A busy week with big desktop, kernel, distro, Android, and gaming developments that directly affect how many of you run and secure your Linux systems.
Top Stories
-
GNOME 51 released with shell polish, app upgrades, and new wallpaper set — GNOME 51’s release notes highlight refinements to GNOME Shell (better screenshot selection, brightness saved across sessions), Mutter fixes (no more desaturated SDR on HDR displays, legacy NVIDIA dropped), and a cleaned-up Settings app, with Roundhex as the new default wallpaper. This matters to anyone on GNOME-based desktops (Ubuntu, Fedora, GNOME OS, rolling distros) because it’s the baseline they’ll be getting in Ubuntu 26.10 and Fedora 45, and it fixes real annoyances like edge-tiled fullscreen and broken German date formats.
-
Ubuntu completes switch to Rust coreutils (cp, mv, rm) in 26.10 — Canonical’s Ubuntu 26.10 release notes show that the final holdouts cp, mv, and rm now come from the Rust-based uutils coreutils, replacing GNU coreutils after audits that turned up 113 issues (44 CVEs) and delayed their inclusion in 26.04. Anyone administering Ubuntu desktops or servers should care because this is a major toolchain change in the default environment, with a coreutils-from-gnu package still available if you need strict GNU behavior.
-
Linux 7.3-rc4 and new stable/LTS kernels land — Kernel.org lists Linux 7.3-rc4 as of 2026-09-20 along with stable 7.2.6 and longterm updates 6.18.52, 6.12.110, 6.6.157, 6.1.188, 5.15.221, and 5.10.270, with Phoronix noting rc4’s fixes are “quite heavy and scattered” and increasingly found by AI tools. This affects distro maintainers and anyone tracking mainline or LTS kernels, as 7.3-rc4 pulls in important x86 and Btrfs fixes and 7.2.6/longterm updates are the right targets for production upgrades this week.
-
GrapheneOS calls out Google over Android 17 QPR1 patches and GPL delays — GrapheneOS argues that Google’s September 2026 Pixel bulletin contains standard platform security fixes that have not been shared via the regular Android Security Bulletin, meaning non-Pixel OEMs may not see them until Android 17 QPR2 in December, and also documents a two-week wait for GPL’d kernel sources for build CD1A.260905.001.A1. Anyone deploying or managing Android devices in mixed fleets should watch this because it implies a widening security gap between Pixels and other Androids, and a worrying pattern on timely disclosure and GPL compliance.
-
Trusting-trust style attack demonstrated against an entire Linux distribution via strip(1) — A new paper, surfaced on both HN and Lobsters, shows Ken Thompson’s “trusting trust” attack can be implemented via the strip utility, not just compilers, meaning compromised binutils could silently backdoor all binaries in a distro. This is a supply-chain red flag for distro maintainers and security-conscious operators, and reinforces the need for verified toolchains, reproducible builds, and minimal trusted binaries on build hosts.
Security Watch
-
Four new local Linux root vulns (DirtyAH6, PPPoEject, TUNderflow, DiagSpill) — Doyensec’s oss-security post details a “quartet of Linux local root vulns” with named exploits DirtyAH6, PPPoEject, TUNderflow, and DiagSpill, along with affected kernel code paths and mitigation status. These require local access but affect common networking and diagnostic subsystems, so distro maintainers and anyone running multi-user Linux boxes should track vendor errata and roll out fixed kernels promptly.
-
Open vSwitch “Fragnesia” skb use-after-free primitive — Doyensec also discloses “The skb that wasn’t freed – the Fragnesia primitive via Open vSwitch,” describing how crafted traffic can turn an skb lifetime bug into a powerful exploitation primitive. This is directly relevant to operators of virtualized/cloud networking using OVS, who should evaluate their kernel/OVS versions and apply the recommended patches or configuration hardening.
-
Linux Zoom client reads everything written to X11 clipboard — Simon Tatham shows the native Linux Zoom client “proactively reading everything written to X11 clipboard,” confirmed by multiple reports and covered on HN and Lobsters. Anyone running Zoom on an X11 desktop should assume clipboard contents are being continuously read and consider isolating Zoom in a separate account/VM, switching to Wayland where possible, or avoiding copying sensitive data while Zoom is running until the vendor ships and documents a fix.
