Ubuntu point releases follow a predictable rhythm: the original LTS ships in April, and the first point release — which bundles all critical bug fixes and, crucially, opens the upgrade path from the previous LTS — arrives around four months later. Right on schedule, Ubuntu 26.04.1 LTS landed on August 4, 2026, marking the moment that "Resolute Raccoon" transitions from early adopter territory to a stable upgrade destination for the wider Ubuntu ecosystem.

If you've been sitting on Ubuntu 24.04 LTS waiting for the green light, that light is now green.

What's in the point release

26.04.1 is not a feature release — it's a quality release. The ISO images now carry four months of accumulated bug fixes, security patches, and hardware enablement updates that would otherwise require downloading the original April ISO and immediately running a lengthy apt upgrade. For new installs, this matters: fresh deployments start from a stable baseline instead of a day-one snapshot with hundreds of pending patches.

More importantly, the point release is the official trigger for upgrade-manager to offer the 24.04 → 26.04 path to existing LTS users. Canonical deliberately withholds this prompt until the first point release to ensure the upgrade experience is smooth — a policy born from past transitions where eager early upgrades hit rough edges in the first weeks of a new LTS.

What 26.04 LTS brings to the table

For users coming from 24.04, the underlying platform changes in "Resolute Raccoon" are substantial. The full release notes cover the headline additions:

• GNOME 50 — the latest major release of the GNOME desktop, with redesigned system settings and improved multi-monitor handling.
• Linux kernel 7.x — broader hardware support, improved energy efficiency on modern CPUs, and continued Wayland driver improvements.
• Wayland by default everywhere — the Xorg session remains available, but Wayland is now the default for all supported GPU drivers including proprietary NVIDIA.
• TPM-backed full-disk encryption — new installs can now use TPM 2.0 for keyless FDE, enabling automatic unlock at boot without a passphrase on trusted hardware.
• Rust in the core — several low-level system components have been replaced or supplemented with Rust implementations, improving memory safety at the OS layer.

How to upgrade

If you're on Ubuntu 24.04 LTS with updates enabled, you'll see an upgrade prompt appear via the Software Updater GUI within a few days of 26.04.1's release. You can also trigger it immediately from the terminal:

sudo do-release-upgrade

The upgrade path is tested and supported. If you're running a server or a production system, the usual advice applies: snapshot first, read the release notes for deprecated packages in your stack, and run a test upgrade in a staging environment before the real thing.

For fresh installs, the 26.04.1 ISO is available now from ubuntu.com/download and is the recommended starting point for any new Ubuntu 26.04 deployment going forward.

Source: Ubuntu 26.04 LTS Official Release Notes

For years, running Google Chrome on ARM64 Linux meant settling for a distribution-packaged build of Chromium — feature-incomplete, no Widevine DRM, and often several versions behind. That era ended on August 3, 2026, when Google quietly pushed official ARM64 Linux packages to Chrome's download page without a press release or blog fanfare. Typical.

What's Actually Available

Google is now shipping two official ARM64 Linux packages:

• 64-bit ARM .deb — for Debian, Ubuntu, and their derivatives
• 64-bit ARM .rpm — for Fedora and openSUSE

Both are accessible directly from Chrome's official download page. Installing either package also adds Google's Chrome APT or DNF/Zypper repository, so future updates flow through your standard package manager rather than requiring manual downloads — the same experience x86_64 users have had for over a decade.

Why This Took So Long

Google shipped native ARM64 Chrome for macOS in 2020 and for Windows on Arm in 2024. Linux was the last holdout, closing what Linuxiac aptly describes as a "six-year gap." The delay was partly engineering (ARM Linux is a fragmented target compared to a single macOS or Windows ABI) and partly market: ARM64 Linux machines were a niche until Raspberry Pi 4 proliferation, RISC-V interest, and the broader ARM server market made it harder to ignore.

Google initially committed to Q2 2026 delivery, then missed that deadline by a few weeks. The packages landed without ceremony in early August — classic Chrome rollout energy.

What You Get That Chromium Doesn't Provide

The practical difference between distro-packaged Chromium and official Chrome on ARM64 Linux comes down to a few things:

• Widevine DRM — Netflix, Disney+, and other streaming platforms that require L3 Widevine now work natively. This alone was the blocking issue for many users.
• Google account sync — bookmarks, extensions, history, passwords synced through your Google account without workarounds
• Automatic updates via the official Google repository, rather than waiting for your distro to package a new Chromium release
• Push notifications and full extension APIs that some enterprise and productivity extensions require

Who Benefits Most

The most immediate beneficiaries are Raspberry Pi 4/5 users running Raspberry Pi OS (Debian-based) or Ubuntu ARM images, Ampere Altra workstation users, and anyone running ARM64 Linux on cloud VMs (AWS Graviton, Google Tau T2A, etc.) who wanted a desktop browser session with DRM support.

