[$] LWN.net Weekly Edition for January 22, 2026
Inside this week's LWN.net Weekly Edition:
Front: Singularity; fsconfig(); io_uring restrictions; GPG vulnerabilities; slab
allocator; AshOS.
Briefs: Pixel exploit; telnetd exploit;
OzLabs; korgalore; Firefox Nightly RPMs; Forgejo 14.0; Pandas 3.0; Wine 11.0;
Quotes; ...
Announcements: Newsletters, conferences, security
updates, patches, and more.
[$] Cleanup on aisle fsconfig()
As part of the process of writing man pages for the "new"
mount API, which has been available in the kernel since 2019, Aleksa Sarai
encountered a number of places where the fsconfig() system call—for configuring
filesystems before mounting—needs to be cleaned up. In the 2025 Linux Plumbers
Conference (LPC) session that he led, Sarai wanted to discuss some of the
problems he found, including at least one with security implications. The idea
of the session was for him to describe the various bugs and ambiguities that he
had found, but he also wanted attendees to raise other problems they had with
the system call.
Pandas 3.0 released
Version 3.0.0 of the pandas data analysis and manipulation
library for Python has been released. Notable changes include a dedicated string
type (str), new "copy-on-write" behavior, and much more. This release also
removes a number of features that were deprecated in prior versions of pandas;
developers are advised to upgrade to pandas 2.3 and ensure code is working
without warnings before moving to 3.0. See the release notes for the full
changelog.
[$] Responses to gpg.fail
At the 39th Chaos Communication Congress (39C3) in
December, researchers Lexi Groves ("49016") and Liam Wachter said that they had
discovered a number of flaws in popular implementations of OpenPGP email-
encryption standard. They also released an accompanying web site, gpg.fail, with
descriptions of the discoveries. Most of those presented were found in GNU
Privacy Guard (GPG), though the pair also discussed problems in age, Minisign,
Sequoia, and the OpenPGP standard (RFC 9580) itself. The discoveries have
spurred some interesting discussions and as well as responses from GPG and
Sequoia developers.
Security updates for Wednesday
Security updates have been issued by AlmaLinux (brotli and
container-tools:rhel8), Debian (python-keystonemiddleware and python3.9), Fedora
(cef, freerdp, golang-github-tetratelabs-wazero, and libpcap), Oracle (brotli,
gpsd, kernel, and transfig), Red Hat (freerdp, golang, java-11-openjdk with
Extended Lifecycle Support, libpng, libssh, mingw-libpng, and runc), SUSE
(abseil-cpp, alloy, apache2, bind, cpp-httplib, curl, erlang, firefox, gpg2,
grafana, haproxy, hauler, hawk2, libblkid-devel, libpng16, libraylib550, python-
keystonemiddleware-doc, python-uv, python-weasyprint, squid, and tomcat), and
Ubuntu (crawl and iperf3).