Releases & Updates
-
Linux 7.3-rc4 announced by Linus Torvalds — Linus released 7.3-rc4 on 2026-09-20, describing the fixes as widespread but “nothing too scary,” with Phoronix noting many were found by AI/LLMs spot-checking code. This is the mainline that early adopters and distro integrators should be testing against before 7.3 goes final.
-
Linux 7.2.6 stable and multiple LTS kernels updated — Kernel.org lists 7.2.6 (stable, released 2026-09-14) with an accompanying ChangeLog-7.2.6, plus new longterm releases 6.18.52, 6.12.110, 6.6.157, 6.1.188, 5.15.221, and 5.10.270 on the same date. Production systems pinned to these branches should plan updates to pick up accumulated fixes, including security hardening.
-
GNOME OS switches to zswap to mitigate OOM issues — GNOME OS maintainers have enabled zswap by default and tuned OOM behavior to reduce out-of-memory crashes in low-RAM situations, alongside work on a Geary email-client fork. Anyone shipping GNOME-based desktop images for constrained hardware can look at GNOME OS’s zswap configuration as a reference.
-
Ubuntu 26.10 adopts Linux 7.3 and improves OOM behavior — Phoronix reports Ubuntu 26.10 “Stonking Stingray” will now ship with Linux 7.3 rather than 7.2, and a separate article details desktop OOM daemon tuning to behave more intelligently under memory pressure. This combination especially benefits workstation users on newer CPUs/GPUs and those running heavy workloads on modest RAM.
-
MX Linux 25.3 released — MX Linux 25.3 updates its Debian Stable-based Xfce, KDE Plasma, and Fluxbox editions, maintaining its goal of a “mid-weight” desktop with solid performance and a moderate footprint, as summarized by DistroWatch. Users on MX’s 25.x series should pick this up for current packages and integration polish, especially on older hardware.
-
Clonezilla Live 3.3.3-37 update — Clonezilla Live 3.3.3-37 remains a Debian-based live environment for partition/disk cloning, with DistroWatch noting it continues to clone a 5 GB system to 40 clients in about 10 minutes. Admins relying on Clonezilla for imaging should refresh sticks to this build to stay aligned with current kernel and userland support.
Worth Reading & Trying
-
How to bring up the Linux kernel on a new platform — WerWolv walks through the practical steps of porting Linux to a fresh hardware platform, from early boot and console to drivers, giving kernel tinkerers and embedded engineers a realistic bring-up roadmap beyond the textbook theory.
-
Kexec and Btrfs subvolumes for fast kernel testing — ArchCloudLabs demonstrates using kexec with Btrfs subvolumes to rapidly test new kernels, minimizing reboot downtime and offering clean rollback, which is useful for kernel hackers and distro packagers iterating on patches.
-
Dropping eBPF CPU cost by ~90% with memoization — Nathan Naveen explains how caching eBPF program results reduced CPU overhead by “about 90%” in a real system, a worthwhile read for performance-minded SREs making heavy use of eBPF-based observability.
-
Disaster recovery backups with rsync — This guide shows how to design DR-focused backup jobs around rsync, including rotation and remote copies, which is directly applicable to homelab and small-production Linux servers.
-
The terminal should not own the work — An opinionated piece arguing that long-running work should be decoupled from a particular terminal session, nudging CLI-heavy users toward better job supervision tools and patterns instead of living in a single fragile shell.
From LinuxBlog.io
- Linux server performance: Is disk I/O slowing your application? — Walks through using tools like top and iowait metrics to diagnose when disk I/O, not CPU, is the bottleneck on a Linux server, with specific guidance on what to look at before tuning.
Inviting you to share what you’re upgrading, testing, or worried about from this week’s news in the replies below so others can compare notes and approaches.
Our community remains free of banner ads thanks to our partnership with Better Stack.
Better Stack offers infrastructure observability services, uptime monitoring, logging, incident management, and a free tier worth checking out. Visit: betterstack.com