Linus Torvalds has a new branch in his own kernel repository named noref-filemap-read-with-llm.
It holds an eight-patch series built on Linux 7.3-rc6 plus fixes, and its commit message gives no kernel release target for merging it.
While the commit message is long and technical, the change itself is easy to describe.
What he changed
When many threads read the same file, the kernel serves them from the page cache, its in-memory copy of recently read data. Today, each read takes a hold of the cached data and releases it afterwards.
Every thread updates the same counter to do so, resulting in the threads tripping over each other. The issue dates to 2024, when Matthew Wilcox flagged it, citing a customer's workload.
Linus' series of patches skips that step. To make that safe, memory that leaves the cache is not handed out for reuse until a short period has passed, so a reader can copy data straight out without holding anything.
The cost is that more memory sits idle for a moment.
The payoff, measured on his own laptop with some security protections switched off, is that eight threads reading one file went from about 10 million reads per second to between 30 and 33 million.
Linus ran the measurements himself, but for the rest, the commit message credits Claude Code, working under his direction. That includes a draft of the message itself, the code and test programs, and the review behind its list of known problems.
This is not the first time he has used AI on kernel work. In August, he used it to help fix a bug in the Intel Xe graphics driver.
What he said in Prague
Linus spoke with his long-time friend, Dirk Hohndel, the head of Ericsson Software Technology, at Open Source Summit Europe in Prague on Friday.
ZDNet's Steven Vaughan-Nichols, who was in attendance, quotes Linus, saying, "I actually really like using AI."
He said he used to think AI was not very good but has changed his mind. In his view, it works well as long as it is treated as a tool, and it makes programming more enjoyable for him.
His own example was a guitar pedal project with an interface he had written in C. He wanted a more modern look and tried AI for it, saying, "I use AI to do the things that I'm bad at."
He also defended vibe coding as "a wonderful way to find joy in programming," mainly for newcomers, and says that while AI is improving the code base, the load it puts on maintainers has become a real problem.
This again shows how much Linus’ stance has changed when it comes to AI. In 2024, he called the AI industry "90 percent marketing and 10 percent reality." Now, he is actively using it for kernel work.
A Fixes tag in a kernel patch points to the commit that introduced the bug, but the last commit to touch a buggy line may only have moved the code to a new file.
Sasha Levin, who co-maintains the stable and long-term support kernel trees, wants AI coding assistants to verify which commit introduced a bug before assigning it a Fixes: tag.
His two-patch series went to the workflows and ksummit mailing lists last week, where he has proposed a new agents directory in the kernel tree to hold the skill that does it.
The new directory
The first patch adds an agents/ directory at the top of the kernel source tree for skills, prompts, and other resources meant for coding assistants. It also adds a MAINTAINERS entry covering the directory.
Each skill gets its own folder under agents/skills/, with a SKILL.md file as its entry point, written in the Agent Skills format.
Assistants are told to read a resource directly from its path in the repository, and links inside a skill are relative to that skill's folder. A new section in the kernel's coding assistants document is meant to describe this layout.
The find-fixes skill, which arrives with the second patch, would be the first one in the directory.
Why do Fixes tags go wrong?
Levin says the series traces back to a question from Ted Ts'o about incorrect tags in stable tree work. He pointed to LLM workflows that help find the right commit.
Ted later explained that the request came from a talk with Hannes Reinecke, who estimated that 15 to 20 percent of Fixes tags are wrong.
That matters beyond bookkeeping, since the tag is how stable maintainers and distributions work out which kernels need a given fix. A wrong one can send a fix to the wrong branches or leave a bug unpatched.
The new find-fixes skill reads Git history and returns a proposed tag with its evidence, while leaving the commit itself untouched.
The skill's guide.rst file says no single clue settles which commit a Fixes tag should name, not even an existing tag. The agent explains how the bug fails, traces candidate commits, and compares each against its parent.
It separates the commit that added the code, the one that made it defective, and any later change that only exposed the flaw.
