Debian’s Advanced Package Tool (APT) is the suite of utilities that handle package
management on Debian and Debian-derived operating systems. APT recently received a
major upgrade to 3.0 just in time for inclusion in Debian 13
(“trixie”), which is planned for release sometime in 2025. The version bump is
warranted; the latest APT has user-interface improvements, switches to Sequoia to verify package
signatures, and includes solver3—a new solver that is designed to improve
how it evaluates and resolves package dependencies.

GNOME contributor Michael Catanzaro has written a blog
post about a noteworthy vulnerability in GNOME’s help browser, Yelp.

I don’t normally blog about particular CVEs, but Yelp CVE-2025-3155 is
noteworthy because it is quite severe, public for several weeks now,
and not yet fixed upstream. In short, help files can read your
filesystem and execute arbitrary JavaScript code, allowing an attacker
to exfiltrate any files your Unix user has access to.

The vulnerability was first reported on December 25, and it
was made public on March 26 after the 90-day-disclosure deadline
was reached. Patches
have been proposed to fix the issue. The bug reporter has published a writeup
demonstrating the attack. Catanzaro asks that Linux vendors
“please consider applying the provided patches even though they
have not yet been accepted upstream“.

Now that Mesa 25.1 is branched for this quarter’s Mesa 3D feature release, Mesa 25.2 has entered development on the main Git branch. One of the first merged changes for Mesa 25.2 is removing the old OpenCL Gallium3D “Clover” driver…

This roundup looks at the finest software-defined radio tools for Linux including apps that let you listen to DAB and DAB+ broadcasts.

Allowing directories to be modified in parallel was the topic of Jeff
Layton’s filesystem-track session at the 2025 Linux Storage, Filesystem,
Memory Management, and BPF Summit (LSFMM+BPF). There are certain use
cases, including for the NFS and Lustre filesystems, as mentioned in a patch set
referenced in the topic
proposal, where contention in creating multiple files in a directory is
causing noticeable performance problems. In some testing, Layton has found
that the inode read-write semaphore (i_rwsem) for the directory is
serializing operations; he wanted to discuss alternatives.

Intel open-source software engineers last week posted a set of patches for a new driver: iXD. The three letter acronym party continues and this time even more difficult to decipher than some of their other obscure driver names…

The BPF verifier is not magic; it cannot solve the

halting problem. Therefore,
it has to err on the side of assuming that a program will run too long if it
cannot prove that the program will not.
The ultimate check on the size of a BPF program is the
one-million-instruction limit — the verifier will refuse to process more than
one-million instructions, no matter what a BPF program does. Alexei Starovoitov gave
a talk at the 2025 Linux Storage, Filesystem,
Memory-Management, and BPF Summit about that limit,
why correctly written BPF programs shouldn’t hit it, and how to make the user
experience of large BPF programs better in the future.

Eric Engestrom is once again stepping up to manage the next quarterly Mesa driver feature release and thus today we have the on-time branching of Mesa 25.1 from Mesa Git and already the release of Mesa 25.1-rc1. This release brings many improvements to the collection of open-source OpenGL and Vulkan drivers that should be ready for their stable debut in May…

The Fedora Asahi SIG and Asahi Linux projects announced the general availability of Fedora Asahi Remix 42 as the latest version of this distribution developed for Apple Silicon Macs.

With today’s launch of the GeForce RTX 5060 Ti graphics card, NVIDIA has also introduced their first Linux driver beta in the R575 driver series…

Merged last month to the widely-used FFmpeg open-source multimedia library was an initial Vulkan-based decoder for FFV1 for the FF Video 1 lossless video coding format. Should you be interested in using this FFV1 decoder on AMD GPUs, there’s a reported 3x performance improvement with the newest code…

This comprehensive guide will walk you through both GUI and CLI methods to safely upgrade your Fedora 41 system to Fedora 42.

The makers of the Fedora-based Ultramarine Linux distribution released today the ISO images of the Ultramarine 41 release, which is built on top of Fedora Linux 41 and was already available for existing users.

WordPress 6.8 CMS, codenamed “Cecil” is out, featuring faster page loads, stronger password security, and a redesigned Style Book.

The GNOME Help Browser “Yelp” for viewing HTML / man page / DocBook and other documentation formats from the GNOME desktop is subject to a yet-to-be-patched-upstream security vulnerability that is now public and can allow for arbitrary file reads and could be funneled through your web browser…

In this advice column, an IT pro seeks recommendations for free tools, particularly for automation and monitoring.

In the first filesystem-track session at the 2025 Linux Storage,
Filesystem, Memory Management, and BPF Summit (LSFMM+BPF), virtual
filesystem (VFS) layer co-maintainer Christian Brauner had a few different
topics he wanted to talk about. Issues on the agenda
included iterating through anonymous mount namespaces, a needed feature
for ID-mapped mounts, the perennial unprivileged mounts topic, potentially
using hazard pointers for file reference counting, and Rust bindings. He
did not expect to get through all of them in the 30 minutes allotted, but
the session did move along pretty quickly to at least
introduce them to the assembled filesystem developers.

Uri Herrera from the Nitrux Project unveiled today NX AppHub, a new system for managing and building applications for the Debian-based, systemd-free, and immutable Nitrux Linux distribution.

Duplicati is a backup client that securely stores encrypted, incremental, compressed backups on cloud storage services and remote file servers.

Security Week is one of several outlets reporting
that the funding for the CVE program at MITRE disappears as of
April 16.

Maintained by MITRE Corporation, a not-for-profit organization that
operates federal R&D centers, the CVE program is funded through
multiple channels, including the U.S. government, industry
partnerships, and international organizations.

Earlier this month, in anticipation of the US government funding
cuts, MITRE initiated layoffs that affected more than 400 employees
in its Virginia office. The cuts were ordered after the Trump
administration announced more than $28 million in canceled
contracts for the company.