A busy week for Linux brought a critical APT vulnerability fix, major kernel and distro updates, Asahi Linux’s licensing pivot over AI code laundering, and early signs of Epic and GOG finally treating Linux as a first-class gaming platform.
Debian/Ubuntu APT MITM flaw (CVE-2026-109518) fixed in coordinated updates — Debian’s security team detailed a man-in-the-middle arbitrary code execution flaw in APT where resumed HTTP downloads could be replaced with attacker-controlled packages, assigning CVE-2026-109518 and shipping fixed versions including APT 3.0.4 for trixie and 2.6.2 for bookworm. Anyone running Debian, Ubuntu, or derivatives that use APT needs to ensure they’ve pulled in the updated apt package, since the bug allows “arbitrary code execution as root” during package upgrades over untrusted networks.
Asahi Linux moves from MIT to GPLv2-or-later to fight AI-driven code laundering — In its November progress report Asahi Linux announced it is relicensing all of its repositories, including the m1n1 boot and GPU drivers, to GPLv2-or-later after discovering “multiple attempts to exploit its permissive licensing to hijack its work,” including AI-assisted rewrites of in-development code aimed at “aggressively monetising Linux on Apple Silicon.” This affects any project consuming Asahi’s code (notably BSDs and alternative Apple Silicon distros) and signals that kernel-adjacent hardware enablement work may increasingly prefer strong copyleft to limit closed, AI-laundered forks.
Linux 7.4-rc2 lands with FAT32 speedups and AMD “PerfOpt” refinements — Linus Torvalds tagged Linux 7.4-rc2 on 2026-11-08, and as Phoronix notes this brings further FAT32 performance optimization plus tweaks to AMD’s new “PerfOpt” iGPU boosting code while also fixing BHI mitigation selection and rolling in many x86 and sound subsystem fixes. Kernel testers, distro maintainers and performance-sensitive users should expect 7.4 to deliver faster build times, big FAT32 throughput gains (Phoronix reports earlier patches yielding up to 265x improvements), and more out-of-the-box AMD integrated GPU performance for graphics and AI workloads.
Fedora 45 released with GNOME 51, Plasma 6.7 and Linux 7.2 — After two schedule slips Fedora 45 shipped on 2026-11-03 with GNOME 51, Plasma 6.7, kernel 7.2, a switch of the virtual consoles to kmscon, and a QR-code powered DRM Panic frontend that links users to a web page explaining kernel panics and pre-filling Bugzilla reports. Fedora workstation and server users get better laptop hardware support (e.g., ASUS ROG Strix G16, Lenovo battery charge limits), a more debuggable panic flow, and a modernized console stack, keeping Fedora at the bleeding edge of the mainstream desktop distros.
Asahi Linux progress: Linux 7.3 upstreaming and Apple Silicon gaming improvements — Asahi’s new status report, covered by Phoronix, outlines code they’ve upstreamed for Linux 7.3 and recent work to improve gaming on Apple Silicon, including Mesa driver work and better performance in titles running via Linux. Anyone using or targeting Apple M1–M5 hardware with Linux should read this as both a capabilities update and a reminder that more of Asahi’s stack is now living in mainline kernels.
Man-in-the-middle code execution in Debian/Ubuntu APT (CVE-2026-109518) — Debian’s advisory explains that APT versions prior to the fixed 3.0.4 (trixie) and 2.6.2 (bookworm) could, when resuming an interrupted HTTP download, accept attacker-supplied data as if it passed signature verification, leading to “arbitrary code execution as root” during package install; updated apt packages are now available and should be installed immediately on Debian and Ubuntu systems. This affects any environment using HTTP mirrors or operating on untrusted networks, and hardens one of the core parts of the Debian/Ubuntu supply chain.
Alpine Linux: OpenSSH password authentication bypass incident — Alpine Linux detailed that its GitLab instance was probed using CVE-2026-97229 against OpenSSH-server, an issue described in the advisory as a “password authentication bypass,” but their logs show only “unsuccessful authentication attempts,” and they’ve since patched affected packages and rotated credentials just in case. Alpine users should ensure they’re running the updated OpenSSH packages noted in the 2026-11-05 post and note that even failed exploit attempts can leak telemetry about your infrastructure.
TCP use-after-free kernel bug CVE-2026-98432 reaches 9.8 CVSS — Atlas’ technical write-up, popular on HN, describes a Linux IPv4 TCP use-after-free that allows a remote attacker to achieve kernel RCE, with a CVSS score of 9.8 and proof-of-concept exploitation; the article notes fixes have landed in stable series like 7.2, 7.3 and LTS branches. Admins should verify their distro kernels include the backported fix mentioned in their vendor advisories (e.g., kernel.org lists 7.3.3, 6.18.62 and other LTS point releases dated 2026-11-06) and prioritize rolling those out on Internet-facing hosts.