This also matters symbolically: ARM64 Linux has been quietly maturing as a developer platform, and first-class browser support from Google — not just a community workaround — signals that the ecosystem is being taken seriously.

Installation is straightforward: download the appropriate .deb or .rpm from google.com/chrome and install via your package manager. The repository will be configured automatically.

If you've been sitting on Ubuntu 24.04 LTS waiting for the right moment to jump to the next long-term release, that moment arrived yesterday. Ubuntu 26.04.1 LTS — the first point release of Resolute Raccoon — landed on August 6, 2026, and with it, Canonical officially opened the direct upgrade path from 24.04 Noble Numbat.

Why the Point Release Matters

Canonical's policy is deliberate: the LTS-to-LTS upgrade path doesn't open until the first point release of the newer version. It's a sensible safeguard. Ubuntu 26.04.0 shipped in April with some rough edges that have been steadily ironed out over three months. The .1 release bundles all those accumulated fixes, security patches, and installer improvements into a single installable snapshot — making it a significantly smoother experience than upgrading immediately on launch day would have been.

For servers and production machines, this is the green light most administrators have been waiting for before scheduling migration windows. For desktop users, running sudo do-release-upgrade will now surface the offer to move to 26.04 rather than staying locked on 24.04.

What You're Upgrading To

In case you missed the April announcement: Ubuntu 26.04 LTS is a substantial generational update. Key changes include:

• GNOME 50 as the default desktop, bringing Variable Refresh Rate support, fractional scaling on by default, and parental controls
• Linux kernel 7.0, adding native support for Intel Nova Lake and AMD Zen 6 hardware
• Wayland-only GNOME sessions — X11 GNOME sessions are gone; XWayland handles legacy app compatibility
• Post-quantum cryptography enabled by default across the system
• Rust-based core utilities progressively replacing GNU coreutils for improved memory safety
• AMD ROCm added to official repositories, making GPU compute significantly easier to set up

The default app selection also refreshed: Showtime replaces Totem as the media player, Resources replaces the old System Monitor, and Ptyxis is now the default terminal.

Long-Term Support You Can Count On

Resolute Raccoon ships with a five-year standard security update window (through April 2031), extending to ten years with Ubuntu Pro and up to fifteen years via the Legacy add-on. For organizations planning infrastructure lifecycles, that's a runway that comfortably covers most planning horizons.

How to Upgrade

Desktop users can upgrade via the Software Updater notification that should now appear, or by running:

sudo do-release-upgrade

Server users should use:

sudo do-release-upgrade -d

As always, snapshot your machine or take a backup before upgrading — point releases are stable, but no upgrade across a major version is entirely without risk. If you're running custom PPAs or third-party drivers, audit those before proceeding.

For those on fresh installs, the 26.04.1 ISO is available now on ubuntu.com/download and ships in a state that's notably cleaner than the April .0 release.

StatCounter's July 2026 figures put Linux at 10.65% of desktop usage in North America — the first time the open-source operating system has cleared double digits in the tracking firm's North American dataset. The headline is real. The interpretation requires some care.

What the data says

StatCounter measures web traffic across more than one million websites, attributing operating system data from HTTP headers. Its July report shows Linux jumping from 5.52% in June to 10.65% in July — a near-doubling in a single month. That rate of change, with no corresponding surge in Linux hardware sales or distro download counts, caught analysts' attention immediately.

The likely explanation involves reclassification rather than mass migration. In June, an "Unknown" traffic category accounted for 9.24% of North American desktop usage. In July, that category largely disappeared while Linux grew. The most plausible reading: StatCounter updated how it identifies certain user-agent strings, and a chunk of previously unclassified traffic — possibly from embedded Linux systems, ARM-based devices, or AI bots — was folded into the Linux figure.

Skeptics and their data

PCWorld's analysis argues that bot traffic is the likeliest culprit: automated scrapers, AI training crawlers, and monitoring tools all tend to run Linux and inflate web-traffic-based OS counts. Windows Latest reached a similar conclusion. Cloudflare Radar, which filters more aggressively for human traffic, places Linux notably lower than 10% — though still with significant recent growth compared to prior years.