For backported fixes, it checks whether the bug came from the original change or from how that change was adapted for an older kernel. Merges, reverts, and incomplete histories get their own handling.
When it cannot establish the origin, it returns no tag, lists the candidates and what is missing, and the fix stays a draft until someone resolves it.
Still a work in progress
The second patch would add a section to the kernel's coding assistants document saying an assistant must follow the guide before finalizing a bug fix or its commit message and when reviewing an existing tag.
The document's step for committing a fix would ask for a verified tag, where it now asks only for a Fixes tag. Keep in mind that the skill would not write commit messages, apply the tag, or decide whether a fix belongs in stable.
Where the files should live is still open. The introductory patch message says he is unsure whether they belong under Documentation or in a separate agents directory at the root.
Greg Kroah-Hartman asked whether the series would fix tools skipping the kernel's guidance because an AGENTS.md file is missing. Sasha replied that this is a separate issue for the symlink patch.
There are plenty of online PDF tools that let you edit documents without installing anything on your computer. You just open a website, upload your file, make the changes, and download the edited document.
But there is a catch. You are handing your files over to a third-party service, and you may not always know how it handles your data. Some services may have questionable privacy practices, while others are outright malicious.
In fact, the FBI has warned people about fraudulent online file converters that steal sensitive information and spread malware in the past.
These tools scrape uploaded files for personal details, banking information, email addresses, and passwords, making them particularly risky when dealing with confidential work documents that should've never left an organization's secure environment.
BentoPDF is an open source alternative that advertises itself as a privacy-first tool that processes files directly in your browser instead of uploading them to a server, helping avoid some of the aforementioned privacy risks associated with online PDF tools.
BentoPDF: For Your PDF Needs
homepage ss here
Created by Alam, a developer out of India, BentoPDF traces its origins to an internal tool that was being used for merging and splitting PDFs. Soon after its creation, the lead dev decided to share his work with the world via Reddit, and a few weeks later the code was live on GitHub.
BentoPDF uses WebAssembly, which lets heavy programs run right inside your browser. Its OCR tool, for instance, runs on Tesseract.js, a port of the Tesseract OCR engine. That way, the processing happens on your computer, and nothing is uploaded to a server.
🚀
You don't need to sign up for an account, and there's no web tracking either!
The project is dual-licensed, where the code is provided under the AGPL-3.0, making it free to use and open for anyone looking to fork it. A separate commercial license is available for closed-source use and costs $79 as a one-time purchase.
Alam also publishes two other open source projects, Hyper Compress and Kura. The first is a PDF compression engine, while the latter converts PDFs to standards like PDF/A and PDF/UA.
Anyhow, coming back to the PDF editor, I took it for a test run on Vivaldi, a Chromium-based browser, covering a few tools to see how it holds up in everyday use.
Editing PDFs
The Edit PDF Text tool shows each block of text in the document with a dashed outline, and picking one brings up the formatting sidebar, which houses the usual editing controls.
It has buttons for tweaking the font, size, colors, alignment, and character spacing, along with bold, italic, underline, and strikethrough formatting.
I could also make it fetch all the fonts installed on my Linux system using the System fonts button, and the info button at the bottom was useful for glancing over the metadata of a document.
Once done editing, exporting the file is only a matter of clicking the "Export" button.
The PDF Editor is mainly meant for annotation work, with tools for highlighting, strikethrough, ink, text insertion, and comments. You pick the relevant tool and drag your cursor over a piece of text to apply it.
Adding watermarks to documents is also possible via the Add Watermark tool, which should come in handy for protecting your work or marking a document as sensitive. It offers a lot of flexibility, letting you choose between a text or image type watermark, a single or tiled layout, and granular controls for the pages, text, and visibility.
Common keyboard shortcuts like the ones for copy (Ctrl+C), paste (Ctrl+V), undo (Ctrl+Z), and redo (Ctrl+Y) also work well here.
