LWN on Slop, Kernel, IBM Against Choice, and C Code

posted by Roy Schestowitz on Nov 12, 2026

GNU/Linux

• Kernel Space / File Systems / Virtualization

  • LWN ☛ Containers as a recognized kernel object

    The foundation of the design for containers in the kernel is that there isn't one; there is no container abstraction that the kernel recognizes. Instead, the kernel provides a long list of components — namespaces, control groups, sandboxing mechanisms, and more — along with a note that says, in effect, "some assembly required". There have been attempts (repeatedly) over the years to turn containers into first-class objects with kernel support, but they have never gotten far. Now Josef Bacik is making a try with a concept that he calls "cells".

  • LWN ☛ Managing the kernel CVE flood

    We recently looked at how the kernel community is dealing with the firehose of vulnerability reports, but said little about how users of the kernel are responding. At the 2026 Linux Plumbers Conference, Amazon employees Dylan Johnson and Justinien Bouron discussed the problem from the point of view of engineers trying to keep AWS running and secure in the face of a storm of CVE disclosures. The kernel community's longstanding advice is to run current kernels, and that turns out to work — sort of.

    Bouron started by reminding the audience that the kernel community became its own CVE numbering authority (CNA) in 2024. The immediate result was the issuance of thousands of CVE numbers every year, forcing companies to rethink how they handle kernel vulnerabilities. The engineers running the AWS cloud were not immune to this change.

  • LWN ☛ The second part of the 7.4 merge window

    The 7.4 merge window, which closed on November 1, included a record-breaking 18,591 non-merge changesets. That is almost as many as the entire 7.3 development cycle, which had 18,765, itself a record breaker. Of those, 11,838 landed after the article covering the first part of the merge window. Most of those were bug fixes of various forms; it seems as though bug fixes may be crowding out feature additions across the open-source ecosystem to some extent. Still, a good number of new features were included, and a handful removed, in the tail end of the merge window.

• Desktop Environments (DE)/Window Managers (WM)

  • K Desktop Environment/KDE SC/Qt

    • LWN ☛ Plasma X11 session removal surprises some Fedora users

      The KDE Project announced, in 2025, that Plasma 6.7 would be the last version of the desktop environment that would support X11 sessions. Those who keep up with KDE's announcements no doubt expected it when Plasma 6.8 dropped X11 support as promised. What seems to have come as a surprise, at least to a number of Fedora KDE Plasma Desktop users, is that the Fedora 44 release—which shipped in April with Plasma 6.6—received an update to Plasma 6.8 that swept away the X11 session without much warning. Despite the surprise, it is gone for good: the Fedora Engineering Steering Committee (FESCo) has voted against a request to revert the update for Fedora 44 and the just-released Fedora 45.

• Distributions and Operating Systems

  • Debian Family

    • LWN ☛ LLM reviews for Debian's new queue spark debate

      The Debian project has wrestled with the topic of LLM usage for years, which culminated in a general-resolution vote this August. The project voted in favor of the fifth, out of eight, option: "Responsible Use of Generative AI". With the door open to LLM use, the DFSG, Licensing & New Packages Team (usually shortened to "DFSG team"), which is relatively new, has started to employ LLMs in sending out reviews of packages entering Debian's new queue. The practice has raised a number of objections and questions about where lines should be drawn in the use of LLM-generated output.

      [...]

      Uploaders receive an email generated by the LLM that states the review was performed by an LLM and is not a review by a member of the DFSG team, with a disclaimer that its review may be incorrect or incomplete. According to McMillan's commit message, if the LLM review claims that there is a blocker or important licensing issue in an upload then it is held from the queue for 24 hours. That seems to be in conflict with the FAQ, though, which states that uploads appear on the dashboard within ""a little more than an hour"". A feature to allow uploaders to answer or reject the LLM review was added on October 19. If the uploader comments, the hold is ended. If there is no comment, then the upload is docked 50 points under the DFSG queue scoring system. According to another commit a response adds 25 points. Note that the scoring system is somewhat opaque, there is no list I could find that spelled out the scoring explicitly. At the moment, the package at the top of the dashboard (bucklespring) has been in the queue for three days, and it has 424 points. At the bottom of the board is a package with only 23 points (openbor) that has been in the queue for seven hours.

• Free, Libre, and Open Source Software

  • Programming/Development

    • LWN ☛ Removing binder.c

      The final talk at Kangrejos 2026 was about the removal of the C implementation of Android's Binder driver, the primary interprocess communication mechanism used on Android devices. Carlos Llamas announced that he had deleted the C code to general applause, and then shared some insights about what went into replacing the C implementation. Alice Ryhl, who has worked on the Rust implementation for some years, added her own thoughts about what the most difficult and interesting parts of the transition were.

      Binder was added to the kernel in 2008, Llamas said, as an interprocess communication mechanism for Android devices. Its design originated in BeOS, but it has grown significantly since then. It provides a rich set of operations for allowing processes to communicate with the minimum amount of overhead. It also, therefore, presents a large attack surface for Android. Many complicated chained attacks against Android have involved Binder at one step or another, Llamas explained. Google's internal "red team" (the team dedicated to proactive security research) deemed Binder to be the most vulnerability-dense component in the entire operating system, with more CVEs per line than anywhere else.

    • LWN ☛ System-call wrappers for glibc

      In a followup to his session at the 2025 Linux Plumbers Conference (LPC), Carlos O'Donell returned to the topic of system-call wrappers for the GNU C library (glibc) at this year's event. This time around, he was joined by Florian Weimer, who is another glibc maintainer. The idea was to give an update on what has happened over the last year with regard to Linux system calls that lack a glibc wrapper, thus are only accessible via syscall(). In addition, they wanted to hear from attendees about their needs in this area.

    • Python

      • LWN ☛ Portable Python scripts with dependencies

        A basic Python script is portable: it can be copied between machines with little concern about compatibility. A script that depends on third-party packages requires quite a bit more care and consideration, however. In 2023, PEP 723 ("Inline script metadata") introduced a standard for declaring a Python script's dependencies inside the script itself. Several third-party tools can now automatically install and manage those dependencies, but there is still little official support for this standard within Python itself.