Bryan Lunduke's take is characteristic of the nuanced response this number received: the figure is interesting regardless of its exact cause, because something — real users, reclassified bots, or a methodology update — pushed Linux over a symbolic threshold that has been discussed for decades.

The real trend underneath

Whatever the July spike reflects, the longer-term trajectory is less ambiguous. Proton has brought a substantial share of the Steam library to Linux. The Steam Deck normalized Linux as a gaming platform for millions of users. Ubuntu, Fedora, and Mint are meaningfully easier to install and maintain than they were five years ago. And widespread frustration with Windows 11's hardware requirements and AI-integration push has sent a visible wave of users looking for alternatives.

The "Year of the Linux Desktop" joke has been running since the late 1990s. Whether July 2026 marks a genuine inflection point or a statistical artifact, the conversation around it carries a different texture than it did even two years ago. Linux is turning up in places it wasn't before — and not just in bot traffic logs.

On August 3, 2026, kernel maintainers Greg Kroah-Hartman and Sasha Levin pushed stable updates across three active LTS lines: v6.18.42, v6.12.101, and v6.6.148. All three releases share a common set of critical security patches, plus a substantial AMDGPU driver overhaul that affects every system running an AMD GPU on one of these long-term kernel lines.

Security Fixes Across All Three Tracks

The patches common to all three LTS lines cover three distinct subsystems:

• ksmbd ACL validation: A flaw in the kernel's in-kernel SMB server could allow unauthorized file access on systems using ksmbd for network file sharing. Patched in all three tracks.
• dm-verity buffer overflows: Device mapper integrity verification contained a buffer overflow condition that could be triggered during block device reads. dm-verity is widely used in Android, ChromeOS, and hardened Linux distributions to verify partition integrity at boot — this fix matters for embedded and security-focused deployments.
• BPF memory safety: The extended Berkeley Packet Filter subsystem received fixes addressing conditions where BPF programs could access memory outside intended boundaries. BPF is used for networking, observability, and security enforcement on virtually every modern Linux server.

AMDGPU Gets a Major Stability Overhaul

The most significant structural change in these releases is to the AMDGPU driver. Driver maintainers converted BUG_ON() calls to WARN_ON() throughout the driver's gfx8 through gfx12 code paths — covering hardware from the Fiji era (2015) all the way up to current RDNA 4 GPUs.

This is more than a cosmetic change. BUG_ON() triggers an immediate kernel panic and system halt when its condition is met; WARN_ON() logs the condition and continues execution. The old behavior meant a GPU driver edge case — a race, an unexpected state — could crash your entire machine instantly with no recovery possible. With WARN_ON(), those conditions produce log entries and let the system keep running, which is the right trade-off for driver code where a panic is rarely necessary for system integrity.

The update also backports a 1,900-line refactor of the DRM buddy allocator — the memory manager used by AMD's display and compute engines — improving correctness and reducing fragmentation under long-running GPU workloads.

Who This Affects

All three kernel lines receiving these updates — 6.18, 6.12, and 6.6 — are actively maintained through at least December 2028. Distributions shipping from these lines include Ubuntu 24.04 LTS, Debian Bookworm, and RHEL-family systems.

For server operators running AMD GPUs under workloads like ML training, video processing, or GPU-accelerated databases, the AMDGPU stability work is worth applying promptly. The security fixes for ksmbd, dm-verity, and BPF are straightforward updates any LTS system should take via its distribution's normal update mechanism.

The full diff and commit details are available on the stable kernel update announcement.

Arch Linux shipped its August 2026 monthly ISO on August 1, and it brings one notable first: kernel 7.1.5 ships as the default. This makes Arch the first mainstream distribution to deploy the 7.1.x series out of the box, following the 7.1.4 release on July 18. The 1.5GB x86_64 image is available from the standard mirrors.

Archinstall 4.4

The ISO bundles Archinstall 4.4, the guided installer that has been steadily gaining features without abandoning Arch's DIY ethos. This release adds a profile for the Niri DankMaterialShell desktop — a scrollable tiling window manager built in Rust, aimed at developers who want something between a full GNOME-style desktop and a pure tiling WM like Sway or Hyprland. Niri's scrollable approach means workspaces extend horizontally rather than switching in place, making it feel distinctly different from anything in the traditional WM lineup.

Plymouth boot splash support is also now wired into the installer. Previously, setting up an animated boot screen required post-install initramfs hook configuration; Archinstall 4.4 handles it during the guided setup pass, so new installs start visually polished out of the box.

