# Linux Kernel The Linux kernel is a free software operating-system component and a large, active software project supporting many processor architectures and systems. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Security evaluations find traditional virtual machines inadequate for containing cyber-capable autonomous agents DevFeed: [Security evaluations find traditional virtual machines inadequate for containing cyber-capable autonomous agents]() Original publisher: [Read original article]() Author: Olimpiu Pop Published: 2026-09-17T07:07:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [virtual machines](), [Security](), [Vulnerabilities](), [Linux Kernel](), [qemu](), [Firecracker](), [systems]() Tags: [agent-escape-vm](), [ai-security](), [development](), [devops](), [firecracker](), [linux](), [linux-kernel](), [news](), [qemu](), [security](), [security-breach](), [virtual-machines](), [virtualization](), [vm](), [vulnerabilities]() ### AI overview Security evaluations found that a cyber-capable autonomous agent escaped standard QEMU and KVM virtual machine configurations by exploiting kernel and library vulnerabilities. Firecracker contained the agent in testing, but the agent still hardlocked the host through Linux kernel flaws. ### Source excerpt Traditional virtual machines are inadequate for isolating cyber-capable autonomous agents. Tests using GPT-5.6-Cyber indicated multiple escape attempts due to kernel flaws. While Firecracker provided some containment, vulnerabilities remained. The study underscores the need for minimal attack surface virtualisation technologies and rapid, proactive patching strategies to safeguard host systems. By Olimpiu Pop ## Linux Randomly Picking Idle CPU Cores Shows Modest Win On High Core Count Systems DevFeed: [Linux Randomly Picking Idle CPU Cores Shows Modest Win On High Core Count Systems]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-09-16T13:30:04Z Content type: news Language: en Sources: [Phoronix]() Topics: [Linux](), [Linux Kernel](), [cpu](), [benchmarking](), [systems]() Tags: [benchmarking](), [cpu](), [desktop-linux](), [linux](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-kernel](), [linux-performance](), [linux-server-benchmarks](), [open-source-graphics](), [patches](), [phoronix](), [phoronix-test-suite](), [scheduler](), [ubuntu-benchmarks](), [ubuntu-hardware]() ### AI overview A Linux kernel patch series proposes randomizing the selection among equally shallow idle CPU cores to reduce scan-order bias and prevent concurrent tasks from converging on the same core. Testing on a 160-core Ampere Altra system showed throughput improvements of up to a few percent in Stress-NG benchmarking, while the benefits on smaller systems remain uncertain. ### Source excerpt Arm engineer Christian Loehle sent out a patch series today proposing that the Linux scheduler code randomize its picking of equally shallow idle CPU cores. This randomization is showing to deliver a win at least for high CPU core counts for better distributing workloads... ## AMD Sends Out Linux Patches For Enabling SEV-TIO TDISP With PCIe 6.0 DevFeed: [AMD Sends Out Linux Patches For Enabling SEV-TIO TDISP With PCIe 6.0]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-09-16T13:02:52Z Content type: news Language: en Sources: [Phoronix]() Topics: [Linux Kernel](), [pcie](), [trusted-execution-environment](), [Confidential Computing](), [virtualization](), [Security](), [Encryption](), [MERN]() Tags: [amd](), [arm](), [attestation](), [confidential-computing](), [cpu](), [desktop-linux](), [encryption](), [intel](), [kernel](), [linux](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-kernel](), [linux-performance](), [linux-server-benchmarks](), [open-source-graphics](), [pcie](), [phoronix](), [phoronix-test-suite](), [processors](), [risc-v](), [security](), [ubuntu-benchmarks](), [ubuntu-hardware]() ### AI overview AMD submitted 17 Linux kernel patches to enable SEV-TIO TDISP for PCIe 6.0 and newer. The work is intended to secure direct I/O device assignment for confidential-computing environments, including AMD Secure Encrypted Virtualization guest VMs, and includes a common TEE Security Manager developed with Intel, Arm, and RISC-V. ### Source excerpt The newest Linux kernel patches out of AMD for enhancing the upstream support with the new AMD EPYC 9006 "Venice" processors is for enabling SEV-TIO TDISP that is supported with PCI Express 6.0 and beyond... ## Documenting the manual: how curiosity and robotic arms led to a career in open source DevFeed: [Documenting the manual: how curiosity and robotic arms led to a career in open source]() Original publisher: [Read original article]() Author: Google Open Source (noreply@blogger.com) Published: 2026-06-22T18:30:00Z Content type: article Language: en Sources: [Google Open Source Blog]() Topics: [Documentation](), [Open Source](), [Linux Kernel](), [Linux](), [C](), [Undocumented feature](), [Network](), [Scripting]() Tags: [c](), [communities](), [documentation](), [linux](), [linux-kernel](), [linux-man-pages](), [network](), [open-source](), [scripting](), [sponsorship](), [undocumented-feature](), [work]() ### AI overview This article profiles Alejandro "Alex" Colomar's path from working with robotic arms to maintaining Linux Kernel documentation. It explains how documenting the previously undocumented SO_TIMESTAMPNS feature led to his first man-pages patch and eventually to a career focused on clarity in open source communities. Google sponsors his work on the Linux Kernel man-pages project. ### Source excerpt by Daryl Ducharme, Google Open Source When you think of "innovation" in open source, your mind probably jumps to the latest AI model or a revolutionary new framework. You might not immediately think of manual pages. Even Alejandro "Alex" Colomar, who spends his days maintaining Linux Kernel documentation, jokingly admits that some might find the work "boring" because it focuses on fixing existing issues and documenting new features rather than flashy inventions. But as any developer knows, the most powerful code is only as good as the documentation behind it. At Google, we believe that investing in the success of projects we don't own is a core part of being a good open source citizen. That is why we are proud to sponsor Alejandro's work on the Linux Kernel man-pages project--supporting the critical infrastructure that many of our own systems rely on every day. Documentation is the gift you give to your future self and your whole community. The precision of a robot Alejandro's journey into the world of essential documentation started at university. He was working with robotic arms that used a proprietary scripting language. Wanting more control, he decided to write a C library to communicate with the robots over the network by sniffing packets with Wireshark. It worked, but it was slow--he had to wait seconds between commands to ensure the robot had finished moving. To make the movements smooth, he needed to understand the messages the robot was sending back in real-time. This required high-precision timing. He found SO_TIMESTAMP, which provided microsecond precision, but he noticed a macro called SO_TIMESTAMPNS in the header files that promised nanosecond resolution. The problem? It wasn't documented in the manual page. The first patch After figuring out how to use the undocumented feature by looking at the kernel source code, Alejandro decided to ensure the next person wouldn't have to struggle. He cloned the man-pages repository, wrote a new paragraph based on exis ## GenAI's effects on quality, adoption costs, copyright disputes, and the technology industry DevFeed: [GenAI's effects on quality, adoption costs, copyright disputes, and the technology industry]() Original publisher: [Read original article]() Author: Sergio Visinoni Published: 2026-05-27T05:02:17Z Content type: opinion Language: en Sources: [Sudo Make Me a CTO]() Topics: [Artificial Intelligence](), [gen ai](), [AI Infrastructure](), [Linux Kernel](), [Open Source](), [Nvidia](), [Microsoft]() Tags: [ai](), [ai-infrastructure](), [gen-ai](), [linux-kernel](), [microsoft](), [nvidia](), [open-source](), [something-big-is-happening]() ### AI overview This commentary issue examines claims that GenAI is increasing output while reducing quality in Linux kernel contributions and academic papers. It also discusses the costs of adopting GenAI in engineering teams, AI infrastructure spending, and a copyright lawsuit involving NVIDIA, alongside two more positive developments. ### Source excerpt Quantity isn't quality; cash is being burnt at unprecedented rates; trillion-dollar companies can't afford to buy books, and a couple of positive notes to cheer us up! ## 2025 CVE Data Review DevFeed: [2025 CVE Data Review]() Original publisher: [Read original article]() Author: jgamblin Published: 2026-01-01T18:38:43Z Content type: article Language: en Sources: [Jerry Gamblin]() Topics: [Vulnerabilities](), [data](), [Statistics](), [Security](), [Content Management System](), [Linux Kernel](), [web applications]() Tags: [2025](), [analysis](), [cms](), [cve](), [data](), [linux-kernel](), [patch-tuesday](), [report](), [statistics](), [supply-chain](), [trends](), [uncategorized](), [volume](), [vulnerabilities]() ### AI overview This review analyzes 2025 CVE publication data, reporting 48,185 published CVEs, a 20.6% increase from 2024. It highlights stable median CVSS scores, growth in web application and CMS-related flaws, publication clustering around vendor release cycles, and the Linux Kernel as the product with the most listed vulnerabilities. The article recommends prioritizing vulnerabilities by exploitability and automating remediation