Latest Linux and open source news from around the web

Docker Deep Dive Sponsored · View on Amazon → UNIX and Linux System Administration Handbook Sponsored · View on Amazon →
LWN.net

A critical GnuPG security update

There is a new GnuPG update for a "critical security bug" in recent GnuPG releases. A crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack buffer overflow in gpg-agent during the PKDECRYPT--kem=CMS handling. This can easily be used for a DoS but, worse, the memory corruption can very likley also be used to mount a remote code execution attack. The bug was introduced while changing an internal API to the FIPS required KEM API. Only versions 2.5.13 through 2.5.16 are affected.

Linux Journal

Official Firefox RPM Package Now Available for Fedora-Style Linux Distributions

by George Whittaker Mozilla has taken a notable step toward improving Firefox distribution on Linux. An official Firefox RPM package is now available directly from Mozilla for Fedora-style distributions, including Fedora, RHEL-compatible systems, and related derivatives. This move gives users a new, upstream-supported option for installing and maintaining Firefox without relying solely on distro-maintained builds. What’s Changed Until now, users on RPM-based systems typically installed Firefox through their distribution’s repositories. While those packages are usually well-maintained, they can sometimes lag behind Mozilla’s release schedule or include distro-specific patches. With the new official RPM, Mozilla provides: A Firefox build maintained directly by Mozilla Faster access to new releases and security updates A consistent Firefox experience across RPM-based distros Reduced dependency on downstream packaging delays This mirrors the approach Mozilla already uses for official DEB p

LWN.net

The GNU C Library is moving from Sourceware

GNU C Library maintainer Carlos O'Donell has announced that the project will be moving its core services away from Sourceware in favor of services hosted at the Linux Foundation. While it was clear to the GNU Toolchain leadership that requirements were coming to improve the toolchain cyber-security posture, these requirements were not clear to all project developers. As part of receiving this feedback we have worked to document and define a secure development policy for glibc and at a higher level the GNU Toolchain. While Sourceware has started making some critical technical changes, the GNU Toolchain still faces serious, systemic concerns about securing a global, highly available service and building a sustainable, diverse sponsorship model. This has been a long-running discussion; see this 2022 article for some background.

Phoronix

New Intel Linux Driver Workaround Halves Initial Game Load Time For MHW

In addition to Mesa 26.1 today seeing Vulkan present timing support finally merged to help reduce game stuttering and separately another long-in-development Mesa merge request for DG2 / Meteor Lake to improve performance as much as 260% in some scenarios, there is another merge today to Mesa Git for enhancing Intel graphics on Linux. For Intel Linux gamers the newest Mesa code adds a new DriConf workaround that is capable of halving the initial game load time for at least one problematic game title...

LWN.net

[$] Implicit arguments for BPF kfuncs

The kernel's "kfunc" mechanism is a way of exporting kernel functions so that they can be called directly from BPF programs. There are over 300 kfuncs in current kernels, ranging in functionality from string processing (bpf_strnlen()) to custom schedulers (scx_bpf_kick_cpu()) and beyond. Sometimes these kfuncs need access to context information that is not directly available to BPF programs, and which thus cannot be passed in as arguments. The implicit arguments patch set from Ihor Solodrai is the latest attempt to solve this problem.