<p><strong>TLDR:</strong> Linus Torvalds updated kernel security documentation this week after AI-generated bug reports made the private security list nearly unmanageable. A cluster of local privilege escalation vulnerabilities targeting the Linux page cache is expanding, with working exploits already public. Firefox 151 shipped Web Serial API support, closing a long-standing gap for hardware makers. The Godot Foundation launched a proper asset store to replace the aging Asset Library.</p>
<hr>
<h2>Linus Torvalds calls AI security reports “slop”</h2>
<p>The Linux kernel security list is drowning. Torvalds updated the kernel’s security documentation this week to clarify what counts as a real vulnerability report and to address the flood of AI-generated submissions — many of them duplicates of the same issues found by different people running the same tools. Maintainers are spending most of their time routing noise rather than fixing actual bugs. Torvalds’s position: AI-detected bugs should be treated as effectively public knowledge since they’re broadly reproducible, and submitters should show up with patches, not just reports. Meanwhile, Linux 7.1-rc5 landed with an unusually large patch set — Torvalds was visibly frustrated that several unnecessary patch series were triggered by AI code review tools running late in the cycle.</p>
<h2>Page cache privilege escalation vulnerabilities keep multiplying</h2>
<p>A cluster of Linux local privilege escalation bugs — Copy Fail, Dirty Frag, Fragnesia, and Dirty Decrypt — all share the same root cause: page cache corruption. Each abuses a different kernel path (AFALG crypto, XFRM ESP, RXRPC, RXGK) but the end result is the same: a normal local user can poison the in-memory copy of a SUID binary like <code>/usr/bin/su</code> without touching the file on disk. Working exploits are public and confirmed on unpatched Ubuntu 24.04. A separate but related bug, CVE-2026-46333 (ssh-keysign-pwn), lets unprivileged users steal SSH host private keys and read <code>/etc/shadow</code> by racing a ptrace exit window. Linus Torvalds authored the patch; seven updated stable kernels are out. If you haven’t patched, set <code>kernel.yama.ptrace_scope=2</code> as a stopgap.</p>
<h2>Firefox 151 ships Web Serial API and PDF merging</h2>
<p>Firefox 151 finally supports the Web Serial API, letting web apps talk directly to serial-connected hardware without native software. Mozilla worked with Adafruit to validate the implementation — CircuitPython workflows on Raspberry Pi Pico and ESP32 flashing via WebSerial ESPTool now work in Firefox. Access requires an explicit user permission prompt and enterprise deployments have it disabled by default. The same release adds built-in PDF merging to the PDF viewer, handling everything locally with no third-party upload required. Mozilla is also pushing to get Web Serial standardized through WHATWG.</p>
<h2>Godot launches its asset store</h2>
<p>The Godot Foundation replaced the old Asset Library with a proper <a href="https://store.godotengine.org" target="_blank" rel="noopener nofollow">Godot Asset Store</a>, live now and integrated into the editor starting with Godot 4.7. The old library only supported free, open-source add-ons. The new store adds versioned downloads with changelogs, user reviews and ratings, publisher analytics, and a roadmap for paid assets. The old library stays running for older engine versions but is deprecated and will eventually go read-only. Manual migration is required — the Foundation ruled out automatic migration due to account linking and permissions complications. Whether the paid marketplace attracts quality submissions once it opens is the real question.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>AMD HDMI 2.1 FRL on Linux:</strong> AMD’s open-source driver is finally getting HDMI 2.1 FRL and DSC support after years of delay caused by the HDMI Forum blocking open-source implementations. FRL will be disabled by default initially (VRR support still pending), with full enablement targeting Linux 7.2.</li>
<li><strong>OpenBSD 7.9 released:</strong> Maximum amd64 CPU cores jumps from 64 to 255, WiFi 6 support lands, LibreSSL gains ML-KEM for post-quantum TLS, and OpenSSH gets a new <code>invaliduser</code> penalty in <code>PerSourcePenalties</code> to cut credential-stuffing noise.</li>
<li><strong>Bambu Lab AGPL violations confirmed:</strong> The Software Freedom Conservancy confirmed two AGPLv3 violations by Bambu Lab — distributing a PrusaSlicer fork without source and using legal threats to suppress a community fork. SFC is launching a reverse-engineering project, a maintained OrcaSlicer fork, and a $250,007 fundraiser.</li>
