Connexion
The Debian Linux project has opened a call for community artwork submissions ahead of the release of the upcoming Forky (Debian 14). If you think you've got the artistic chops, your art could appear on the boot screens, login prompts, and desktop wallpapers of millions of users. The submission deadline is November 26.
Continuing Debian's community-driven ethos, the artwork submission process mirrors that of previous releases. The artwork must feel distinctively "Debian," integrate cleanly without the need for core software patching, and remain visually appealing for the long term.
Elise Couper's "Ceratopsian" theme was chosen as the winning default for Debian 13 Trixie. For anyone who might not be up on the latest from the Toy Story franchise, the release names echo character names from the animated films. Trixie was a triceratops introduced in Toy Story 3, hence the "Ceratopsian" wink in the winning submission. It makes sense that the next version of Debian continues this trend with Forky, a character introduced in the franchise's fourth entry. The Debian team cautions against overly busy designs that may cause user fatigue, but if anyone can successfully incorporate Forky's googly eyes into the design somehow, know that you'd at least win the contest for my Debian desktop wallpaper.
This week, the Model Context Protocol (MCP), an open source standard for how AI systems interact with external tools and data sources, saw its largest update since its introduction. Most notably, MCP's protocol core is now stateless, so requests are no longer dependent on a session tied to an individual server instance. This change has the potential to address long-standing barriers to scalability.
The blog post announcing the specification, written by lead maintainers David Soria Parra and Den Delimarsky (who both work at Anthropic), says:
As the Steam Deck slowly marches toward its fifth birthday next February, owners are likely eager for a way to extend its life rather than investing in expensive high-end competition. A new patch for AMD's Linux drivers could substantially reduce low-end frame hitches when the Steam Deck or other AMD-based gaming hardware is running in Energy Performance Preference (EPP) mode.
Writing on the Linux kernel mailing list (thanks, Phoronix), kernel coder David Vernet lays out the basic problem that games often face in EPP mode. When a busy thread frequently goes to sleep for short periods, the current AMD driver can misinterpret that behavior as a signal to lower its average performance target. When those threads wake up, they start at a lower-than-desired frequency, leading to increased frame latency, stale frames, and longer frame generation times at the low end of the distribution.
Shifting the processor to "performance" mode fixes this problem but eliminates the energy savings that EPP mode is supposed to provide. And simply boosting the affected thread's minimum performance target permanently actually makes low-end performance worse, thanks to the complexities of CPU/GPU boost management.
Researchers have analyzed a high-severity vulnerability in Linux that’s able to escalate untrusted users to root by exploiting a bug you don't often see: a single errant character inside the kernel.
The vulnerability, tracked as CVE-2026-23111, is located in nf_tables, a subsystem of the Linux kernel that provides packet filtering capabilities. It’s used to manage firewall rules and replaces older subsystems such as iptables, ip6tables, arptables, and ebtables.
The presence of a single mis-issued exclamation point in code implementing nf_tables introduced a use-after-free, a class of vulnerability that corrupts memory by placing malicious code at memory addresses that haven’t been properly freed of their previous contents. CVE-2026-23111 can be exploited by an unprivileged user or process to elevate system rights to root.
Linux users have been bitten by yet another vulnerability that gives containers and untrusted users the ability to gain root access, marking the second time in as many weeks that a severe threat has caught defenders off guard.
The threat, known as Dirty Frag, allows low-privilege users, including those using virtual machines, to gain root control of servers. Attacks are particularly suitable in shared environments, where a server is used by multiple parties. Hackers can also gain root as long as they have access to a separate exploit that gives a toehold into a machine. Exploit code was leaked online three days ago and works reliably across virtually all Linux distributions. Microsoft has said it has spotted signs that hackers are experimenting with Dirty Frag in the wild.
The leaked exploit is deterministic, meaning it works precisely the same way each time it’s run and across different Linux distributions. It causes no crashes, making it stealthy to run. A vulnerability known as Copy Fail, disclosed last week with no patches available to end users, possesses the same characteristics.
Last year, we noted how the long-standing vagaries of HDMI licensing and open source AMD driver development combined to prevent the upcoming Steam Machine from receiving official support for the HDMI 2.1 display standard. Now, though, it seems that AMD is making real progress on adding full HDMI 2.1 compliance to its Linux amdgpu driver in the near future.
In patch series notes for an amdgpu driver update posted on Friday (and noticed by Phoronix), AMD's Harry Wentland says that the company is finally adding HDMI FRL (Fixed Rate Link) support to the popular Linux display driver. That's the feature that allows for higher bandwidth on compatible HDMI cables compared to the TMDS standard found on HDMI 2.0 and earlier. That in turn enables direct support for higher resolutions, dynamic HDR, and features like Variable Refresh Rate that aren't supported in HDMI 2.0.
Wentland notes that this update is still just "a representative subset of HDMI compliance," in part because it is missing the code to support the Display Stream Compression (DSC) that allows for even higher resolutions and frame rates up to 10K at 100 Hz. But Wentland adds that DSC support "is still being tested and will be sent out later," and that "a full compliance run" for HDMI 2.1 is "in the works." An AMD driver developer with the handle agd5f also commented on Phoronix, noting that "a full implementation [of HDMI 2.1] will ultimately be available once the patches are ready and have completed compliance testing."
Publicly released exploit code for an effectively unpatched vulnerability that gives root access to virtually all releases of Linux is setting off alarm bells as defenders scramble to ward off severe compromises inside data centers and on personal devices.
The vulnerability and exploit code that exploits it were released Wednesday evening by researchers from security firm Theori, five weeks after privately disclosing it to the Linux kernel security team. The team patched the vulnerability in versions 7.0, 6.19.12, 6.18.12, 6.12.85, 6.6.137, 6.1.170, 5.15.204, and 5.10.254) but few of the Linux distributions had incorporated those fixes at the time the exploit was released.
The critical flaw, tracked as CVE-2026-31431 and the name CopyFail, is a local privilege escalation, a vulnerability class that allows unprivileged users to elevate themselves to administrators. CopyFail is particularly severe because it can be exploited with a single piece of exploit code—released in Wednesday’s disclosure—that works across all vulnerable distributions with no modification. With that, an attacker can, among other things, hack multi-tenant systems, break out of containers based on Kubernetes or other frameworks, and create malicious pull requests that pipe the exploit code through CI/CD work flows.
Lateo.net - Flux RSS en pagaille (pour en ajouter : @ moi) 