where possible. ### Source excerpt 2025 set a new baseline with 48,185 published CVEs. While the sheer volume is climbing, the median CVSS score remained surprisingly stable. We are seeing a distinct shift toward web application flaws (specifically in the CMS ecosystem) and a wider distribution of vendors, proving that vulnerabilities are spreading deeper into the supply chain. This massive growth ... Read more ## How io\_uring improves database performance DevFeed: [How io\_uring improves database performance]() Original publisher: [Read original article]() Published: 2025-12-11T00:00:00Z Content type: tutorial Language: en Sources: [Gaurav Sarma's Blog]() Topics: [io\_uring](), [Databases](), [Linux Kernel](), [NVMe]() Tags: [asynchronous](), [database-performance](), [io](), [io-uring](), [nvme](), [performance]() ### AI overview This article explains how io_uring improves database performance through shared submission and completion queues, batching, fewer system calls, zero-copy operation, and features such as SQPoll and registered buffers. It also discusses DMA and the relevance of fast NVMe storage. ### Source excerpt . [How io_uring Improves Database Performance](how-iouring-improves-database-performance-cover... ## exploits.club Weekly Newsletter 88 - kCTF RCAs, Tesla Shells, Remote Pointer Leaks, And More DevFeed: [exploits.club Weekly Newsletter 88 - kCTF RCAs, Tesla Shells, Remote Pointer Leaks, And More]() Original publisher: [Read original article]() Author: exploits.club Published: 2025-10-03T15:00:41Z Content type: news Language: en Sources: [exploits.club]() Topics: [Security](), [vulnerability](), [Linux Kernel](), [TLS (Transport Layer Security)](), [bug](), [macOS](), [Android](), [Cloud]() Tags: [analysis](), [android](), [aws](), [azure](), [linux](), [linux-kernel](), [macos](), [security](), [tls](), [vulnerability]() ### AI overview This weekly newsletter highlights security news and write-ups, including an OSS zero-day competition involving AWS, GCP, and Azure; the Android September Security Bulletin; a Tesla Telematics Control Unit ADB authentication bypass; an Apple macOS font vulnerability; and analysis of a Linux kernel TLS vulnerability. ### Source excerpt We hope everyone is enjoying their new t swizzle album with a pumpkin spice latte on the side...annnnnyways πŸ‘‡ In Case You Missed It... ZeroDay Cloud - AWS, GCP, and Azure have teamed up to put on an OSS 0-day competition. Find bugs in the targets, demo them on ## exploits.club Weekly Newsletter 86 - KSMBD 0Clicks, Apple Ends Memory Corruption, Mini-Kernels in Zig, And More DevFeed: [exploits.club Weekly Newsletter 86 - KSMBD 0Clicks, Apple Ends Memory Corruption, Mini-Kernels in Zig, And More]() Original publisher: [Read original article]() Author: exploits.club Published: 2025-09-18T15:00:23Z Content type: article Language: en Sources: [exploits.club]() Topics: [Hacking](), [Exploit](), [Linux Kernel](), [Security]() Tags: [apple](), [exploits](), [kernels](), [memory](), [newsletter](), [weekly]() ### AI overview A weekly newsletter covering OrangeCon videos, an open DistrictCon CFP, a Linux kernel ksmbd exploit write-up, DEF CON car-hacking challenges, and Apple's Memory Integrity Enforcement research. ### Source excerpt Write a weekly newsletter, they said. It will be fun, they said....Annnnnnyway πŸ‘‡ In Case You Missed It... OrangeCon 2025 Videos Online - Hours of new content...go check it out! DistrictCon CFP Still Open - Get em in by the end of the month! Resources And Write-Ups From This ## exploits.club Weekly Newsletter 85 -Fuzzing KSMBD, Kernel-Hack-Drill, Vibe-Crashing, And More DevFeed: [exploits.club Weekly Newsletter 85 -Fuzzing KSMBD, Kernel-Hack-Drill, Vibe-Crashing, And More]() Original publisher: [Read original article]() Author: exploits.club Published: 2025-09-04T15:00:32Z Content type: article Language: en Sources: [exploits.club]() Topics: [Fuzzing/Fuzz testing](), [Linux Kernel](), [vulnerability](), [Security](), [race-condition](), [Exploit](), [Ubuntu]() Tags: [exploits](), [fuzzing](), [kernel](), [linux-kernel](), [race-condition](), [security](), [vulnerability]() ### AI overview The 85th exploits.club weekly newsletter highlights work on fuzzing improvements and vulnerability discovery in ksmbd, including 23 reported bugs. It also covers Kernel-Hack-Drill research on exploiting CVE-2024-50264, a Linux kernel socket race condition resulting in use-after-free, and related exploitation constraints. ### Source excerpt New idea - let AI submit a different, buzzwordy talks to every CFP. What could go wrong? Annnnnnnnyways πŸ‘‡ In Case You Missed It... 0-day Hunting Strategy with Eugene "Spaceraccoon" Lim - Following the release of his recent No Starch Press book, @spaceraccoonsec will be on tomorrow' ## exploits.club Weekly Newsletter 83: Windows Kernel and Xbox Exploit Research, Plus an