IWD networking option

Networking setup gains IWD as a selectable option alongside the traditional iwctl and NetworkManager paths. IWD (iNet Wireless Daemon), Intel's modern wireless daemon written in C, offers faster connection times and better WPA3-Enterprise support than wpa_supplicant on compatible hardware. For users installing on laptops with newer Intel Wi-Fi chips, it's worth selecting over the default.

Project governance

On the organizational side, lead developer Levente Polyák (known as "anthraxx") was re-elected for a second term in June, and the team is pushing an AUR (Arch User Repository) security initiative alongside this release — moving more packages toward reproducible builds and stronger signature verification.

For existing Arch users, rolling update via pacman -Syu remains the primary upgrade path. The ISO exists primarily for new installs and recovery environments. The addition of the Niri profile is worth watching: it represents Arch formally validating a Rust-based tiling compositor as a first-class desktop option, which will likely accelerate its adoption across other rolling-release distributions.

On July 30, 2026, Greg Kroah-Hartman shipped six Linux stable kernel updates in a single coordinated drop: 6.18.41, 6.12.100, 6.6.147, 6.1.180, 5.15.213, and 5.10.262. The synchronized release targeted a single root cause: a use-after-free (UAF) race condition in the POSIX CPU timers subsystem that has lived in the kernel since approximately 2010.

What the bug does

The vulnerability is a race between sys_timer_delete() and non-leader thread exec() calls. In vulnerable kernels, this race can silently disable process timers — or on multi-threaded systems, create conditions for local privilege escalation. It was independently discovered by two researchers, Wongi Lee and Jungwoo Lee, who reported it through coordinated disclosure.

POSIX CPU timers measure CPU time consumed by a process or thread. They're commonly used by profiling tools, resource accounting daemons, and real-time workloads. The affected code path triggers on any system where a thread group performs exec() while another thread is deleting a CPU timer — a pattern common enough in production services to make this non-theoretical.

Why six branches at once

The Linux kernel maintains multiple simultaneous stable and long-term support (LTS) trees, each targeting systems locked to a specific major version. The 5.10 and 5.15 branches are long-term support, maintained for embedded and enterprise systems. The 6.1 branch is LTS. The 6.6, 6.12, and 6.18 branches are current stable series. A coordinated fix across all six in one day suggests the kernel security team treated this as a formal coordinated disclosure with a fixed embargo date.

What to do

If you're running any of the affected branches (5.10, 5.15, 6.1, 6.6, 6.12, or 6.18), update now. Most major distributions — Debian, Ubuntu LTS, RHEL, SUSE — track one or more of these trees and will receive the fix through normal update mechanisms. Arch Linux, Fedora, and other distributions shipping the 7.x kernel series are unaffected by this specific patch series.

The 16-year lifespan of the bug before discovery is a reminder that subtle concurrency issues in the kernel can survive multiple major rewrites of surrounding code. Use-after-free races in timer subsystems are notoriously hard to catch in testing but reliably exploitable by a motivated local attacker with enough CPU time and patience.

On July 24, 2026, the UBports Foundation released Ubuntu Touch OTA 2.0 — the second major feature update based on Ubuntu 24.04 LTS "Noble Numbat." It's a meaningful release for anyone running Linux on a phone, addressing some of the platform's longest-standing practical limitations.

The browser situation improves considerably

The Morph Browser now runs on a Chromium 134 engine, a significant jump in web compatibility over the older engine it replaced. Modern web apps were increasingly broken on Ubuntu Touch; this closes a large portion of that gap. For a platform that leans heavily on web apps given the limited native app ecosystem, this matters more than the version number suggests.

Streaming is finally viable

OTA 2.0 ships with a Widevine installer, which means supported devices can now play DRM-protected content from services like Netflix. Previously this required workarounds; now it's a checkbox in setup. This is one of those features that shouldn't be notable in 2026, but it's a significant usability barrier that many alternative mobile operating systems still haven't cleared.

New devices and display improvements

The Nothing Phone (1) and Zinwa Q25 join the official supported device list. On the display side, OTA 2.0 adds handling for device notches and rounded corners — small but irritating gaps in the UI that become obvious the moment your device has them. Printing support also arrives in this release.

Shell and quality-of-life changes

The Lomiri shell gains a screenshot editor with crop, rotate, and color-adjustment tools. The emoji keyboard picks up over 2,000 new entries and emoji variant support. X11-based legacy apps from the Open Store have improved compatibility, and mobile data connections are more reliable across supported hardware.

The bigger picture

Ubuntu Touch occupies a niche but an important one: it's the clearest working demonstration that a fully open-source Linux stack can run on phone hardware people actually own. OTA 2.0 doesn't change that position, but it sharpens it — Widevine and a modern browser engine are the two features most likely to determine whether a general user gives the platform a serious try.