Easy OCRs
Sometimes a PDF is nothing more than a set of page images, like a scanned report or a document full of charts. You cannot search through it or copy anything out of it because there is no text for your PDF viewer to find.
The solution to that problem is to run OCR on it, which converts the pages into machine-readable text.
OCR PDF handles this in BentoPDF by letting you upload a file, select the relevant language(s) found in the document, and start the process. During my test, I used a two-page brochure for a motorcycle I like to window shop for and left the advanced settings untouched.
It took a while to process the pages, but the output was mostly accurate. Only the very small, lossy text at the bottom of the document tripped it up. I could copy everything to the clipboard or export it as a .txt or searchable PDF file.
File Conversions
BentoPDF has a range of file conversion tools available, and I tested out two of them. PDF to JPG converts each page of a PDF into a JPG image, and using it is quite simple. You upload a PDF file, set the image quality with a slider (the pre-set value is 90%), and click "Convert."
Images to PDF does the reverse, and it accepts an array of formats beyond JPG, including PNG, BMP, HEIC, and PSD.
There are plenty more conversion tools on offer, covering formats like ODP, CSV, EPUB, JSON, WebP, and Markdown, among others.
Quick Compressions
Usually, when handling PDF files that need to be sent via email, its file size matters a lot. Popular email services like Gmail, Proton Mail, Outlook.com, and Yahoo Mail cap attachments at around 20 to 25 MB.
To tackle that, the Compress PDF tool offers two algorithms, "Condense", which is the recommended one, and "Photon," that's tailored for photo-heavy PDFs. Alongside them are four compression levels that run from "Light" to "Extreme.".
For checking it out, I stuck with Condense and only changed the compression level, going with Extreme to see how small the file could could get.
It took quite a while to process, but BentoPDF brought my 120.4 MB PDF down to 28.5 MB, a 76.3% reduction. That is still a little over the usual email limits, but for a 214-page document, it's a good result.
The text and images stayed very readable too, and I only noticed the loss in quality when I zoomed into the images.
Start Editing
There's a lot more BentoPDF has to offer than what I have covered above. Just scroll down on the homepage to see its full list of 100+ PDF tools. There are some security-focused ones that I am sure many of you will like.
If you are looking for the source code, then you should visit the project's GitHub repository, which also contains details on the tech stack that powers BentoPDF.
Long-standing open source projects won't receive new DigitalOcean infrastructure credits after the company quietly ended its support program in a disruptive move that has affected many open source projects. Though they did have enough money to fund Omarchy. 🤷
I cannot confirm, but it could be related. Gentoo Linux is seeking new infrastructure sponsors after several long-term backers withdrew support. The project accepts donated machines, colocation space, virtual machines, physical servers, or funds.
Music copyright group IFPI has submitted yt-dlp, a general-purpose command-line downloader, to the EU's piracy watchlist, lumping it with dedicated ripping services. They named four maintainers while claiming the tool fuels copyright harm.
AI-generated spam flooded Google's open source bug bounty program, prompting the company to temporarily pause product vulnerability submissions. Supply chain reports are still welcome, with them teasing a revamped program by Q1 2027.
Siemens silently deleted the OpenRadioss repository, but AGPL licensing has saved it. Rocky Linux co-founder Brian Clemens forked it as OpenCourant within days; it's already shipping binaries for Linux and Windows.
Red Hat's Lightwell flips the security script. Instead of waiting for upstream patches, it backports fixes directly to production Java libraries. Having cleared 400 vulnerabilities, its on track to grow.
Sequoia PGP arrives in Ubuntu 26.10 as a modern Rust-based OpenPGP tool that sits alongside GnuPG. Both implementations coexist for now, but the plan is to eventually phase out the latter.
Tuta Mail now has an app in the Nextcloud App Store, and a separate Nextcloud plugin in Tuta lets users upload email attachments to Nextcloud and embed video conference links in calendar events.
