Brief items

Vulnerabilities in various GTK-based PDF readers

Michael Catanzaro has disclosed a command-injection vulnerability affecting a number of GTK-based PDF readers; exploits included:

They contain a script for building malicious polyglot PDFs that are simultaneously both valid PDF files and also valid ELF binaries. When the user opens the PDF in the PDF viewer and clicks on a malicious link embedded in the PDF, the PDF abuses the command injection vulnerability to load itself as a GTK module using the `--gtk-module` command line flag. It can then execute arbitrary code via its library constructor. That flag was removed in GTK 4, which is why the vulnerability is much less serious for Papers than it is for Evince, Atril, and Xreader.

Comments (30 posted)

Stenberg: The pressure

Curl maintainer Daniel Stenberg writes about the stress of keeping up with the current flood of security reports.

This is a never-before seen or experienced pressure on the curl project and its security team members. An avalanche of high priority work that trumps all other things in the project that is primarily mental because we certainly could ignore them all if we wanted, but we feel a responsibility, we have a conscience and we are proud about our work. We feel obliged to fix security problems in the software we have helped shipped to every device on the globe. This is personal to us.

With about half the release cycle left until the pending release ships, we already have twelve confirmed vulnerabilities meaning twelve pending CVE announcements. That's a new project record and it also means we will reach thirty published CVEs in 2026 even before half the calendar year has passed. The projected total amount of curl CVEs published through the whole year is therefore at least double this number!

Comments (19 posted)

Security quote of the week

My takeaway from this incident: AI tools are going to find a lot of vulnerabilities in the short term. A human inspecting this code should have been able to find the command injection vulnerability, but that requires time and effort, so nobody did. Running an AI and telling it to inspect the code is much easier. We're probably in for a rough time in the short term. But in the long term, we are going to be much more secure than we were before, so this is good.

— Michael Catanzaro

Comments (1 posted)

Kernel release status

The current development kernel is 7.1-rc5, released on May 24. Quoth Linus:

I'm not entirely happy about it - most of this is totally trivial stuff to random drivers, which obviously makes it all less scary, but at the same time I'm really not convinced the churn is worth it at rc5 time. These things are "fixes", sure, but at the same time a lot of them are simply so irrelevant that I think they'd be better off in a linux-next tree and get merged during the merge window.

So I think I'll start being a bit more hardnosed about this kind of unnecessary churn this late in the game. We are supposed to look for *regressions*. Non-critical fixes to long-standing issues are simply not appropriate for this late in the release cycle.

End result: this is too big, and this is the heads-up that I'll be pushing back on pointless pull requests with fixes that just aren't that important. And yes, several of these series were triggered by AI code review.

This release has seen 14,943 non-merge changesets from 2,320 developers, 459 of whom were first-time kernel contributors. The release history looks like:

RC	Date	Commits
v7.1-rc1	2026-04-26	13963	13963
v7.1-rc2	2026-05-03	475	475
v7.1-rc3	2026-05-10	584	584
v7.1-rc4	2026-05-17	428	428
v7.1-rc5	2026-05-24	748	748

See the LWN KSDB v7.1 page for a lot more details.

Stable updates: 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174, 5.15.208, and 5.10.257 were all released on May 23.. The first four are huge (the 7.0.10 review version had 1,146 commits) while 6.1.174, 5.15.208, and 5.10.257 are small updates for the "Fragnesia" vulnerability.

Comments (none posted)

Andrew Morton's 2004 OLS keynote

I recently presented a brief tribute to Andrew Morton at the 2026 Linux Storage, Filesystem, Memory Management, and BPF Summit; it included a suggestion that reading (or re-reading) his 2004 Ottawa Linux Symposium keynote would be instructive. This talk, given immediately after the Kernel Summit session that decided to fundamentally change the kernel's development model, tells a lot about how the kernel project got to where it is today. The text of that speech was hosted on Groklaw, and has since been replaced by crypto spam, which is rather less useful. In the hopes of preserving this seminal moment, the transcript has been rescued thanks to the Wayback Machine and is presented here.

Full Story (comments: 2)

Quotes of the week

Maybe this is how things *should* be? Four weeks of enormous merge flurry then four weeks of diligently picking through it all, getting things mainline-worthy? After all, that's what Linus does, with different values of "four".

— Andrew Morton

I still haven't had time to look into the 6.6 regression, because [of] my day job (which is not ext4, but herding cats for an AI infrastructure project --- it's amazing how many fellow developers I met at LSF/MM are actually doing AI infrastructure projects for $WORK, and not kernel development as their primary job responsibilities.)

— Ted Ts'o

Comments (none posted)

OpenBSD 7.9 released

The OpenBSD 7.9 release is out, right on schedule. There is the usual long list of new features, including improved architecture support, CPU scheduling on heterogeneous systems, the ability to hibernate a suspended system after a configurable delay, socket splicing, a __pledge_open() system call giving special access to the C library, and much more. See the announcement and the full changelog for details.

Comments (none posted)

Arias: Human proof for FOSS contributions

Rodrigo Arias Mallo, maintainer of the Dillo web browser, has written a blog post with a proposal on one way to ensure that a contribution is written by a human and not AI; he suggests asking new contributors to record their programming session using asciinema.

In the same way that LLMs generate patches, they can also generate the asciinema recordings themselves. Then, the contributors can lie to the reviewers pretending to have made the edits. Perhaps surprisingly, this is not a easy task for LLMs, at least from my observations. The corpus of recordings of developers making mistakes and thinking the whole process of editing a file is not as large as the corpus of FOSS programs and patches in which to train an LLM. During my very simple tests I haven't been able to generate an asciinema session that remotely resembles what I would expect from a human, and even less so from a human with a nice editor theme and editing an existing Dillo source file.

The Dillo project is not yet requiring asciinema recordings, but he said that he would like to test the theory further. LWN covered asciinema in January 2026.

Comments (58 posted)

Comprehensive Response to Bambu's AGPLv3 Violations (Software Freedom Conservancy)

The Software Freedom Conservancy (SFC) published a news item on May 18 about its response to violations of the AGPLv3 by Bambu Lab in its 3D printers. The company has not provided the source code to its modifications to a 3D "slicer" program that was released under the AGPLv3 and it has also threatened Paweł Jarczak who created a fork of a different slicer (Orca Slicer) released under AGPLv3 in order to interoperate with his Bambu printer. Based on that, the SFC has created the baltobu project aimed at reverse-engineering and reimplementing the Bambu code while also hosting the Orca Slicer fork.

Bambu has behaved badly for years and made multiple, provably false public statements regarding the AGPLv3 and its requirements. The recent aggressive behavior toward Paweł Jarczak was a last straw for us: we have decided to launch a multi-pronged effort that will assist consumers and users in the short-term, and also work toward a long-term strategy to improve the software right to repair for all 3D printer consumers.

Comments (14 posted)

Interview session with Jonathan Corbet

The Linux Foundation will be hosting a live interview with LWN co-founder Jonathan Corbet. The event will take place on Tuesday, June 2 at 8:00AM Pacific daylight time (UTC-7). Registration is open for those who would like to attend.

Comments (3 posted)