linux

3 posts with the tag “linux”

Three Linux Kernel Flaws Are Being Exploited Now — Patch by Monday

Sep 20, 2026

Christopher Shaun Godwin

Author

Three Linux Kernel Flaws Are Being Exploited Now — Patch by Monday

CISA added three Linux kernel flaws to its Known Exploited Vulnerabilities catalog on September 18, 2026 (CISA KEV, 2026). All three are under active exploitation (The Hacker News, 2026). Federal civilian agencies must remediate by September 21 under Binding Operational Directive 26-04 (TechTimes, 2026). The deadline applies to the whole industry in practice. These are kernel bugs with public exploits, and they sit under nearly every Linux workload you run.

The three flaws

CVE	CVSS	Subsystem	What it does
CVE-2025-39682	9.8	kTLS receive path	Zero-length record bypasses record-type handling, corrupting TLS processing (CyberSecurityNews, 2026)
CVE-2026-53266	8.8	ebtables SNAT	Out-of-bounds write in packet filtering, local privilege escalation (SecurityOnline, 2026)
CVE-2025-39964	7.8	AF_ALG	Race condition corrupts crypto results or crashes the system (CyberSecurityNews, 2026)

Red Hat updated its advisories for all three on September 19, 2026 and acknowledged active exploitation. It rated them high risk with known public exploits and told customers to patch with high priority (The Hacker News, 2026; Red Hat, 2026).

CVE-2025-39682: the critical kTLS bug

CVE-2025-39682 is a critical improper-condition check in the kernel’s software TLS receive path (CyberSecurityNews, 2026). Software TLS lives in net/tls/tls_sw.c. An application enables it by setting TCP_ULP to "tls" on a TCP socket (TechTimes, 2026).

The flaw is a corner case. A zero-length record pulled from the receive list bypasses the normal record-type handling in recvmsg(). Later TLS records then get processed with wrong zero-copy and queueing assumptions (CyberSecurityNews, 2026).

The exposure window is wide. A public proof-of-concept has circulated since September 2025, so vulnerable hosts may have faced exploitation attempts for up to a year before the KEV addition (TechTimes, 2026). Affected versions span Linux 6.0 through 6.16.3, plus release candidates 6.17-rc1 and 6.17-rc2 (TechTimes, 2026).

The fix is a code change in tls_sw_recvmsg() that handles the zero-length record case. There is no configuration-only workaround. Disabling kTLS entirely is the only mitigation short of patching (TechTimes, 2026).

CVE-2026-53266: out-of-bounds write in ebtables

CVE-2026-53266 is a high-severity out-of-bounds write in the netfilter bridge ebtables SNAT target (CyberSecurityNews, 2026). It lets a local attacker escalate to root (SecurityOnline, 2026).

The bug sits in the Address Resolution Protocol rewrite path. During an optional sender hardware-address rewrite, the kernel can call skb_store_bits() without confirming the destination range is writable. If the data lives in a nonlinear socket-buffer fragment backed by a splice-imported file page, the write lands directly in the underlying page (CyberSecurityNews, 2026).

The upstream fix adds skb_ensure_writable() to the ebt_snat path, forcing the buffer to be writable before the copy (TechTimes, 2026).

CVE-2025-39964: the AF_ALG race

CVE-2025-39964 is a race condition in AF_ALG, the kernel interface that exposes cryptographic operations to userspace through socket file descriptors (TechTimes, 2026). The data path allowed two concurrent writers on the same socket. Request payloads from separate threads interleave unpredictably inside the kernel’s crypto processing queue, leaving the per-socket context inconsistent (SecurityOnline, 2026). The result is corrupted cryptographic output or a denial of service (CyberSecurityNews, 2026).

The fix adds exclusive write ownership. Only one writer may call sendmsg() on the socket at a time (CyberSecurityNews, 2026).