Supported devices can pull the update via Settings → Updates. For the full device list and release notes, see the UBports blog.

System76 released COSMIC Epoch 1.4.0 on July 22, delivering a focused quality-and-polish update to the Rust-native desktop. No headline-grabbing rewrites — just targeted fixes for the friction points that COSMIC users have been filing tickets about since 1.0.

A Default Sound Theme, Finally

For the first time, COSMIC ships with its own default sound theme, delivered through a new cosmic-sound-theme package. Fresh installs of Pop!_OS with COSMIC now have audio feedback out of the box — login sounds, notification chimes, error tones — without requiring users to hunt down a third-party theme. The package is distributed separately so other COSMIC-capable distributions (NixOS, Arch, Fedora) can adopt it at their own pace.

Fractional Scaling Precision Fix

A persistent pain point on hi-DPI displays has been pointer accuracy at screen edges when fractional scaling (125%, 150%, etc.) is active. 1.4 ships an explicit fix for this: the compositor now correctly maps edge-of-screen pointer positions under fractional scaling. If you've ever tried to snap a window to a corner and missed by a pixel or two, this one's for you.

COSMIC Monitor Gains GPU Frequency and Force-Quit

The system monitor application gets two meaningful additions. First, a force-quit button for stuck processes — no more opening a terminal to kill -9. Second, switchable graph types in the GPU panel: you can now display GPU frequency data alongside existing utilization graphs. This brings COSMIC Monitor's GPU visibility closer to what KDE's KSysGuard and GNOME's Resources already offer.

Portal and Network Stability

xdg-desktop-portal-cosmic is now a system service rather than a session-started daemon. The practical effect: file-picker dialogs and screenshot portals now activate reliably even when applications launch quickly after login. NetworkManager integration in the networking applet also received additional stability fixes that should reduce connection-state desync on resume from suspend.

Where COSMIC Stands in Mid-2026

COSMIC remains the only major Linux desktop environment written primarily in Rust. System76 has maintained a roughly monthly release cadence since the 1.0 debut in 2024, and the cadence shows: each release is small, targeted, and ships without regressions. For users on Pop!_OS, 1.4 arrives via the standard package manager. Community ports for other distributions typically follow within a week or two.

The project still has ground to cover — Wayland protocol coverage has gaps, and some applets feel early — but 1.4 is a sign that System76 is disciplined about shipping steady incremental improvement rather than chasing features.

On July 25, 2026 — yesterday — Canonical pushed a sweeping security update for Linux kernels running on Azure and Azure FDE-encrypted systems for Ubuntu 26.04 LTS. The update addresses over 500 vulnerabilities spanning networking, filesystems, device drivers, and hardware interfaces. It is one of the largest single-kernel security batches Canonical has shipped in recent memory.

What Is Being Patched?

The official security notice (USN-7600-1) covers flaws across a remarkably wide surface: networking stack (TCP/UDP race conditions, IPv6 handling bugs), filesystem drivers (ext4, XFS, BTRFS edge cases that could corrupt data or allow privilege escalation), and dozens of device driver issues in USB, NVMe, GPU, and audio subsystems.

The headline finding is a cluster of AMD Zen 2 speculative execution vulnerabilities. These flaws allow a local attacker — or a malicious virtual machine on a shared host — to perform side-channel reads of kernel memory or escalate privileges without any user interaction. Given that Zen 2 processors (EPYC Rome, Ryzen 3000) are extremely common in Azure virtual machine SKUs, this is a real-world threat for cloud workloads.

Why the Azure Kernel Specifically?

The Azure-tuned kernel carries a different set of enabled modules and backported patches compared to the generic Ubuntu kernel. It includes drivers optimized for Hyper-V, Azure-specific storage backends, and enclaves used by Azure Confidential Computing. This broader surface area means vulnerabilities accumulate faster — and fixing them in one batch avoids the performance overhead of multiple reboots.

Also Released: Six LTS Kernel Stable Versions

The same day, upstream kernel maintainer Greg Kroah-Hartman released six simultaneous LTS stable kernel updates, covering versions 5.10.261 through 6.18.40. Key fixes include a KVM/x86 shadow paging flaw (CVE-2026-46113), a confirmed XFS data-corruption path under high I/O concurrency, and a BPF verifier regression on s390 that could cause incorrect program acceptance.

