Agreguesi i feed

Version:7.1.13 (EOL) (stable) Released:2026-09-02 Source:linux-7.1.13.tar.xz PGP Signature:linux-7.1.13.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-7.1.13

Version:6.18.49 (longterm) Released:2026-09-02 Source:linux-6.18.49.tar.xz PGP Signature:linux-6.18.49.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.18.49

Version:6.12.108 (longterm) Released:2026-09-02 Source:linux-6.12.108.tar.xz PGP Signature:linux-6.12.108.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.12.108

Version:6.6.156 (longterm) Released:2026-09-02 Source:linux-6.6.156.tar.xz PGP Signature:linux-6.6.156.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.6.156

Version:6.1.187 (longterm) Released:2026-09-02 Source:linux-6.1.187.tar.xz PGP Signature:linux-6.1.187.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-6.1.187

Version:5.15.220 (longterm) Released:2026-09-02 Source:linux-5.15.220.tar.xz PGP Signature:linux-5.15.220.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-5.15.220

Version:5.10.269 (longterm) Released:2026-09-02 Source:linux-5.10.269.tar.xz PGP Signature:linux-5.10.269.tar.sign Patch:full (incremental) ChangeLog:ChangeLog-5.10.269

A version 2 Linux kernel patch posted on August 31 fixes a stack overflow in the SA2UL hardware crypto driver. The Kernel Address Sanitizer, or KASAN, detected a one-byte write past a local buffer while strongSwan’s charon-systemd process was configuring an IPsec transform.

RxRPC is a Linux kernel transport for remote procedure calls. A teardown race reported in August shows that its network namespace cleanup can still reach a peer after that peer has been freed. The failure was caught by the Kernel Address Sanitizer, or KASAN, during automated testing.

A version 2 Linux kernel patch series posted on August 31 proposes a new eBPF security interface for applying Landlock policy during program execution. The 15-patch set introduces generic Linux Security Module policy objects, lets privileged BPF programs retain those objects in maps, and adds a helper that can apply a selected policy during exec processing.

Once again, GNOME is considering participating in the Outreachy internship program. Outreachy provides internships to people subject to systemic bias and impacted by under-representation in the tech industry where they live.

Outreachy internships are funded by the participating communities. While the GNOME Foundation has not yet finalized the budget for this cohort, having a strong list of proposed projects and available mentors helps the Board decide how many slots to fund.

Project ideas will be selected based on available funding and their relevance to the overall goals of the GNOME project. Project selection will be handled by Matthias Clasen, Allan Day, and Sri Ramkrishna.

If you are a GNOME developer/maintainer available for mentoring between December 2026 and March 2027, please submit a project proposal at gitlab.gnome.org/Teams/internship/project-ideas as soon as possible (by September 11).

If you have any questions, you can contact the Internship Committee on Matrix or ask on Discourse.

An anonymous reader quotes a report from Ars Technica: President Trump yesterday demanded that the Federal Communications Commission punish or rebuke an NBC journalist for saying he has "mixed results" in his election endorsements. In the latest example of how Trump is using the FCC to harass reporters and news organizations that he dislikes, he said Meet the Press host Kristen Welker "will be reported to the FCC for rebuke or punishment" for what he claimed was a "purposeful inaccuracy." "Kristen Welker, the Unpopular 'Hostess' of the once great Meet the Press, now considered Meet the Fake Press, just stated that Donald Trump has 'mixed results' on his Endorsements of Candidates, when the recent WINS of Darline Graham and Mike Mazzei, stand at 100% for the U.S. Senate, and 98% for the U.S. House, recently and over the longterm. How can anyone be allowed to say this, working for freely given Public Airwaves? Results are attached. Because of this purposeful inaccuracy, she will be reported to the FCC for rebuke or punishment," Trump wrote in a Truth Social post. A separate post from Trump yesterday said, "THE FAKE POLLS USED BY OUR CROOKED MEDIA ARE OUT OF CONTROL, AND SOMETHING MUST BE DONE ABOUT IT. FCC TO THE RESCUE! President DJT." Trump also posted a rant on Friday about New York Times journalist Maggie Haberman, calling her "an unattractive person both inside and out" who "should be forced to turn over any and all money that she's made through her fake reporting on me." Trump referred to Haberman throughout his post as "Maggot Haberman." Trump's post about Welker included an image purporting to show he has near-perfect results in his endorsements this year. "The Press is a Disgrace to our Nation, and I hope that Chairman Brendan Carr, and the fine people of his Commission, will take this Threat to our Country very seriously," Trump wrote. Perhaps indicating that he will refer additional journalists for FCC punishment, Trump wrote that Welker "is not the only one. The Radical Left News is going out of their way to harass, demean, and libel anything 'TRUMP.'" The FCC website says the commission "cannot prevent the broadcast of any particular point of view," and that it "generally will not intervene" in complaints about "one-sided news reports" because "it would be inconsistent with the First Amendment to replace the journalistic judgment of licensees with our own." As noted by Ars, FCC Chairman Brendan Carr has "made it clear he takes orders from Trump, abandoning his previous position -- which he held under Democratic presidents -- that the FCC must operate independently of White House interference." Carr could use the commission's regulatory authority over licensed broadcasters to open an investigation into Welker, potentially creating pressure on NBC and its affiliated stations through licensing proceedings or other FCC actions. The most likely vehicle would be the FCC's rarely enforced news distortion policy, which Carr has repeatedly revived to target coverage he considers misleading; historically, however, the policy required an unusually high evidentiary bar and was seldom enforced.