<li><strong>Bitwarden leadership changes raise concerns:</strong> New CEO Michael Sullivan has a private equity M&amp;A background. The company briefly removed “Always Free” from its pricing page, and its core values were quietly rewritten — dropping Inclusion and Transparency. Sullivan has since posted reassurances, but the pattern of unannounced changes has unsettled users.</li>
<li><strong>Plex lifetime pass tripling to $749 on July 1:</strong> Jellyfin responded by announcing it would “quadruple” its price (4×$0=$0). Migration from Plex to Jellyfin is reportedly straightforward, though remote access requires more setup.</li>
<li><strong>HP joins LVFS as Premier sponsor:</strong> HP is now contributing $100K/year alongside Dell and Lenovo, giving the Linux Vendor Firmware Service three major PC manufacturers funding at the highest tier.</li>
<li><strong>Valkey 9.1 released:</strong> The Redis fork hits 2.1 million requests per second with a new I/O threading model, adds database-level ACLs for multi-tenant isolation, and reports 6 million container pulls per week — a 17x increase year-over-year.</li>
<li><strong>TanStack supply chain attack postmortem:</strong> Attackers exploited GitHub Actions cache poisoning and unsafe <code>pull_request_target</code> workflows to publish 84 malicious package versions across 42 packages in six minutes, harvesting cloud credentials and SSH keys from developer environments.</li>
<li><strong>Canonical shutting down Ubuntu Pastebin May 31:</strong> After 18 years, <a href="http://paste.ubuntu.com" target="_blank" rel="noopener nofollow">paste.ubuntu.com</a> is being decommissioned. Users should back up saved pastes via Ubuntu One before the deadline.</li>
<li><strong>AV2 codec release imminent:</strong> The AV2 video codec from the Alliance for Open Media appears set for official 1.0.0 release on May 29, with the reference implementation repository already showing a pre-dated changelog.</li>
<li><strong>GNOME Commander 2.0:</strong> Major rewrite from C++ to Rust with GTK4 migration, adding an embedded terminal, redesigned quick search, and improved Wayland support.</li>
<li><strong>OpenTelemetry graduates in CNCF:</strong> Now the second highest-velocity CNCF project after Kubernetes, with 12,000+ contributors from 2,800+ companies and JavaScript API downloads growing from 75M to 200M monthly npm downloads in a year.</li>
<li><strong>FreeBSD 15.1-RC1:</strong> Six security advisories addressed, with AI-driven firms and autonomous research teams credited for finding a kernel use-after-free, a ptrace privilege escalation, and a remote code execution bug in the installer’s WiFi scanning code.</li>
<li><strong>Rust <code>Untrusted&lt;T&gt;</code> type for the kernel:</strong> Greg Kroah-Hartman presented a new Rust type that attaches a compile-time marker to data from user space or hardware, forcing explicit validation before use — potentially eliminating 80% of kernel CVEs with no runtime overhead. Not yet merged.</li>
<li><strong>pgBackRest continues:</strong> The popular PostgreSQL backup tool was archived in April due to lack of sponsorship, then rescued in May when a coalition of sponsors stepped forward to fund ongoing development.</li>
<li><strong>Deutsche Bahn was blocking Linux users:</strong> <a href="http://bahn.de" target="_blank" rel="noopener nofollow">bahn.de</a>’s bot-detection flagged the word “Linux” in the User-Agent string, returning error 751 to any browser identifying as Linux. DB says it was unintentional and the issue appears resolved.</li>
<li><strong>Flipper One announced:</strong> A Linux-based open hardware device on Rockchip RK3576 targeting network hacking and hardware experimentation, with dual Gigabit Ethernet, WiFi 6E, and an M.2 slot. No release date, no firm price, and the team is explicitly asking for contributors to finish building it.</li>
</ul>


Linux distro releases, open source project news, and FOSS community updates.

Open Source Digest

A roundup of notable developer news: Linus Torvalds updated Linux kernel security documentation after AI-generated bug reports overwhelmed maintainers, labeling them 'slop' and requiring submitters to provide patches. A cluster of Linux local privilege escalation vulnerabilities (Copy Fail, Dirty Frag, Fragnesia, Dirty Decrypt) targeting page cache corruption have public working exploits on Ubuntu 24.04, with patched stable kernels now available. Firefox 151 ships Web Serial API support validated with Adafruit hardware and adds local PDF merging. The Godot Foundation launched a new Asset Store replacing the old Asset Library, with versioned downloads, reviews, and a roadmap for paid assets. Additional items include OpenBSD 7.9 with post-quantum TLS, confirmed AGPL violations by Bambu Lab, a TanStack supply chain attack via GitHub Actions cache poisoning, Valkey 9.1 hitting 2.1M req/s, a new Rust Untrusted<T> kernel type, and pgBackRest rescued from archival.

Linux kernel drowns in AI-generated reports, Godot launches its asset store