What You Should Do

If you are running Ubuntu 26.04 on Azure, the fix is a standard apt update && apt upgrade followed by a reboot to activate the new kernel. On Azure, this fits cleanly into a maintenance window using rolling instance updates. On bare-metal servers or Hyper-V guests outside Azure, check whether your kernel version is in the affected range and update accordingly.

The Zen 2 speculative execution issues are particularly important to address quickly: because they are exploitable from within a VM, a compromised tenant container on a shared host could potentially read data from neighboring workloads. In a cloud context that is a critical-severity finding.

Takeaway

Five hundred patches in one day is striking, but it reflects something positive: structured, proactive auditing rather than a sudden crisis. Canonical's security team sweeps continuously, batches fixes for efficiency, and ships them as a single testable update. The important thing for Ubuntu Azure users is that the fixes are available now — and the only action required is an upgrade and a reboot.

Two milestones arrived in the same release candidate last weekend, and both have been years in the making. Linux 7.2-rc4 dropped on July 19 with Cache-Aware Scheduling finally merged into the mainline kernel — a task placement optimization that has been in development across multiple kernel cycles — and with the last vestiges of the deprecated strncpy API permanently removed after a six-year cleanup effort.

The full rc4 changelog covers both changes along with Btrfs large folios enabled by default, initial AMDGPU HDMI 2.1 FRL support, USB4STREAM, and AMD ISP4 camera support. The stable 7.2 release is currently tracking for August 2026.

Cache-Aware Scheduling: What It Does

Modern CPUs — particularly AMD's Zen architecture — have complex cache hierarchies. Tasks running on different cores don't all share the same L3 cache slices, and migrating a thread across a cache boundary means cold-starting its working set. The kernel's existing scheduler knows about CPU topology (cores, clusters, NUMA nodes) but has historically made migration decisions without explicitly accounting for cache warmth or the cost of crossing cache domain lines.

Cache-Aware Scheduling (CAS) adds that accounting. The scheduler now tracks cache affinity and weights migration decisions against the cost of reloading hot data. According to the LKML merge announcement, benchmarks on AMD Zen 5 hardware show up to 100% higher throughput in database workloads — MongoDB is the cited reference — due to dramatically reduced cache misses during task migration. The gain varies by workload: highly cache-sensitive server applications benefit the most, while single-threaded workloads see little change.

Linus Torvalds noted in the rc4 announcement that AI-assisted profiling tools were used during CAS development to identify migration patterns that human reviewers had consistently missed — a first for a major scheduler subsystem change.

The End of strncpy

The kernel's long campaign against strncpy is over. The function has been considered unsafe in kernel code since at least 2018 because it doesn't guarantee null termination of the destination buffer when the source string is longer than the specified size — a class of bug responsible for several historical vulnerabilities. The kernel community began a systematic replacement effort around 2020, migrating call sites to strscpy and related safe alternatives.

As of 7.2-rc4, the final call sites are gone and the internal strncpy implementation has been removed from the kernel's string library. New code that tries to use it will fail to compile. For users, this means one fewer category of string-handling bug is possible in kernel drivers and subsystems going forward.

Other Notable Changes in rc4

• Btrfs large folios: The Btrfs filesystem now enables large folios (multi-page memory mappings) by default, reducing memory management overhead and improving sequential I/O throughput on NVMe storage.
• AMDGPU HDMI 2.1 FRL: Initial support for Fixed Rate Link signaling in AMD's GPU driver, required for true 4K/144Hz and 8K/60Hz output over HDMI 2.1 on newer AMD hardware.
• USB4STREAM: A new USB4 streaming transport protocol that allows high-bandwidth low-latency data transfer between USB4 devices, targeted at external GPU and capture card use cases.

Ubuntu 26.10 Target

Linux 7.2 is the target kernel for Ubuntu 26.10 "Stonking Stingray", which means these changes will land in the standard Ubuntu release track when 26.10 ships in October 2026. For users on Ubuntu 26.04 LTS, the 7.2 kernel will be available via the hardware enablement stack shortly after the stable release.

Stable release is expected in late August 2026 if the rc cycle stays on its current schedule.

On July 21, 2026, Canonical published USN-8579-1, a security notice patching three separate vulnerabilities in snapd — the daemon that manages Snap packages on Ubuntu. Two are rated high severity. One of them turns any local account on a default Ubuntu Desktop install into full root. If you run Ubuntu 22.04 LTS, 24.04 LTS, or 26.04 LTS and haven't updated snapd since July 21, you should do that now.