Watch the scope, not just the score. The flaw carries a CVSS of 7.8, but it affects kernels from 2.6.38 through 6.16.9 and 6.17-rc6. That is a much older and broader exposure surface than the score suggests (TechTimes, 2026).

Patch, reboot, then triage

All three fixes require a kernel update followed by a system reboot. None of them has a configuration-only fix (TechTimes, 2026). Plan the reboot window now, because the calendar is short.

BOD 26-04 adds a step the old directive never required. Agencies must determine whether a system was already compromised before the patch arrived. Forensic triage is now part of the remediation, not an afterthought (TechTimes, 2026).

CISA has not published how the three flaws are being exploited in the wild, or whether they form a single attack chain (The Hacker News, 2026). Treat that gap as a reason to move faster, not slower.

Your checklist

Inventory kernel versions. Run uname -r on every fleet, then compare against the affected ranges for each CVE (TechTimes, 2026). Legacy distro kernels are the most likely to miss the fixes.
Apply vendor updates. CISA directs affected organizations to apply vendor mitigations under BOD 26-04 (CyberSecurityNews, 2026). Red Hat, Canonical, SUSE, and Debian each shipped or are shipping kernel errata.
Reboot after the update. No fix takes effect without a reboot. Schedule rolling reboots so no workload stays on a vulnerable kernel past September 21 (TechTimes, 2026).
Prioritize kTLS hosts. CVE-2025-39682 is the critical one, and its proof-of-concept is a year old. Multi-tenant hosts and anything that terminates TLS in-kernel get patched first (TechTimes, 2026).
Run forensic triage on exposed hosts. Even patched hosts that were previously exposed may have been compromised before the fix. Review kernel logs and check for persistence before you call the ticket closed (TechTimes, 2026).

The takeaway

The KEV catalog is a list of bugs that attackers already use. Three of those bugs are in the Linux kernel, one of them is a year old, and the federal deadline is tomorrow (CISA KEV, 2026; TechTimes, 2026). Kernel patching is rarely urgent, and that is exactly why this batch matters. Inventory, update, reboot, and triage this weekend, not next sprint.

Revitalizing Desktop UX: Why Linux Must Lead the Next Evolution

Dec 20, 2025

Christopher Shaun Godwin

Author

Desktop user interfaces have remained static for decades. Consider the Macintosh Finder’s clever middle-ellipsis filename truncation, a subtle tweak from the early 1980s still in use today. Or the nuanced drag-and-drop mechanics that enable seamless file handling across windows. The core paradigms feel frozen in time. At the recent Ubuntu Summit 25.10, a veteran UX designer with roots at Apple and Google delivered a compelling wake-up call: are we doomed to the same desktop experience forever?

The speaker, drawing from four decades in the field, highlighted how Linux desktops inherited proven patterns from Mac and Windows. This wasn’t laziness; it was smart iteration. As Steve Jobs once quipped, echoing Picasso, “Good artists copy, great artists steal.” Early Linux environments creatively adapted these foundations, even influencing back with features like virtual desktops. But now, with proprietary giants stalled, open source has an opportunity—and arguably a responsibility—to pioneer anew.

The Innovation Drought from Big Tech

Apple’s 2017 pivot to iPad as the “post-PC” future flopped. That infamous “What’s a Computer?” ad twisted the knife, positioning the Mac as obsolete, yet iPadOS’s forced window-manager choices and touch-first design never conquered productivity workflows. Shiny effects like “liquid glass” can’t mask the lack of substance.

Microsoft fares little better. Aggressive OneDrive prompts, Edge shilling, and the botched Recall feature (great idea, poor execution) erode trust. The speaker shared a personal anecdote: interviewing for Windows UX lead eight years ago, pitching radical changes, only to be politely rebuffed. “We dodged a bullet,” they noted, praising niche Windows experiments but lamenting mainstream inertia.