LLM-Assisted Security Tool DevFeed: [exploits.club Weekly Newsletter 83: Windows Kernel and Xbox Exploit Research, Plus an LLM-Assisted Security Tool]() Original publisher: [Read original article]() Author: exploits.club Published: 2025-08-21T15:00:46Z Content type: article Language: en Sources: [exploits.club]() Topics: [Hacking](), [Windows](), [Linux Kernel](), [Large Language Model](), [Code]() Tags: [exploit](), [hacking](), [kernel](), [linux-kernel](), [llms](), [race-condition](), [vulnerability](), [windows]() ### AI overview This issue of the exploits.club weekly newsletter highlights a Phrack anniversary release, a Phrack CTF, research into a Windows kernel vulnerability that was adapted to target Xbox One, and a new LLM-related security analysis tool. The supplied text ends before the tool's details are complete. ### Source excerpt We are getting dangerously close to hacking fueled by PSLs. Get your cozy VS Code color schemes ready...Annnnnnyways πŸ‘‡ In Case You Missed It... Phrack 4oth Anniversary Release - If you weren't lucky enough to get snag a physical copy from one of the recent cons, the digital ## NixOS 25.05 released DevFeed: [NixOS 25.05 released]() Original publisher: [Read original article]() Author: NixOS Published: 2025-05-23T12:00:00Z Content type: release Language: en Sources: [NixOS Announcements]() Topics: [Nix](), [Release notes](), [releases](), [Linux](), [configuration](), [modules](), [Linux Kernel](), [distributed-systems](), [gcc](), [LLVM](), [upgrade]() Tags: [bugfixes](), [compilers](), [deprecated](), [end-of-life](), [features](), [gcc](), [kernel](), [linux](), [linux-kernel](), [llvm](), [nix](), [nixos](), [release](), [release-notes](), [updated](), [updates](), [version]() ### AI overview NixOS 25.05, codenamed "Warbler," is publicly available. The release adds and updates packages, introduces configuration modules and options, updates GNOME and the default Linux kernel, and updates LLVM and GCC. NixOS 25.05 receives bugfixes and security updates through 2025-12-31, while NixOS 24.11 reaches end of life after 2025-06-30. ### Source excerpt Hey everyone, we are Leona Maroni and Tristan Ross, the release managers of the newest release of NixOS. We are very proud to announce the public availability of NixOS 25.05 "Warbler". NixOS is a Linux distribution. Its underlying package repository Nixpkgs can also be used on other Linux systems and macOS with the Nix package manager. This release will receive bugfixes and security updates for seven months (up until 2025-12-31). The old release 24.11 "VicuΓ±a" is now officially deprecated and will reach its end-of-life and stop receiving security updates after 2025-06-30. NixOS Release Notes Highlights New Services Backward Incompatibilities Other Notable Changes Nixpkgs Release Notes Highlights Backward Incompatibilities Other Notable Changes Nixpkgs Library Upgrade Instructions ISO Image Downloads The 25.05 release was made possible due to the efforts of 2857 contributors, who authored 57054 commits since the previous release. Highlights NixOS is already known as the most up to date distribution while also being the distribution with the most packages. This release of Nixpkgs Added 7840 new packages Updated 28054 existing packages Removed 1694 outdated packages, in an effort to keep the package set maintainable and secure. In addition to packages from Nixpkgs, the NixOS Linux distribution also features composable configuration modules and integration tests for distributed systems. This release of NixOS Added 137 new modules and 1930 configuration options Removed 10 outdated modules and 215 configuration options. GNOME 48 GNOME has been updated to version 48 "Bengaluru", which introduces notification stacking, a new music player, HDR support, and more changes. Refer to the release notes for more details. Kernel The default Linux kernel has been updated from 6.6 to 6.12. All supported kernels remain available. C compilers LLVM has been updated to version 19. GCC has been updated to version 14. Special Thanks We want to personally thank Seth and raf for editorializin ## Blog: Detecting Supply Chain Attacks with Falco Actions DevFeed: [Blog: Detecting Supply Chain Attacks with Falco Actions]() Original publisher: [Read original article]() Published: 2025-03-19T00:00:00Z Content type: tutorial Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [supply chain attacks](), [GitHub Actions](), [Security](), [GitHub](), [Containers](), [Kubernetes](), [Linux Kernel]() Tags: [cicd](), [falco](), [github-action](), [github-actions](), [kubernetes](), [linux](), [linux-kernel](), [pull-request](), [runtime-security](), [security](), [software-supply-chain](), [supply-chain-attacks](), [supplychain]() ### AI overview This tutorial explains how to use Falco Actions in GitHub Actions workflows to detect suspicious behavior and software