Project
The open-source Unix-like kernel underlying Linux-based operating systems, from Android to servers and embedded devices, maintained via kernel.org.
Sasha Levin's 9 October patch to deprecate the Linux kernel's Assisted-by AI tag has drawn more than 50 replies. The argument is over one line in a commit message, and it hands teams writing AI policies two opposed models to copy.
Reality
Linux kernel flaw CVE-2026-99999 let pwn.ai's Paulos Yibelo read about 32 bytes of host memory per packet from Vercel's production sandboxes. Operators who host other people's VMs need the fix in the kernel the host itself runs.
Reality
Canonical released Ubuntu 26.10 with GNOME 51 and a completed Rust-based coreutils rollout, according to Phoronix and LWN. Teams coming from 26.04 LTS have several separate changes to test, and we'd start with coreutils.
Reality
Linus Torvalds built an experimental Linux page-cache branch with Claude Code that cuts one contended read test to about a quarter of its CPU cost. His own cover letter flags open problems, so the series is a request for review.
Perspective Coverage
3 publishersReality
Tencent Zhuque Lab published working demos on October 12 for Vghost (CVE-2026-74580), a vhost bug that gives local users root on Linux 4.11 through 7.2-rc4. The August 3 fix is out, but Ubuntu 24.04 and 26.04 kernels were still listed as in progress on October 13.
Reality
Linus Torvalds says Claude Code largely wrote Linux page-cache patches that cut kernel cycles per read from about 2,950 to 725 in his test. The branch was still outside mainline 7.3-rc6 on October 13, so the kernel has not yet taken the code.
Reality
DepthFirst published a working Ubuntu 26.04 exploit for CVE-2026-80521 on 2026-09-22, before distribution kernels carried a fix, according to a dev.to post. The flaw sits in AF_UNIX, which default Docker and Kubernetes seccomp profiles permit.
Reality
Raspberry Pi OS's 6.18 kernel drives a pwm-ir-tx IR transmitter through a 300 ms test code in 7 microseconds, a dev.to post reports. ir-ctl still exits 0 after about 350 ms, so only a trace or a phone camera shows it.
Reality
Linus Torvalds says he likes using AI, though three-quarters of a day of kernel maintainer talks went to making AI generation and review less stressful. Teams writing an AI policy can turn his line on serious code into a test of who ends up checking the output.
Reality
Google stopped taking product vulnerability reports for its open-source bug bounty on October 1 after a flood of invalid AI-generated submissions. Any team that takes outside security reports faces the same imbalance, with reports now cheap to write and as costly as ever to check.
Perspective Coverage
15 publishersReality
Researcher Asim Manizada published working local-root exploits for four Linux kernel bugs on 18 September 2026. On hosts where containers or exposed services share one kernel, any compromised service can now become a lost node.
Reality
Microsoft's FORGE lab helped discover Windows flaws assigned 140 CVEs from May to September 2026, 52 of them fixed in the September release. Microsoft says the pace now depends on how fast its response center can validate and fix what the AI agents report.
Reality
Meta's Gregory Price showed Linux Plumbers a compressed-memory design, CRAM, that reads up to 452x faster than ZRAM by keeping pages out of swap. His slides still list a compressed host's usable capacity as an open problem for anyone sizing servers around it.
Reality
The stable AndroidX Security State libraries report patch state for the core OS, Play system modules and the Linux kernel separately, and let an app ask whether a named CVE is fixed before it turns a feature on.
Reality
Google Threat Intelligence Group counted 10,740 vulnerability disclosures in August, more than double the monthly figure at the start of 2026. Exploitation is rising more slowly, so the first call on any budget reopened this quarter is triage capacity.
Reality
Google deprecates the September 2026 android16-6.12 GKI release, 6.12.92, from 1 January 2028, about 15 months after publication. A certified Android Automotive build is bound by that date and the branch's 1 July 2029 end of life, whatever kernel.org projects for 6.12.
Reality
VUSec disclosed Branch Target Reuse, a Spectre-v2 attack on JIT engines whose Linux exploit leaks memory at 8 bytes a second. It bypassed every enabled mitigation, and the kernel's fix had already shipped in July.
Reality
Intel, AMD and Arm say their IBPB barrier can block Branch Target Reuse, a Spectre v2 variant hitting all three, if JIT software calls it. Each kernel, browser and runtime that rewrites JIT code now has to add that call itself.
Perspective Coverage
3 publishersReality
Google's Threat Intelligence Group counted 141 flaws exploited in the wild from January to August, while monthly disclosures doubled to 10,740. Patch teams do better sorting by that exploited set than by the total, though attackers now reach some public flaws within days.
Reality
Git 2.56 adds a staging flag that aborts on leftover conflict markers and cuts one Chromium diff from about eight minutes to 0.07 seconds. Teams get the speed by upgrading, but they get the safety only by editing the scripts their developers and coding agents run.
Reality
Build · September 28, 2026 · Confirmed2 publishers
Build · September 27, 2026 · Confirmed2 publishers
Build · September 27, 2026 · Confirmed2 publishers
Security · September 23, 2026 · Confirmed2 publishers
Build · August 24, 2026 · Confirmed2 publishers
Security · August 29, 2026 · Confirmed4 publishers
Build · September 25, 2026 · Confirmed2 publishers
Security · September 21, 2026 · Confirmed5 publishers