Linux enthusiasts often dismiss desktop refinements—“I use the CLI anyway”—but this misses the point. Robust desktop UX enables broader usability, enabling drags into apps, clipboard fluidity, and data flows that power non-technical users. Stagnation here stifles adoption.

Common Pushback and a Framework for the Future

Critics retort: “Desktop is for boomers,” “It’s a standard; don’t break it,” or “Users hate change.” All partially true, but flawed. Mobile dominates consumers, not enterprise CAD or codebases. Standards evolve—BlackBerry yielded to iPhone—and users adapted to cars, PCs, and smartphones despite initial resistance.

Enter the “Could, Should, Might, Don’t” mindset from Could, Should, Might: Thinking About the Future. “Could” sparks wild ideas (AI fever dreams); “Should” sets metrics (ethics, business); “Might” maps scenarios; “Don’t” defines boundaries (no data collection). Avoid their shadows: foolhardy visions, short-term preaching, unfocused fear, rigid gatekeeping. Open source thrives by drafting behind proven ideas, but with sources dry, it’s time to lead.

UX Beyond Pixels: Bridging Programmers and Designers

Misnomer “UX/UI” conflates deep research—user studies, personas, tech mapping, flows—with superficial visuals (icons last!). Programmers probe every edge case (“might”); designers prioritize user stats (“should”). Tension arises: “That’s just your opinion.” Solution? Shared perspective via research, like Mastodon’s quote-post tweak, informed by Twitter studies and marginalized voices, flipping “reduce harm” to “enable good.”

Learning Loops: Game Design for Desktops

Raph Koster’s Theory of Fun offers “learning loops”: intent → affordance → feedback → refined model. Super Mario masters one jump button across move, climb, attack via progressive discovery. Nintendo invests 80% here.

Desktop text selection exemplifies: click → drag-select → double-click word. Mobile botched this naive “tap=click” copy, yielding four tap outcomes (cursor, select, menu, scroll). Research fixed it: force-press + magnifier + gesture menus slashed edits from five taps to one fluid motion.

A toy demo illustrated: a hypothetical mouse “super” button (or key) for windows—click to close, drag to resize/reposition, deeper press for clipboard/file ops. Crossing WM, editor, and file manager boundaries with layered gestures. Subtle, consistent, powerful.

Practical Prototypes, No AI Hype

Ditch grand AI visions or far-out physical UIs like Dynamic Land. Focus modest growth between CLI and radical futures.

Easy: KDE Connect 2.0 – Polish phone-desktop sync (Continuity-like). Prioritize Android SDK depth, consumer UX over programmer defaults. Bluetooth handoff for reliability?
Medium: Super Windowing – Wayland-ready system weaving files, history, apps. User-research first: pains in versioning, flows. Prototype fast, iterate.
Hard: Local Recall – Ethical, on-device LLM for history/clipboard smarts. Ultimate right-click? Gesture predictions? APIs needed, but experiments viable.

Fund like Ink & Switch: 1-3 person teams, 3 months build + 1 month paper. CRDTs emerged this way, spawning research ecosystems on shoestring budgets.

A Call to Action

“When you’re finished changing, you’re finished,” warns Benjamin Franklin (via Brad Frost). Allocate “float” time—even 0.5%—beyond 70% maintenance/20% increments for blue-sky UX. Hardware leaps (100M× faster CPUs since 1984 Mac) demand software ambition. Canonical’s polish work is vital, but foundational shifts beckon.

Linux desktops aren’t relics; they’re poised for renaissance. Prototype, reflect, share. Color outside the lines—be Princess Leia, blast the hole, jump in. The future desktop awaits.

Lessons from the Graveyard

However, we must temper this “blue sky” ambition with a hard look at the “Graveyard of Ambition.” Why did Ubuntu’s Unity or GNOME 3.0 face such fierce backlash? Because for enterprise users, muscle memory is money. Radical change often breaks workflows. The challenge for Linux isn’t just to innovate, but to innovate without alienating the “Boomers” who keep the lights on. The next evolution must be a bridge, not a cliff—a lesson Microsoft learned the hard way with Windows 8.