This edition of FOSS Weekly is supported by Karakeep, an open source bookmark manager.
Karakeep is a self-hostable “bookmark-everything” app. Throw links, notes, images, and PDFs at it, and it helps you find them again.
It uses AI to automatically tag bookmarks and generate summaries, with blazingly fast search across everything you save.
Add content from your phone, browser, or RSS feeds, and build collections with friends or coworkers using collaborative lists.
It’s your private, carefully collected corner of the internet. A home for those 50 open browser tabs you're sure you might need later.
Someone has used AI to create clones of Adobe Photoshop and other tools. I would not keep my hopes high. The project is in a very early stage of development, so there are many functions missing and the user experience is not close to the original. It will also be worth seeing if the project gets development a few months down the line. Because AI has made it easier to create software, so many people create something and then forget about maintaining it.
Tuxdle is the Linux terms guessing game that I created two weeks ago. I am delighted to see that this tiny puzzle game gained a niche following of daily active users. After all, this is a fun way to keep your general Linux knoweldge in check.
S-TUI is a Python tool that monitors CPU frequency, temperature, and power use in your terminal. It can stress-test your processor and detect thermal throttling, with customizable display options and mouse support for navigation.
If your gaming needs have been affected by the absurd increase in prices for memory, storage, and GPU, why not give cloud game streaming a try? NVIDIA already offers a native client for GeForce NOW on Ubuntu.
In the Nemo file manager, pressing F3 opens an extra pane to view two folders side-by-side, making it easy to drag, drop, copy, or move files between different directories without switching windows.
If you find the keyboard shortcut inconvenient, you can add a dedicated toggle button to your interface by going to Edit → Preferences and opening the "Toolbar" tab. Here, you can enable/disable the Extra Pane option. When enabled, it adds a split-window icon to your top toolbar, letting you control the view with a single click.
If you like what we do and would love to support our work, please become It's FOSS Plus member. It costs $49 a year (less than the cost of a McDonald's burger a month), and you get free ebooks, an ad-free reading experience with the satisfaction of helping the desktop Linux community.
And here I thought Windows were only useful for ventilating a room. 🤭
🗓️ Tech Trivia: Did you know? On September 30, 1980, Xerox, Intel, and DEC published the "Blue Book" as the first Ethernet specification. Ethernet had already been running at Xerox PARC for years, but this document helped turn a lab experiment into the networking technology we still use today.
🧑🤝🧑 From the Community: You might have heard about the Blanc Browser by now. It's creator has made an appearance in the forum, replying to an inquisitive thread by one of our Pro FOSSers, Bill.
Plenty of open source projects keep going on goodwill alone, with contributors putting in the hours and expecting nothing back. While others lean on outside support like cash, donated hardware, or someone else covering the hosting bill.
This kind of support rarely gets much attention, but these needs are some of the most foundational aspects of any project that's serious about growing.
Gentoo falls in the second group. The source-based Linux distribution, built around the Portage package manager, runs largely on sponsored infrastructure, as it can only manage to maintain a few vital machines.
Sadly, many sponsors that had backed Gentoo all these years have decided to stop making contributions. The project is now looking for replacements and has put out a call for infrastructure sponsors.
Currently, its sponsors page lists names such as Oregon State University's Open Source Lab, CDN77, HP, and Hetzner, but it may not yet reflect the dropouts.
Gentoo's search for sponsors
Some of the listed sponsors of Gentoo.
There are five ways to help, as laid out on the sponsorship page of Gentoo's wiki, with preference being given to supporters who share the project's vision of software that respects choice and stays open to user-driven changes.
The first way is to accept donated machines for the project's hosting locations in the US. They are not asking for much; anything good enough to handle server-focused tasks in today's time is a good offering for them to use.
Next is Colocation, a type of physical hosting. The sponsor would provide rack space, power, and connectivity, while Gentoo finds the hardware to put in it. Capacity outside the US is their most urgent need at the moment, though offers from the US are welcome too.
