven kernel tooling.
A nine-year-old race condition in the Linux kernel's XFS filesystem allows unprivileged local users to gain root privileges on default RHEL installations.
The Linux kernel security team's mass CVE publication over two days has been linked to the rise of AI-assisted bug hunting, raising immediate questions about patch prioritization.
Collabora and Valve published the first preview of Holo Core — a from-scratch AArch64 port of Arch Linux for the upcoming Steam Frame VR headset, with sources, binaries, and CI infrastructure built specifically for the project.
After more than two decades of patent encumbrance, the final MPEG-4 Part 2 patent — held by Siemens AG in Brazil — expired on July 19, 2026, making the codec that powered DivX and Xvid free to use anywhere in the world.
Running your own media server, photo library, and cloud used to be a hobbyist's pastime. In 2026 it's starting to look like basic privacy hygiene.