Read more of this story at Slashdot.

The FTC and 22 state attorneys general are suing Amazon, accusing the company of secretly inflating advertising prices through undisclosed changes to its auction system that may have extracted more than $20 billion from advertisers since 2019. "Amazon has millions of advertising customers who were misled into paying significantly higher prices," FTC Chairman Andrew Ferguson said in a statement. "These higher costs were largely passed on to American consumers." CNBC reports: The complaint, which was filed in U.S. District Court for the Western District of Washington, centers on Amazon's sponsored products ads, brands ads and display ads that run alongside search results on its sprawling webstore. Amazon has amassed the third-largest digital advertising business globally, trailing only Google and Meta. The company hauled in more than $68 billion in ads revenue last year, with the lion's share coming from sales of sponsored products ads. Third-party sellers who hawk their wares on Amazon's marketplace have recently criticized surging advertising costs on the site, including a string of recent policy changes, which led to some top merchants withholding their ad spend in a boycott. The company has traditionally used a "second-price" auction system, wherein it told advertisers they "only pay the least bid amount needed in order to win," the complaint states, citing Amazon's own marketing materials. The FTC alleges in its complaint that Amazon in 2019 changed its auction rules without notice by adding an undisclosed surcharge it referred to as a "soft reserve price," which led to higher ad prices. "Amazon made this surreptitious change to its auction because it was unhappy about how much revenue its advertising auctions were generating," the agency said in its complaint, which cites internal communications between Amazon ad executives. In one exchange, a company executive allegedly acknowledged it uses an "invented auction participant" to increase prices, the FTC said. The FTC and the states alleged Amazon's practices violate federal and state consumer protection laws, and they're seeking civil penalties, restitution and other unspecified damages. In a blog post, Amazon called the FTC's lawsuit "misguided" and said the complaint "fundamentally misunderstands how advertisers operate." The company added that the agency's lawsuit doesn't include evidence of consumer price increases. "We've provided advertisers with guidance about our auctions and pricing in the main tools they use to manage their campaigns, and we continue to update that guidance," the company said. "We look forward to making our case in court."

Read more of this story at Slashdot.

According to The Information (paywalled), Apple reportedly moved up the release of new Mac mini and Mac Studio models after unexpectedly strong enterprise demand for Macs capable of running AI workloads. MacRumors reports: Apple normally releases new Mac models in the autumn, closer to October or November, making this week's announcement unusually early, falling just before the anticipated arrival of new iPhone models. The Information says that the AI-driven boom in Mac Studio and Mac mini sales is behind the early launch. Apple noticeably promoted the ability to link multiple Mac Studios together into a single, more capable system for running large frontier AI models, a feature aimed at business and developer customers rather than everyday consumers. Apple highlighted the Mac mini and Mac Studio's shift toward business buyers in June, with a "Business at the Park" event involving executives from major companies Ford, Disney, and Anthropic. The Mac mini was said to be the "darling" of the event. Even so, enterprise's rush toward powerful desktop Macs more broadly took Apple by surprise. The company reportedly did not possess an engineering team dedicated to business customers or staff focused on developer relations, and lacked an enterprise AI strategy. Businesses that approached Apple asking to buy access to the company's Private Cloud Compute infrastructure were reportedly turned down. Apple is instead leaning on partners such as WebAI and Mount Thor, which provide AI tools and execution environments built on Apple hardware.