Third are virtual machines, with a minimum of 2 vCPUs, 4GB of RAM, and 25GB of storage. The project says that it is leaning more on the cloud wherever it can, but many of its services are monolithic, and that Kubernetes would suit them poorly.
The fourth way is full-package hosted physical servers. The wiki gives two examples: a root server like the ones Hetzner offers, or a sponsor's older or unused servers with Gentoo getting full remote access.
In that second case, the sponsor would still own and manage the hardware, whereas Gentoo would take care of the operating system and remote management, only asking for advance notice before any migration events.
The last is plain old money. Any donated funds would go toward paying for colocation and hosting.
A call to act
Gentoo is far from the only project that needs this kind of backing.
Take LVFS, the firmware update service for Linux. It leaned heavily on the Linux Foundation and Red Hat, with Framework and the Open Source Firmware Foundation pitching in $10,000 a year.
Then Lenovo and Dell joined at the Premier tier, at $100,000 a year each, along with HP and NVIDIA, who followed soon after. I would call that a win for LVFS and a sign that sponsors are out there for projects that go looking.
Maybe your organization has spare rack space, or you have money lying around and want it to do some good. Either way, someone has to host the servers behind projects like this, and Gentoo's infrastructure team is available at infra@gentoo.org for any infrastructure sponsorship-related queries.
Suggested Read 📖: Google has shut down part of its Open Source Bounty Program thanks to AI.
How does an operating system that isn't proprietary or powered by the Linux kernel manage to run Docker, you ask? Well, it would need features like namespaces and cgroups.
That's exactly what Vinix did, adding its own implementations of those plus overlayfs and seccomp, allowing the stock Alpine Linux Docker engine to run on ARM64.
It also runs QEMU 9.1.2, which can boot a second Vinix inside a window of the first, and for gaming, it can run DOOM, a DOOM 3 demo, Gothic II's demo via OpenGothic, and Minecraft Java Edition.
There are still some limitations.
For instance, the Docker support lacks bridge networking and iptables rules, and QEMU runs on software emulation for now. Minecraft runs in interpreter mode on one CPU core, and DOOM 3 manages about 13 FPS under software rendering.
🚧
This is early-stage software that is not meant to be used daily or in production environments.
Yet another OS?
Vinix exists to give MacBooks a fast, minimal, open source OS, with the project's motivation being tied to macOS getting slower and bloated with every passing release. They are initially targeting Apple Silicon devices to eventually cover the whole M-series lineup, though only the M1 is supported right now.
While Linux users have little reason to switch to it, Vinix aims for a setup without systemd and a kernel small enough for one person to read through.
Beyond that, nothing runs in the background unless you start it, and the system sticks to a single init system, desktop, package manager, and binary format. The kernel handles memory manually instead of using a garbage collector, so a cleanup pass can't interrupt a system call or the compositor.
All of it runs on a V programming language foundation, which was picked for its fast compiles and small, readable design. The project doubles as a testbed for bare metal programming in V too!
The security model of the OS is modeled after OpenBSD, with pledge and unveil available, though apps must opt in, and user memory can't be both writable and executable by default. Verifying the bootloader, kernel, and root filesystem isn't supported yet.
It runs Linux apps
At its core, Vinix is a monolithic kernel booted through Limine, with its drivers built into the image. Most of it is V, alongside some C and assembly.
It features a native desktop built with V UI2 that renders through the framebuffer, with X.org and Hyprland sessions as options on ARM64. The developers claim that the OS takes up 50 MB of RAM after boot and roughly 1 GB of disk once installed.
Alpine Linux, the distro behind that Docker engine from earlier, is lightweight and security-focused, and it's built around musl and BusyBox. Vinix targets its aarch64 packages.
Thanks to that, Vinix is able to run Linux apps because it answers the system calls they make, plus the ELF format and musl behavior they rely on, and those binaries run natively, without a VM or an emulator.