supply chain attacks in CI/CD pipelines. It covers runtime monitoring, custom rules, workflow setup, findings, and generated reports. ### Source excerpt The recently discovered CVE for the GitHub action tj-actions/changed-files brought to light a topic that is really critical for companies: supply chain attacks. With that, we want to discuss and show a bit about how Falco can help your organization detect this kind of attack and other suspect behaviors inside your CI/CD pipeline. What is Falco? Falco is a cloud native security tool that provides runtime security across hosts, containers, Kubernetes, and cloud environments. It leverages custom rules on Linux kernel events and other data sources through plugins, enriching event data with contextual metadata to deliver real-time alerts. Falco enables the detection of abnormal behavior, potential security threats, and compliance violations. What is Falco Actions? Falco Actions enable you to run Falco in GitHub Actions to detect suspicious behavior in your CI/CD workflows. If you run it in a pull request, the action will create a comment with the findings. Thanks to ad-hoc Falco rules specific to this use case, these GitHub actions can monitor your GitHub runner and detect software supply chain attacks. Using Falco Actions To have Falco inside your pipeline, you need to add these two actions: falcosecurity/falco-actions/start falcosecurity/falco-actions/stop Below you can see an example: name: CI on: push: pull_request: jobs: build: runs-on: ubuntu-latest permissions: contents: read actions: read steps: - uses: actions/checkout@v4 - name: Start Falco uses: falcosecurity/falco-actions/start@main with: mode: live falco-version: '0.40.0' verbose: true - name: My Custom Step run: | echo "This is my custom step" - name: Stop Falco uses: falcosecurity/falco-actions/start@main with: mode: live verbose: true OBS: main is being used here only to simplify how it works, you should always pin your dependencies to a specific commit SHA. After the execution, you will be able to see the results at the github action summary. If you want a more detailed report, you can use the action fal ## Supporter spotlight: Kees Cook on Linux kernel security DevFeed: [Supporter spotlight: Kees Cook on Linux kernel security]() Original publisher: [Read original article]() Published: 2024-09-29T00:00:00Z Content type: article Language: en Sources: [reproducible-builds.org]() Topics: [Linux Kernel](), [Security](), [open-source-security](), [free software](), [Arm](), [Ubuntu](), [Debian](), [Fedora]() Tags: [arm](), [canonical](), [debian](), [fedora](), [free-software](), [kernel](), [linux](), [linux-kernel](), [open-source-security](), [org](), [security](), [ubuntu]() ### AI overview This supporter spotlight interviews Kees Cook, founder of the Kernel Self-Protection Project, about his work improving Linux kernel security. He discusses kernel self-protection, recruiting expertise in ARM and memory management, and his earlier security-hardening work at Canonical on Ubuntu. ### Source excerpt The Reproducible Builds project relies on several projects, supporters and sponsors for financial support, but they are also valued as ambassadors who spread the word about our project and the work that we do. This is the eighth installment in a series featuring the projects, companies and individuals who support the Reproducible Builds project. We started this series by featuring the Civil Infrastructure Platform project, and followed this up with a post about the Ford Foundation as well as recent ones about ARDC, the Google Open Source Security Team (GOSST), Bootstrappable Builds, the F-Droid project, David A. Wheeler and Simon Butler. Today, however, we will be talking with Kees Cook, founder of the Kernel Self-Protection Project. Vagrant Cascadian: Could you tell me a bit about yourself? What sort of things do you work on? Kees Cook: I'm a Free Software junkie living in Portland, Oregon, USA. I have been focusing on the upstream Linux kernel's protection of itself. There is a lot of support that the kernel provides userspace to defend itself, but when I first started focusing on this there was not as much attention given to the kernel protecting itself. As userspace got more hardened the kernel itself became a bigger target. Almost 9 years ago I formally announced the Kernel Self-Protection Project because the work necessary was way more than my time and expertise could do alone. So I just try to get people to help as much as possible; people who understand the ARM architecture, people who understand the memory management subsystem to help, people who understand how to make the kernel less buggy. Vagrant: Could you describe the path that lead you to working on this sort of thing? Kees: I have always been interested in security through the aspect of exploitable flaws. I always thought it was