Linux Foundation Establishes Agentic AI Foundation, Anchored by Anthropic's MCP Donation

Dec 15, 2025

Christopher Shaun Godwin

Author

In a significant step for open-source AI infrastructure, the Linux Foundation has announced the formation of the Agentic AI Foundation (AIF). It is a new neutral governance body dedicated to developing standards and tools for AI agents. Leading the charge is Anthropic’s donation of the Model Context Protocol (MCP), a rapidly adopted open standard. It enables AI models and agents to connect with external tools, APIs, and local systems.

The Rise of MCP: A Protocol for AI Integration

Born as an open-source project within Anthropic, MCP quickly gained traction due to its community-driven design. It standardizes communication between AI agents and the outside world—think sending messages, querying databases, adjusting IDE settings, or interacting with developer tools. Major platforms have already embraced it:

ChatGPT
Cursor
Gemini
Copilot
VS Code

Contributions from companies like GitHub and Microsoft further accelerated its growth. Previously under Anthropic’s stewardship, its transfer to AIF ensures broader, vendor-neutral governance.

Agentic AI Foundation: Core Projects and Mission

Hosted by the Linux Foundation—a nonprofit powerhouse managing over 900 open-source projects, including the Linux kernel, PyTorch, and RISC-V—the AIF aims to foster transparent collaboration on agentic AI. Alongside MCP, the foundation incorporates:

Goose: A local-first, open-source agent framework leveraging MCP for reliable, structured workflows.
Agents.md: A universal Markdown standard adopted by tens of thousands of projects, providing consistent instructions for AI coding agents across repositories and toolchains.

The AIF’s goal is clear: create a shared, open home for agentic infrastructure, preventing proprietary lock-in and promoting stability as AI agents integrate into everyday applications.

Strategic Benefits and Industry Backing

Handing MCP to the Linux Foundation neutralizes perceptions of single-vendor control, encouraging multi-company adoption and long-term stability. Founding Platinum members—each paying $350,000 annually for board seats, voting rights, and strategic influence—include:

Platinum Member	Notable Quote
AWS	”Excited to see the Linux Foundation establish the Agentic AI Foundation.”
Anthropic	(Donor of MCP)
Block	-
Bloomberg	”MCP is a foundational building block for APIs in the era of agentic AI.”
Cloudflare	”Open standards like MCP are essential to enabling a thriving developer ecosystem.”
Google Cloud	”New technology gets widely adopted through shared standards.”
Microsoft	”For a gentic future to become reality, we have to build together and in the open.”
OpenAI	-

These tech giants gain priority visibility, committee access, and leadership summit invitations, signaling strong industry commitment despite ongoing debates over their proprietary models.

Implications for Open Source and AI

While ironic—given these firms’ closed-source frontier models—this move counters AI fragmentation. By aligning on protocols like MCP under Linux Foundation oversight, developers benefit from interoperability without vendor lock-in. As agentic AI proliferates, AIF positions open source as a stabilizing force, much like Linux has for operating systems.

This development marks a win for collaborative innovation, ensuring AI tools evolve transparently. Time will tell if it delivers on neutrality, but the foundation is set for agentic AI to scale responsibly.

True Openness or Tech Oligopoly?

However, the platinum roster reads like a Who’s Who of Big Tech—AWS, Microsoft, Google—raising the specter of “corporate capture.” While the Linux Foundation has successfully herded cats before, there’s a risk that this body becomes less about “open source” in the Stallman sense. It could become more about creating an interoperability layer for proprietary giants. If “open” standards simply make it easier to link closed-source models like Claude and GPT, does the open ecosystem actually win? The challenge for AIF will be proving it’s more than just a lobbying arm for the oligopoly. Independent developers must not be just consumers of these standards, but architects of them.