New applications can be installed with pkg, a command-line tool that pulls packages from Alpine's aarch64 repositories. Apps like Chromium, GIMP, Sublime Text, and Gnumeric are known to work, as is Wine, the widely adopted compatibility layer.
The catch is that this is limited to ARM64 and selected packages. Software that relies on a Linux kernel feature Vinix doesn't have yet may not run properly.
Additionally, support for the M3, M4, and M5 is coming soon, while GPU drivers are still a work in progress.
Vinix's history spans many years, with the first commits on GitHub dating back to March 2021 and the original kernel core being the work of Mintsuki, the creator of Limine.
Development then paused for around two years before Alexander Medvednikov, the author of V, took over as maintainer.
Mintsuki's core covered the physical and virtual memory managers and the scheduler, but since the handover, Vinix has gained storage, networking, input, and graphics support, along with a Unix-style userspace and the Alpine compatibility we saw earlier.
Get Vinix
You will find that the official website offers a .dmg installer file for M1 Macs, whereas the project repository hosts two distinct ISOs, one for ARM64 (targeted at QEMU and VirtualBox on Apple Silicon Macs) and the other for x86_64 (targeted at Intel and AMD systems).
If you want to test it on a virtual machine, the requirements are quite modest. Vinix needs at least 4 GB of memory and 4 GB or more storage space. Building from source is also an option.
Since 2022, Google's Open Source Software Vulnerability Reward Program (OSS VRP) has been the path for outside researchers to get paid for reporting security flaws in the company's open source code, including projects like Flutter, Angular, Go, and Fuchsia.
With an announcement on X, they have now decided to discontinue the product-facing side of it.
They are calling the change temporary, while supply chain reports remain open and anything submitted before October 1 stays unaffected.
What's closed, what's not?
📢 PSA for open-source bug hunters
We are temporarily no longer accepting OSS VRP product vulnerability submissions. This does not impact OSS VRP supply chain reports, or any outstanding reports. As an alternative, we encourage you to find impact across our other VRP programs…
— Google VRP (Google Bug Hunters) (@GoogleVRP) October 1, 2026
Product vulnerabilities are bugs in the projects themselves, like a failing HTML sanitizer, memory corruption issues in file format parsers, or insecure code examples in documentation.
The updated rules do not limit the change to a specific project tier, as they just won't be accepting any reports related to this.
Supply chain reports, on the other hand, cover vulnerabilities in how the software is built and shipped. Exposed package manager credentials used to publish build artifacts is one case the rules page lists. It remains unaffected by this change.
There's also an exception for some Google Cloud repositories. If a bug there affects a Cloud product, Google may still accept the report, but through its Cloud VRP.
Why did it come to this?
Back in March, a post on the Bug Hunters blog from Google engineers said AI-generated reports were flooding the program. Some were serving up hallucinated information, while others were flagging legit coding errors that had little to no impact on the security posture of the targeted project.
Google's first response was to raise the bar on memory corruption reports for its two top project tiers. Researchers had to either reproduce the bug through an existing OSS-Fuzz fuzz target or point to a patch that maintainers had already merged.
An update to the same post the following month went further. The standard and low-priority tiers, OT2 and OT3, stopped offering rewards or credit for product vulnerabilities and other security issues. The top supply chain reward for OT2 projects also fell to $3,133.70.
Supply chain reports still pay, from $500 on OT2 projects up to $31,337 on flagship ones.
As an alternative, Google points to the Patch Rewards Program, which pays between $100 and $15,000, though only for patches that have stayed in a project for a month without being reverted.
An open question
Google has not said when or in what form product vulnerability reports will return. Their announcement only promises an update in the first quarter of 2027 while they continue reworking that part of the program.
There's also a loose end. At the time of writing, the OSS VRP page still lists reward ranges for product vulnerabilities, up to $7,500. Though, as you saw earlier, the rules page for it has already been updated, so it shouldn't be long before this is addressed.
