<p><strong>TLDR:</strong> CVE-2026-46242 (Bad Epoll) is a use-after-free in the Linux kernel’s epoll subsystem affecting kernels v6.4 through the fix date — an unprivileged process can reach root with 99% reliability, and an Android exploit for Pixel 10 is in progress. Godot formalized a ban on AI-generated code and autonomous agents, joining Zig, Ghostty, and curl in drawing a hard line. Valve confirmed SteamOS is coming to Nvidia GPUs, which matters given that over 90% of PC gamers run Nvidia hardware. Git 2.55 shipped with Rust enabled by default and a new <code>git history fixup</code> subcommand that makes amending older commits without interactive rebase finally practical.</p>
<hr>
<h2>Bad Epoll (CVE-2026-46242): unprivileged root on Linux desktops, servers, and Android</h2>
<p>A race-condition use-after-free in the epoll subsystem, introduced in kernel v6.4, lets an unprivileged process gain root. The race window is only about 6 instructions wide, but the exploit widens it with a retry loop and hits 99% reliability. The chain goes UAF write → cross-cache attack → arbitrary kernel read via /proc/self/fdinfo → ROP chain for root shell. There’s no workaround since epoll is a core kernel feature — the only fix is applying upstream commit a6dc643c6931. Kernels v6.1 and earlier are not affected. An Android exploit targeting Pixel 10 (kernel v6.6+) is in progress. <a href="https://daily.dev/posts/8ik6UsR3n" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Godot bans AI-generated code and autonomous agents from contributions</h2>
<p>Godot updated its contribution policy to prohibit autonomous AI agents, vibe coding, and substantial AI-generated code, with automatic bans for violators. The stated reason isn’t just review burden — it’s that code review has historically been the mentorship pipeline for future maintainers, and AI-authored PRs break that dynamic entirely since an LLM can’t grow into a trusted contributor. Limited AI use for things like code completion or regex is still allowed with disclosure. This mirrors bans already in place at Zig, Ghostty, and curl, and connects to a broader concern about AI eroding the junior developer talent pipeline. <a href="https://daily.dev/feed-by-ids?id=6oecDtTap&amp;id=lLNG4i6Ki&amp;id=Ig5XpIsqR&amp;id=dECENQBsP&amp;id=FWP3RSKcR&amp;id=a4Jk6EvSf&amp;id=4blhtIpzs" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Valve confirms SteamOS is coming to Nvidia GPUs</h2>
<p>Valve has confirmed active work to bring official SteamOS support to Nvidia GPUs, a significant shift from the historically AMD-only hardware focus. Over 90% of PC gamers use Nvidia, so this is a meaningful expansion of SteamOS’s reach. SteamOS 3.8.10 is already improving Intel Panther Lake compatibility, and the broader hardware support push is expected to accelerate the DIY Steam Machine movement. The main remaining friction points are anti-cheat compatibility and Proton gaps, but the direction is clear. <a href="https://daily.dev/feed-by-ids?id=W1XRLojOK&amp;id=lNfZZm155&amp;id=YmYorDNIC" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Git 2.55 ships with Rust enabled by default and <code>git history fixup</code></h2>
<p>Git 2.55 makes Rust a default build dependency (still optional via NO_RUST) and introduces <code>git history fixup</code>, an experimental subcommand that folds staged changes into an older commit and auto-rebases stacked branches — no interactive rebase required. The release also adds Linux fsmonitor support via inotify, remote group support for <code>git push</code>, and significant bitmap generation performance improvements (612s down to 294s in one benchmark). Full mandatory Rust support is planned for Git 3.0. <a href="https://daily.dev/feed-by-ids?id=yTX0eZS5f&amp;id=HS6UGTnIr&amp;id=RP044xSQM" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>LUKS encryption keys silently leaked across suspend since Linux 6.9 (May 2024):</strong> A developer discovered that since Linux 6.9, the tool responsible for wiping LUKS keys on laptop suspend had been silently failing due to an unexpected kernel refactoring interaction, leaving encryption keys in RAM across suspend for over two years and exposing data to cold boot attacks — a one-line kernel fix has been proposed but is incomplete for virtual loop devices. <a href="https://daily.dev/posts/E8gtZE4cs" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>KDE Plasma sandbox escape: unpatched ACE via ‘Open New Window’ after 90-day disclosure:</strong> A sandboxed Flatpak app can escape its sandbox and spawn arbitrary binaries on the host by manipulating argv0 to impersonate a legitimate app and triggering KWin’s ‘Open New Window’ action, which reads /proc/PID/cmdline without validation — reported to KDE Security in April 2026, no patch or response after 90 days, full PoC now public. <a href="https://daily.dev/feed-by-ids?id=DGV9MU1kd&amp;id=qGzYzxbxB&amp;id=96cXaaIZt" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Immich v3.0.0 ships Workflows automation system and mobile photo editing:</strong> Immich v3.0.0 introduces a drag-and-drop Workflows automation builder, non-destructive mobile photo editing matching the web editor, real-time video transcoding (experimental), and OCR text selection — breaking changes primarily affect third-party API integrations, standard Docker Compose upgrades are unaffected. <a href="https://daily.dev/feed-by-ids?id=c9Kcowdm0&amp;id=e7BVoaFwZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Aikido acquires Root for ~$70-100M to backport CVE patches without requiring upgrades:</strong> Aikido Security acquired Israeli startup Root, whose AI agents generate patches targeting the exact package version a team already runs — in over 80% of cases no code changes are needed — and committed to backporting fixes for CISA’s Known Exploited Vulnerabilities to the open source community for free across npm, PyPI, and Maven. <a href="https://daily.dev/feed-by-ids?id=898lhU9ih&amp;id=HQE9TnaBD&amp;id=yOwYcEKXM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>IBM and Red Hat launch Project Lightwell: $5B patching service targeting AI-discovered OSS vulnerabilities:</strong> Project Lightwell is a subscription service backed by 20,000 engineers delivering backported, signed patches with contractual SLAs for enterprises, prompted by Anthropic’s Claude Mythos disclosing 1,596 vetted vulnerabilities across 281 open-source projects through Project Glasswing — but only 97 have been patched, a 6% fix rate. <a href="https://daily.dev/posts/PcQmQq3Sh" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Linux distro releases, open source project news, and FOSS community updates.

Open Source Digest

CVE-2026-46242 (Bad Epoll) is a use-after-free in the Linux kernel's epoll subsystem affecting kernels v6.4 through the fix date — an unprivileged process can reach root with 99% reliability, and an Android exploit for Pixel 10 is in progress. Godot formalized a ban on AI-generated code and autonomous agents, joining Zig, Ghostty, and curl in drawing a hard line. Valve confirmed SteamOS is coming to Nvidia GPUs, which matters given that over 90% of PC gamers run Nvidia hardware. Git 2.55 shipped with Rust enabled by default and a new `git history fixup` subcommand that makes amending older commits without interactive rebase finally practical.

Bad Epoll lands a 99% reliable root exploit, Godot bans AI contributions