Read more of this story at Slashdot.

Broadcom is launching "TrueSource," an effort to curate and secure open-source components used with its Tanzu platform, including Spring, RabbitMQ, and libraries across Java, Python, and Node.js. "The idea is to provide a set of solutions focused on providing clean and secure artefacts," Purnima Padmanabhan, vice president of Broadcom's Tanzu Division, told The Register. "We choose and build every Spring library, databases, other Java components," she said. The Register reports: Padmanabhan said that promise means VMware will also provide "TrueSource trusted artifacts" for code that is not part of Spring, including the wider Java ecosystem, Python, and Node.js. "Broadcom's curation process ensures that the libraries conform to a reference architecture and are supportable by the maintainers of record," according to a company statement. "Thousands of engineers across Broadcom's software divisions scan, fix, contribute to, and consume them every day." A VMware spokesperson told The Register the Broadcom business unit "will work with and support maintainers on open source software and we will provide fixes to open source upstream for any active projects." "With Spring and RabbitMQ, we are the maintainers. For other open source software, we will work with the maintainers. We believe that the community maintainers must remain the source of truth," the spokesperson said. This is just the sort of contribution that the open-source community wants vendors to do to reflect the value they extract from software they did not create alone. It's also the sort of thing vendors sometimes conclude they need to do to keep products based on FOSS viable.

Read more of this story at Slashdot.

An eBPF security system can produce precise Linux telemetry while leaving a harder question unanswered: what happens if the eBPF layer itself is misconfigured, vulnerable, or trusted too broadly?

Linux interrupt maintainer Thomas Gleixner traced a Kernel Address Sanitizer report to incomplete regmap IRQ cleanup on Aug 30, 2026. The crash appeared while Linux was taking a CPU offline, but the stale pointer was created earlier when a device’s interrupt setup failed.

Jonghyuk Kim submitted a Linux Direct Rendering Manager scheduler patch series on Aug 28, 2026 that targets a use-after-free read shared by several GPU drivers. The proposed change caches a fence’s timeline name while its scheduler is still alive.

Kalshi has issued its first-ever lifetime ban to former U.S. Rep. George Santos after concluding he failed to fully cooperate with an insider-trading investigation. He is also being fined $71,356, according to a filing (PDF) on its website. Engadget reports: It was reported in June that Santos was under investigation from the Department of Justice (DOJ) and the Commodity Futures Trading Commission (CFTC) over insider trading. Prediction markets like Kalshi allow users to buy contracts or shares in the outcome of events. Participants don't necessarily have to wait for an event to resolve before selling these contracts and cashing in. Santos allegedly bought contracts on Kalshi indicating that he would not attend this year's State of the Union speech after weather disrupted his travel plans. According to the CFTC, Santos then sold those contracts for a profit after claiming on social media that he would be in attendance. The former congressman is said to have made more than $17,500 through this scheme, which Kalshi reportedly detected and flagged to authorities. In July, Santos agreed to pay over $35,000 to settle the CFTC's claims against him. The agency also issued him a three-year trading ban. Kalshi, however, doesn't plan to allow Santos back on its platform in 2029 (or anytime after that). The company confirmed to The Wall Street Journal this was the first time it had given anyone a lifetime ban and that it did so because Santos didn't fully cooperate with its investigation. He can appeal the decision to the CTFC.

Read more of this story at Slashdot.

It’s hard to evaluate the security of open source projects when security bug reports remain private forever. Users deserve to see security bug reports, so please remember to unset issue report confidentiality when you’re done handling an issue. There are very few good reasons to keep an issue report confidential forever. If you’re not planning to disclose the issue report within the next few months, it should probably already already be public.

For GNOME, I disclose issues whenever a merge request has been created or a fix lands in the git repo, or 30 days after the issue was reported, whichever comes first. Your project might prefer to wait until the fix is released before disclosing, especially if you fear that a vulnerability might actually be exploited during the window between the fix and release. Whatever you choose, please don’t forget about it and leave the issue report confidential forever. That’s not fair to your project’s users. Even if not many people will take the time to look, users should at least have a chance to see reported issues.