CVE-2026-8933: Root From Nowhere

The most severe vulnerability, CVE-2026-8933 discovered by Qualys, lives in snap-confine, the binary responsible for setting up the sandbox environment before a Snap application launches. During sandbox initialization, snap-confine creates temporary directories and files under /tmp that are initially owned by the calling unprivileged user. A race condition in that initialization window lets an attacker mount a FUSE filesystem over one of those temporary paths and use a symlink to redirect writes to arbitrary files on the system — including files owned by root.

The CVSS 3.1 score is 7.8 (High). The practical impact on a default Ubuntu Desktop installation: a user with a local account and the ability to run any snap can escalate to root. No special privileges, no pre-installed malware — just a race condition and a FUSE mount. The affected releases are Ubuntu 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS.

CVE-2026-15226: Creating Setuid Binaries Through the Seccomp Template

The second high-severity flaw, found by Zygmunt Krynicki, involves snapd's default seccomp template — the syscall filter applied to contained Snap applications. The template failed to block the chmod and related syscalls needed to create executables with the set-user-ID (setuid) bit. A local attacker inside a confined Snap could craft and execute setuid binaries from within the sandbox, escaping snap confinement from a confined root context into an unconfined root context. Affected: Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS.

CVE-2024-5300: Password Hashes Readable by Sandboxed Apps

The third vulnerability is rated medium, but its reach is remarkable: it affects every Ubuntu LTS release back to Ubuntu 16.04, a decade of installations. A flaw in snap-confine's filesystem isolation allowed sandboxed Snap applications to read hashed user passwords from the host system. Depending on password strength and hashing algorithm, those hashes are potentially crackable offline.

How to Fix It

All three CVEs are patched in the snapd update released on July 21. On any affected Ubuntu release, updating is a two-step process:

sudo apt update
sudo apt install --only-upgrade snapd

You may need to restart the snapd service or reboot for the new snap-confine binary to take effect. The patches apply to Ubuntu 16.04 (via extended security maintenance), 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS.

The Broader Snap Security Picture

This is not the first significant snap-confine vulnerability — a similar race-condition privilege escalation chain, CVE-2026-3888, was patched earlier this year. The pattern suggests that the snap confinement model — which combines seccomp filters, AppArmor profiles, and the snap-confine binary — has attack surface that is proving difficult to fully audit. For shared Ubuntu environments (lab servers, cloud instances with multiple users, developer workstations shared by a team), the calculus is straightforward: update immediately, and treat any local account as a potential privilege escalation vector until you do.

On July 19, 2026, the last patent covering MPEG-4 Part 2 Visual — Brazilian patent BRPI0109962B1, held by Siemens AG and administered by the VIA Licensing Alliance — expired without fanfare. After 26 years, the codec that powered the golden age of internet video is now legally free in every jurisdiction on Earth.

MPEG-4 Part 2 is the technical standard behind DivX and Xvid, the two formats that defined how people shared movies online in the early 2000s. Anyone who remembers downloading a .avi file and needing a codec pack knows the format well. The codec reached its peak when broadband became widespread and hard drive space was still precious; a full DVD-quality film could compress to 700 MB and fit on a single CD.

But patents kept it encumbered. The MPEG-4 Visual patent pool required licensing fees for commercial use. Most US and European patents expired years ago, but Brazil's patent term and filing date pushed its expiration to July 2026. That single patent in a single country was enough to make global MPEG-4 Part 2 deployment technically risky for open source projects.

That changes now. FFmpeg, GStreamer, and VLC can ship MPEG-4 Part 2 encode and decode support anywhere — including Brazil — with no IP caveats. Linux distributions that previously shipped the codec with asterisks in their licensing docs can remove them. CI/CD pipelines in video processing and media transcription can freely include MPEG-4 Part 2 without legal review.

The comparison to MP3 is instructive. When the last Fraunhofer MP3 patent expired in April 2017, Fedora shipped MP3 playback enabled by default in its next release. The practical effect was smaller than anticipated — by 2017, most projects had already bundled the codec via patent-free alternatives or just accepted the risk — but the symbolic moment mattered. It completed a chapter.

For MPEG-4 Part 2, the situation is similar. H.264 and AV1 have long since taken over as the formats of choice. But legacy MPEG-4 Part 2 content is everywhere in video archives, surveillance footage, and older broadcast workflows. Open source tools can now handle that content without carve-outs.

Phoronix covered the expiration on July 19 itself, and a Hacker News thread surfaced the news the same day. For historians of digital video, the expiration also closes the book on a colorful era. DivX started as a pirated rip of Microsoft's MPEG-4 implementation; Xvid was created specifically as a free counterpart when DivX went commercial. Both names carry a generation's worth of cultural baggage. They are now patent-free software artifacts — freely distributable, unencumbered, and quietly preserved in every major multimedia toolkit.

