On October 21, 2026, Linus Torvalds merged into Linux 7.4 the removal of __get_user() and __put_user(), historical variants that do not validate the user address range and are therefore unsafe. He drafted the conversion partly with Claude Code, used “as a fancy sort of Coccinelle script”: AI is settling into kernel maintenance, including for eliminating whole classes of memory bugs.

On October 15, 2026, a critical Linux kernel flaw, CVE-2026-99999 nicknamed PwnEscape, lets code running inside a virtual machine read its host’s memory, crash the host, or execute code on it. Update the host kernel, not the guest kernel, and verify the fix with your distribution.

Kubernetes has deprecated cgroup v1 and plans its full removal in v1.38; since v1.35, the kubelet refuses to start on a node still running cgroup v1. If your nodes are still on cgroup v1, migrate them to cgroup v2 before upgrading, or the cluster will fail to start.

On October 8, 2026, the Linux 7.3 Git merge deprecated EXT4’s data=journal mode, which writes file data and metadata to the journal before committing them, with removal scheduled for early 2028. Check your mount options in /etc/fstab: if you don’t enable data=journal explicitly, this deprecation does not affect you.

The Ubuntu 26.10 “Stonking Stingray” beta is out: it completes the migration of coreutils to Rust, ships Linux 7.3, GNOME 51, and dbus-broker in place of dbus-daemon. Test it now to gauge the impact on your fleet before the October 15 stable release.

The RMPOPT instruction, expected on Zen 6 “Venice” EPYCs, reduces the Reverse Map Table overhead that protects SEV-SNP VM memory integrity, and its Linux support lands in kernel 7.4. Confidential-computing operators on AMD can start planning their test benches.

Canonical replaces its four-week and two-week cycles with a single cascading two-week cycle that ships an Ubuntu kernel every week. For an Ubuntu fleet, that shortens the gap between a kernel CVE and its fix — if you adapt your maintenance windows.

A patch series by Yuan Liu (Intel), queued in mm/core.git ahead of the Linux 7.4 merge window, replaces page-by-page zone scans with an optimized contiguity check. Measured: up to 81% less time to hot-add memory to a VM and 75% to hot-remove it, with Samsung also reporting CXL gains.

An 81-line patch by Hao Li, queued into slab/for-next ahead of the Linux 7.4 merge window, lets the slab allocator refill its sheaves from the barn instead of partial slabs, clearing a saturation that penalized kfree_rcu(). The measured result: +24% on the will-it-scale mmap1 test and massive gains on the barn microbenchmarks.

On August 31, 2026, researcher Lukas Maar published OEMpocalypse, an exploit chain that elevates any permissionless Android app to root on Samsung Galaxy S23–S26, Xiaomi flagships and Oppo/OnePlus/Realme devices — locked bootloader, Verified Boot still green. Your root detection is blind to it: only hardware-backed keys (KeyStore/StrongBox) still hold.

On September 12, 2026, Debian shipped 13.7, the seventh trixie point release, bundling 107 security updates and fixes across 106 packages. If you follow security.debian.org you already have most of it — the real value sits in the fresh install images and QEMU’s Secure Boot bypass fix.

The public preview of Amazon Linux 2027 arrived on September 3 with a 7.1 kernel, SELinux enforcing by default, and AWS Neuron driver support. Test it now if you are planning an AL2023 migration.

On August 29, 2026, Konstantin Ryabitsev published hard numbers on AI crawler traffic to the Linux kernel repositories: six million requests a day, a fifth of CPU capacity, and barely 2% legitimate traffic. For any public self-hosted service, it is proof that a proof-of-work challenge only moves the problem.

On August 25, 2026, Cong Wang released mklinux v7.0-mk2, the first ready-to-run build of the multi-kernel concept: several independent Linux kernels on one physical machine, with no hypervisor and no emulation. A promising path to hard isolation — but not yet a production artifact.

The Linux kernel’s NTFS3 driver restores setuid bits straight from untrusted on-disk data, letting a crafted NTFS image produce a setuid-root binary as soon as the volume mounts. Reported privately two months ago and still unpatched, the bug hits desktops whose automounter mounts NTFS volumes with suid on by default.

Kaspersky has found a new CoolClient backdoor variant carrying a signed kernel driver that hides processes, files, registry keys, and network connections. The HoneyMyte group (Mustang Panda) is using it against governments in Asia — detecting it requires kernel-level telemetry.

The Linux project published 46 CVEs between August 2 and 8, 2026. Every single one is already fixed in stable, none are 0-days, but the gap between the available patch and the kernel running on your machines is the real risk.

On August 6, 2026, the Linux WiFi maintainer announced a three-second rejection rule for AI-generated patches, as the networking subsystem continues to be flooded with automated contributions. Open-source network infrastructure maintainers are raising the alarm: code quality is at risk.

On August 6, 2026, a speculative execution vulnerability was publicly disclosed, affecting all AMD Zen 1 through Zen 4 processors via the Linux kernel's SRSO mitigation. A fix is already in linux.git; the community must patch without delay.

A freshly provisioned Ubuntu VPS on Hetzner, OVH, or DigitalOcean receives its first SSH brute-force attempt within 12 minutes. These 10 commands — AppArmor, firewalld, fail2ban, auditd, AIDE, kernel hardening, Lynis, and unattended-upgrades — lock it down in 5 minutes flat.