like a magic trick to make a computer do something that it was very much not designed to do and seeing how easy it is to subvert bugs. I wanted to improve that fragility. In ## Nix Weekly Recap: 2024-06-02 DevFeed: [Nix Weekly Recap: 2024-06-02]() Original publisher: [Read original article]() Published: 2024-06-02T00:00:00Z Content type: article Language: en Sources: [nixpkgs.news]() Topics: [Nix](), [releases](), [Linux](), [Linux Kernel](), [AppImage](), [Perl]() Tags: [linux](), [linux-kernel](), [recap](), [release](), [release-notes](), [weekly]() ### AI overview A weekly recap covering the NixOS 24.05 release, selected highlights and breaking changes, Snowfall Lib v3 migration, and a call for gradle2nix v2 testers. ### Source excerpt The NixOS 24.05 release, Snowfall Lib v3, and a call for gradle2nix v2 testers. ## Blog: Introducing Falco 0.38.0 DevFeed: [Blog: Introducing Falco 0.38.0]() Original publisher: [Read original article]() Published: 2024-05-30T00:00:00Z Content type: release Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Linux Kernel](), [eBPF](), [configuration](), [Prometheus](), [Maintainers]() Tags: [announce](), [configuration](), [ebpf](), [falco](), [features](), [linux](), [maintainers](), [plugin](), [prometheus](), [release]() ### AI overview Falco 0.38.0 is released with changes to driver installation and selection, configuration file splitting, rule selection, field transformations, Prometheus metrics, and the Plugin API. The release also includes breaking changes and improved compatibility with Linux kernels through driver-loading and eBPF updates. ### Source excerpt Dear Falco Community, today we are happy to announce the release of Falco 0.38.0! This is the first Falco release since its graduation within the CNCF, and, as usual, brings many improvements and features alongside some pretty big changes in its configuration mechanism. This release brings an easier to use mechanism to install and configure your drivers, new rule language features, better support for Falco metrics and many more improvements. During this release cycle, we merged more than 100 PRs on Falco and more than 180 PRs for libs and drivers, version 0.17.0 and version 7.2.0 respectively. Thank you to our maintainers and contributors, as this would not happen without your support and dedication! To learn all about these changes, read on! What's new? TL;DR Key features: New capabilities in falcoctl to automatically select the best driver for your system and make it easier to install The Falco configuration file can now be split into multiple files to make it more manageable Rule selection from configuration file or command line Field transformers and value comparison Prometheus metrics support Plugin API improvements This release also comes with breaking changes that you should be aware of before upgrading. Major features and improvements The 0.38.0 release contains a number of feature and UX improvements, here are list of some of the key new capabilities. Driver loader magic ✨ If we could pick the most common issue that we've heard from adopters and we experienced first hand is the fact that sometimes we all struggle with installing and upgrading Falco drivers. The Falco team has been tirelessly working for years to improve the installation experience and Linux kernel compatibility with massive changes such as the introduction of the new CO-RE eBPF probe and most recently the complete rewrite of our driver loading component, integrated in falcoctl. With this new version of falcoctl, integrated in Falco 0.38.0, our loading tool will automatically detect your sys ## Mobian's PinePhone Kernel Support and the Loss of Cross-Distribution Collaboration DevFeed: [Mobian's PinePhone Kernel Support and the Loss of Cross-Distribution Collaboration]() Original publisher: [Read original article]() Author: Mobian team Published: 2023-10-10T00:00:00Z Content type: opinion Language: en Sources: [Mobian's Blog]() Topics: [Linux Kernel](), [Mobile](), [patches](), [Hardware]() Tags: [community](), [hardware](), [linux-kernel](), [mobile](), [patches]() ### AI overview Mobian reflects on the difficulties of maintaining support for the original PinePhone. The article argues that separate kernel trees and reduced cross-distribution collaboration left the community dependent on a small number of maintainers and created a single point of failure. ### Source excerpt Mobian started as a hobby project, triggered by the excitement of finally being able to hack one's mobile phone at will. It is fair to say that the device that made it possible back then was the original PinePhone. However, after running once again into the same difficulties we experienced over and over, we're wondering whether maintaining support for this device is still worth the effort... Of kernels and men In the beginning, the mobile Linux world was full of