Linux 7.3.3 stable and 7.4-rc2 mainline published — kernel.org now lists 7.3.3 (released 2026-11-06) as the latest stable with an accompanying ChangeLog-7.3.3, plus fresh LTS bumps 6.18.62, 6.12.116, 6.6.162, 6.1.192, 5.15.225 and 5.10.274, while 7.4-rc2 became the current mainline snapshot on 2026-11-09. Anyone maintaining custom kernels or staging distro updates should pull these for the latest security and bug fixes and test against their workloads.
kitty 0.50 brings session restore, docked windows and Wayland touch support — The GPU-accelerated kitty terminal’s 0.50 release can now “restore OS windows, tabs, and windows with their scrollback” after logout when restore_session_after_logout is enabled, introduces docked windows/tabs for status bars or file trees, adds cursor-trail shaders like cursor-trail-pixiedust, and supports touchscreen tap/scroll/select on Wayland. Terminal-heavy users on Linux and macOS, especially Wayland and tiling WM users, get a much more capable terminal that remembers layouts and integrates better with touch-capable laptops.
Ghostty 1.4 overhauls rendering and tightens Linux support — Hashimoto’s Ghostty terminal 1.4, with “over 170 contributors and 2,800+ commits,” now requires GTK 4.18 and libadwaita 1.7 on Linux, rebuilds the GTK renderer with triple buffering for less tearing and sharp fractional scaling, adds drag-and-drop for split windows across tabs, compresses scrollback to cut memory usage by “70% to 90%,” and implements the full Kitty graphics protocol. Linux desktop users on rolling distros (Arch, NixOS, openSUSE, Ubuntu 26.04 etc.) can try the new builds now, but Ubuntu 24.04 LTS and other older stacks will need to stick to older Ghostty releases or build from source.
Heroes of Might and Magic II engine fheroes2 1.1.18 released — The free reimplementation of HoMM2, fheroes2, shipped version 1.1.18 after what the project calls “a very long delay and endless waiting,” delivering another round of engine compatibility and gameplay improvements. Linux players who own the original game assets can update to get the latest fixes and continue enjoying a native, modernized take on the classic.
NVIDIA 620.70.06 stable driver for Linux — NVIDIA’s new 620.70.06 release is now the “latest stable recommended driver,” targeting Linux gamers and workstation users on supported GPUs. If you rely on proprietary NVIDIA drivers, especially for gaming or CUDA/AI work, this is the build you’ll want to validate against your current kernel and X/Wayland stack.
Asahi Linux progress report for Linux 7.3: upstreaming and gaming — Asahi’s own post (also the source for the licensing move) details which Apple Silicon support patches made it into Linux 7.3, improvements to their Mesa GPU stack and what that means for real-world gaming performance on M-series Macs under Linux. If you’re considering an Apple Silicon machine as a Linux dev or gaming box, this report sets expectations around hardware support and where work is still concentrated.
“From Linux to Wikipedia: How Volunteers Build the Internet” — This MIT Press Reader piece, widely shared on HN and Lobsters, traces how volunteer communities built foundational layers like the Linux kernel and Wikipedia, and includes the observation that “without Linux, Apache, and MySQL, the early web would have looked very different.” It’s a thoughtful long read for anyone interested in the social and governance side of the stack we all run in production.
Ubuntu 26.04’s Rust sudo incompatibilities explained — Chris Siebenmann walks through how Ubuntu’s Rust-based sudo replacement (sudo-rs) in 26.04 differs from traditional sudo, including config handling and path expectations, and explicitly notes that “Ubuntu’s Rust sudo is not compatible with standard sudo” in several behaviors. Admins managing mixed fleets or deploying automation scripts should read this before assuming sudo-rs behaves identically to classic sudo across distros.
Making musl and proprietary NVIDIA drivers work together on Chimera Linux — Chimera Linux’s developers describe how they got NVIDIA’s proprietary driver stack running on a musl-based distro, including the glue needed around glibc expectations and binary interfaces. It’s a useful case study for anyone eyeing non-glibc userlands but still needing closed-source drivers or third-party binaries.
syscall.sh: refreshed Linux system call reference and API — A Show HN that resonated with kernel and systems folks, syscall.sh is a modern Linux syscall browser with multiple architectures, kernel selector and an accompanying JSON API at https://api.syscall.sh. It’s a handy tool for low-level developers, security engineers, and educators who often need to look up syscall numbers, prototypes or per-arch differences.
Home Lab Beginners Guide: Hardware (2026) — Updated on 2026-11-03, this guide walks through the author’s 12U rack as of March 2026 and covers concrete hardware choices and tradeoffs for building a home lab, with the memorable framing “a place where you can fail in the privacy of your own home.”
Finding Linux Compatible Printers — Published 2026-11-02, this article lists specific printer models and brands known to “seamlessly integrate with Linux operating systems” and links to compatibility resources so you can buy hardware that won’t fight CUPS on day one.
Join the conversation in the replies below with what you’re testing, upgrading, or worried about from this week’s news.
Our community remains free of banner ads thanks to our partnership with Better Stack.
Better Stack offers infrastructure observability services, uptime monitoring, logging, incident management, and a free tier worth checking out. Visit: betterstack.com