This site wins the internet for the week: https://www.getrandomnumber.org/

I'm not sure claiming "everything is on fire" is the correct takeaway here

There is a pile of flammable materials we've been ignoring for decades. It catches on fire sometimes. It caught on fire a lot this week

And the people who put out the fires, for free, put the fire out again

The current plan is to just keep throwing more oily rags on the pile. We could try to help the volunteers, but that costs more than adding oily rags to the pile

New usbutils release: https://lore.kernel.org/all/atmyfUVyCnr5WnJh@kroah.com/

⏳ 2 weeks left to nominate for the European Open Source Awards 2027!

The European Open Source Awards exist to make the quiet work visible, and to celebrate the individuals and communities advancing innovation, collaboration and digital sovereignty in Europe.

👉 Nominate by 1 November: https://awards.europeanopensource.academy/nomination-process

#EOSAwards #OpenSource #EuropeanOpenSourceAcademy

Gave a 2+ hour lecture at vu.nl today about Linux kernel development and security things that was a lot of fun, the students had great questions about a huge range of relevant topics.

Afterward a student gave me a vanilla cake baked by their grandmother.

Best speaker gift ever.

Claude.ai rightly points out that when reviewing code, we should focus on the code and not on its author.

We all hate this

@gregkh dropping necessary bombs about LLMs in Linux security and development.

https://www.youtube.com/watch?v=NnV_cWeoo5Q

The purported 79 vulnerabilities were mostly bogus (not a bug, fabricated data) or had already been patched; the few real (all very minor) bugs took him an hour to fix. He says "do not panic", and emphasizes that time to apply patches is the main vulnerability these days (not an LLM problem).

"These are pattern-matching tools", "they do not have intent". (Vindicating to @emilymbender and @timnitGebru re "stochastic parrots"; it was accurate at the time and accurate today, protestations from boorish AI boosters notwithstanding.)

New code is 50% wrong, generated code is littered with new vulnerabilities; need to reject a lot but believes review processes are adequate to prevent a shipping a flood of LLM-generated vulnerabilities.

High false-positive rates make the models incredibly irritating. Cf. Coverity's post-mortem with a deterministic tool that had low false-positive rates.

Push back hard [on corporate marketing to developers]

With regard to higher CVE rates:

We'll grind it down like we did with the fuzzers.

If you want to look for bugs with an LLM (which amounts to fuzzy pattern-matching), use a local model and never upload to platforms.

I have banned LLMs from driver staging, unless you have the hardware and can prove you have tested the patch. That's not what staging is for. Staging is to learn how to do development and get involved with our community. [...] Kernel development is all about trust. If I take patches from you and I don't know who you are, now I am responsible for that patch. [...] You need to build up trust.

It's put a lot of additional burden on us, as maintainers.

Here's a bit more up to date version of the "how many CVEs have we fixed" stats than what I showed earlier this week at @KernelRecipes as I was able to catch up on some reviews on my way home on the train.

Also cve.org just crossed the 100000 numbering barrier just now, first time that ever has happened, hopefully no scripts broke. And yes, the kernel.org CNA has CVE-2026-100000 reserved, need to find a "good" bug for that one, suggestions welcome!
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx

#Linux 7.3, since a few hours ago, will definitely be the #kernel with the most commits, as right now it already has 18.672 (17.410 if you ignore merges).

The previous record holder was 6.7, which had 18.404 (17.284) -- and was bigger than other releases at that time because it contained nearly 3,000 commits of bcachefs history.

For more stats on #LinuxKernel releases, see https://docs.google.com/spreadsheets/d/1_yH7lFmZxAoSWrtsd8tGu3befG4zIcMnytB1ml4pQQM/edit?usp=sharing

Slides from my Kernel Recipes talk.

https://slides.com/mricon/maintainer-container

Also attached as PDF.

My secret kernel review tools were spotted in the back of the @KernelRecipes room

Kairui Song is starting the last day of the conference : Swap and Memory Reclaim: Squeezing Out More RAM

What was SWAP subsystem before and now: Too many indirections kill indirections

What kernel maintainers think of bots, in four slides:

they talk: endless changelogs nobody asked for
they flood: dozens of "fix leak" patches before your first coffee
they lie: the "best" models are still wrong half the time
they leak: whatever you tell them, they'll tell someone else

So basically... the perfect coworker!
#kr2026

Survival guide for the age of bots, #kr2026 edition:

If it feels wrong, it probably is
Ignore the doom marketing
Keep your models at home
NEVER feed them anything non-public
Found a bug? Fix it. Today. Yourself.

Meanwhile, the kernel security team now asks for a patch with your report. Revolutionary concept.

@gregkh on stage: LLMs and us

FEAAAAAR!!!!!

"Executives working on AI at Microsoft and OpenAI admitted what its critics have been saying all along: Large language models are predatory pieces of technology that have been built on what a Microsoft executive called “an astonishing theft of unprecedented proportions,” and the “largest theft of labor in human history.” An internal Microsoft document said generative AI products have created a “doom loop” that is killing “the entire web.”"

(Article title: ‘Doom Loop’: OpenAI and Microsoft Admits LLMs Are Destroying the Web and Built on Theft)

https://www.404media.co/doom-loop-openai-and-microsoft-admits-llms-are-destroying-the-web-and-built-on-theft/

"for months on end now, most of our teams have just been triaging bugs and coordinating releases. It has truly taken all the fun out of the job"

https://blog.nlnetlabs.nl/maintaining-the-love-for-coding-in-the-time-of-ai/

Looks like the legacy C implementation of the #Binder IPC driver will soon be removed from #Linux in favor of its #Rust version:

https://lore.kernel.org/all/rm-c-binder@google.com/

""Long live the new Rust Binder king!""

#Rustlang #LinuxKernel #Kernel

This might be a “record” for stable kernel -rc releases. Not really a record I want to ever beat…

     version  queued
	5.10:	 798
	5.15:	 935
	6.1:	1191
	6.6:	1424
	6.12:	1376
	6.18:	1518
	7.2:	1815
	total:	9057

The September 11 CRA reporting milestone is here.

Our new community guide explains manufacturers’ reporting obligations and how open source maintainers and stewards can prepare for collaboration when vulnerabilities affect downstream products.

https://openssf.org/blog/2026/09/11/a-community-guide-to-the-eu-cra-september-11-deadline-for-manufacturers/