happy people, hacking on many different aspects of the system in a very disorganized but fruitful way, one of those aspects being the Linux kernel. Back then there was a single reference source tree, maintained under the PINE64 umbrella (but still being a community effort, no one being funded in any way to work on this kernel). Things were obviously not ideal, however many talented people were talking to each other, trying to improve hardware support and fix the many bugs we were experiencing at this point. Until, I don't quite remember how, it all turned into a race, in which the goal was to have better (or at least identical) support than the neighbouring projects. In particular, one very skilled developer set to solve many of the problems we had back then, and published their work as a separate repo. Several mobile distributions quickly switched to this kernel, effectively abandoning the shared kernel source we were all using until then. This resulted in a loss of interest and, ultimately, collaboration on the kernel ceased: some ended up using megi's kernel directly, while Mobian forked the "Pine64" one and cherry-picked interesting patches from megi's tree, but it all happened without further cross-distro discussions. Our single reference tree was then left rotting (the last kernel compatible with the PinePhone being based on 5.9, which was released nearly 3 years ago!) and unmaintained since then. A single point of failure The end result can be summed up as follows: those relying on megi's kernel depend ## What is SELinux? DevFeed: [What is SELinux?]() Original publisher: [Read original article]() Author: jakub.nyckowski@goteleport.com (Jakub Nyckowski) Published: 2022-12-13T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [SELinux](), [Access Control](), [Linux](), [Security](), [Linux Kernel](), [Framework]() Tags: [access-control](), [blog-post](), [deep-dive](), [framework](), [linux](), [linux-kernel](), [security](), [selinux]() ### AI overview This tutorial explains SELinux, its history, and how it provides Mandatory Access Control on Linux alongside traditional Discretionary Access Controls. It introduces Linux Security Modules and discusses related modules such as AppArmor, SMACK, and BPF. ### Source excerpt In this blog post, we'll deep-dive into SELinux. ## What You Need to Know About Linux Audit Framework DevFeed: [What You Need to Know About Linux Audit Framework]() Original publisher: [Read original article]() Author: jakub.nyckowski@goteleport.com (Jakub Nyckowski) Published: 2022-08-30T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [audit](), [Linux Kernel](), [Logging](), [Security]() Tags: [article](), [audit](), [linux](), [logging](), [security]() ### AI overview This deep dive explains the Linux Audit Framework, also known as auditd, and how it records system events for post-mortem analysis. It describes kernel-level auditing, configurable rules, event propagation through netlink, and filesystem storage of audit events. ### Source excerpt In this blog post, we'll deep-dive into Linux Audit Framework. ## Process Behaviour Anomaly Detection Using eBPF and Unsupervised-Learning Autoencoders DevFeed: [Process Behaviour Anomaly Detection Using eBPF and Unsupervised-Learning Autoencoders]() Original publisher: [Read original article]() Author: Simone Margaritelli Published: 2022-08-15T14:06:05Z Content type: tutorial Language: en Sources: [evilsocket]() Topics: [eBPF](), [Processes](), [Linux Kernel](), [Learning]() Tags: [ai](), [anomaly-detection](), [artificial-intelligence](), [autoencoder](), [bcc](), [cybersecurity](), [deep-learning](), [deep-neural-networks](), [defensive-security](), [dnn](), [ebpf](), [github](), [kernel](), [kprobe](), [kretprobe](), [linux](), [linux-security](), [machine-learning](), [neural-networks](), [process-anomaly-detection](), [process-behaviour](), [raw-syscalls](), [runtime-protection](), [sys-enter](), [syscall-tracing](), [tensorflow](), [tracepoint](), [unsupervised-learning]() ### AI overview This tutorial describes using eBPF syscall tracing and an unsupervised autoencoder to detect process behavior anomalies at runtime. It explains an approach that models syscall frequency without requiring an explicit allowlist and discusses potential detection of exploitation, denial-of-service, and other attacks. ### Source excerpt Hello everybody, I hope you've been enjoying this summer after two years of Covid and lockdowns :D In this post I'm going to describe how ## epoll: The API that powers the modern internet DevFeed: [epoll: The API that powers the modern internet]() Original publisher: [Read original article]() Author: Graham King Published: 2022-01-03T23:46:10Z Content type: tutorial Language: en Sources: [Graham King]() Topics: [Linux](), [networking](), [Linux Kernel](), [systems](), [Programming]() Tags: [epoll](), [history](), [linux](), [linux-kernel](), [network-programming](), [networking](), [programming](), [software]() ### AI overview This article explains how Linux's epoll API addresses the C10K problem by efficiently handling network connections while clients or servers wait for data. It connects epoll with Go and nginx server software and contrasts it with process and thread pools, while noting related polling approaches on other operating systems. ### Source excerpt Linux's epoll API solved the C10K problem, enabling fast and afforable Internet services. ## PinePhone Pro support status in Mobian DevFeed: [PinePhone Pro support status in Mobian]() Original publisher: [Read original article]() Author: Mobian team Published: 2021-12-28T00:00:00Z Content type: article Language: en Sources: [Mobian's Blog]() Topics: [Mobile](), [Linux](), [Linux Kernel](), [Hardware](), [4g lte](), [Bluetooth]() Tags: [4g-lte](), [bluetooth](), [boot](), [configuration](), [hardware](), [linux](), [linux-kernel](), [mobile](), [modem](), [patches]() ### AI overview This article reports early Mobian support for the PinePhone Pro. It describes hardware enablement, Linux kernel and boot patches, a Mobian image that boots into Phosh, working 4G connectivity with SMS/MMS and mobile data, and remaining challenges with phone-call audio routing. ### Source excerpt Pine64 recently announced the PinePhone Pro, a significantly upgraded version of their PinePhone. As developers started receiving their devices earlier this month, significant progress have been made already to get existing mobile distributions, including Mobian, to run on this new Linux phone. Keep reading for the latest status updates on the PinePhone Pro support. Initial hardware enablement The PinePhone Pro was designed in such a way that it is an easy device to work with: it is based on a Rockchip RK3399 SoC, for which mainline kernel support is really good, and switched to a Broadcom/Cypress WiFi/Bluetooth chipset, supported by the mailine bcrmfmac kernel driver. Moreover, the modem is the same model as the one used in the OG PinePhone: despite its numerous drawbacks, it is a well-known unit and we can already provide workarounds for its most significant issues. @megi and @MartijnBraam, which both had access to early prototypes of this device, did an awesome job at bringing up the device and providing patches for u-boot and the Linux kernel. This allowed distribution developers to boot the PinePhone Pro with very little effort and start improving on an already solid basis. As a matter of fact, only a few hours were necessary to craft a Mobian image able to boot into Phosh on the PinePhone Pro! Making the notification LEDs, flash light and orientation sensors to work as nicely as they do on the OG PinePhone was only a matter of few more hours (if not minutes) of additional hacking. Getting 4G/LTE connectivity As mentioned above, the PinePhone Pro uses the same exact modem as the OG PinePhone. As a consequence, only a limited amount of software changes were necessary to get it to work on Mobian. Using the latest versions of both ModemManager and eg25-manager, the modem is automatically powered on and able to connect to 4G networks, with both SMS/MMS and mobile data being fully functional. Giving and receiving phone calls Phone calls are another problem, as those ## Preventing Data Exfiltration with eBPF DevFeed: [Preventing Data Exfiltration with eBPF]() Original publisher: [Read original article]() Author: info@goteleport.com (Eugene Yakubovich) Published: 2021-07-22T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [eBPF](), [Security](), [Linux Kernel](), [data](), [Instrumentation](), [ssh]() Tags: [data](), [ebpf](), [linux-kernel](), [security](), [ssh]() ### AI overview An introduction to Kernel Runtime Security Instrumentation (KRSI), explaining how Linux Security Module hooks and eBPF can support dynamic policies to prevent data exfiltration based on IP ranges. ### Source excerpt An introduction to KRSI and how you can use it to dynamically prevent data exfiltration based on IP ranges. ## What is eBPF? | How eBPF works DevFeed: [What is eBPF? | How eBPF works]() Original publisher: [Read original article]() Author: info@goteleport.com (Virag Mody) Published: 2020-11-05T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [eBPF](), [Linux Kernel](), [Kernel](), [Code]() Tags: [bytecode](), [ebpf](), [kernel](), [linux-kernel](), [operating-systems]() ### AI overview This tutorial introduces eBPF, explaining how it lets programmers execute custom bytecode within the Linux kernel without modifying the kernel or loading kernel modules. It also covers kernel space, user space, and the motivation for extending the kernel. ### Source excerpt eBPF lets programmers execute custom bytecode within the kernel without having to change the kernel or load kernel modules. [Next page]()