System76 shipped COSMIC Epoch 1.3.0 on July 14, 2026 — the third minor update to its from-scratch Rust-based Linux desktop environment, and the release that finally delivers the visual centerpiece users have been requesting since the project launched.

The headline is frosted glass: a softly blurred transparency effect applied to window surfaces, panels, applets, and system interfaces. But the implementation goes deeper than a toggle — it's granular enough to enable selectively. You can enable frosted glass on the panel and dock while leaving application windows opaque, or go all-in across every surface. The setting lives under COSMIC Settings → Desktop → Appearance → Style.

Not a Reskin — A Different Codebase Entirely

Understanding why COSMIC matters requires understanding what it isn't. It's not GNOME with a theme applied. It's not a KDE fork. System76 built COSMIC entirely in Rust using its own custom toolkit, libcosmic, starting from nothing in 2022. That choice gives it a different performance profile from the rest of the Linux desktop landscape — faster cold-start times, more predictable memory usage — in exchange for a smaller extension ecosystem and fewer ready-made components.

1.3 continues that trajectory with two structural changes: the replacement of COSMIC Settings' custom NetworkManager backend with nmrs, a Rust-native alternative, and updates to the COSMIC Launcher to show the discrete GPU by default in the context menu.

GPU Monitoring Across AMD, Intel, and NVIDIA

The other major 1.3 addition is deeper hardware monitoring. The telemetry layer now exposes power draw, temperature, and utilization across all three major GPU vendors — AMD, Intel, and NVIDIA — surfaced directly in the COSMIC system interface without requiring a separate tool. For a desktop environment that positions itself partly at developers and creators pushing hardware, this is a more useful day-to-day feature than it might seem at first glance.

AVIF Wallpaper Support

A quieter change worth noting: COSMIC 1.3 adds AVIF wallpaper support via libdav1d. AVIF compresses images significantly better than PNG or JPEG at the same quality level — noticeable on HiDPI displays where a single wallpaper at native resolution can be several megabytes in older formats.

What's Still Missing

COSMIC's extension and theming ecosystem remains thin compared to KDE Plasma, and the app library is still catching up to what most users expect from a daily driver. For workflows that depend on complex tiling rules, third-party applets, or deep customization, it still requires more manual work than the established desktops.

That said, the gap has closed with each release. COSMIC 1.3 is available now via System76 software repositories and will roll into Pop!_OS with the next update cycle. Users on other distributions can build from source via the cosmic-epoch GitHub repository.

On July 11, 2026, the Debian project released Debian 13.6, the sixth point update to its current stable release "Trixie." It bundles 244 package fixes and over 120 security updates — but the headline item goes well beyond a routine maintenance release: a critical patch for an industry-wide Secure Boot crisis that has been building since the original certificates were issued 13 years ago.

The Problem: A 2013 Certificate Has Expired

UEFI Secure Boot is the mechanism that prevents a PC from booting tampered or unauthorized operating systems. At its core, it depends on a chain of digital certificates. The foundation of that chain — the 2013 UEFI Secure Boot Certificate Authority — shipped on virtually every PC sold over the past decade, and it's what gets used to verify the bootloaders of Linux distributions, Windows, and other operating systems.

That root certificate has now expired.

On its own, expiry doesn't immediately break anything — existing installations continue to boot normally. The danger is forward-looking: firmware updates that include revocation (DBX) database changes could leave systems unable to boot with Secure Boot enabled if the CA isn't updated at the same time. Systems that haven't migrated to the new certificate chain could also reject new shim builds after a future OS update, potentially locking users out.

What Debian 13.6 Ships to Fix It

Debian 13.6 addresses the problem through two targeted updates. First, fwupd has been bumped to version 2.0.20, which gains the ability to push updates to the Secure Boot Certificate Authority (CA), Key Exchange Key (KEK), and Forbidden Signatures Database (DBX) — the three databases that govern what a UEFI system will and won't boot. Second, shim and shim-signed have been updated for compatibility with the 2023 Microsoft UEFI CA and the new SBAT revocation requirements that accompany the transition.

Debian's release announcement strongly advises users to apply CA, KEK, and DBX updates from their system OEM after upgrading. The updates are being distributed through normal firmware update channels — fwupd's expanded capabilities make this process accessible for the first time on most hardware.

This Affects Every Linux Distribution

The Secure Boot CA expiry is a cross-distribution, cross-platform issue. Ubuntu, Fedora, Arch, openSUSE, and every other distribution that ships signed bootloaders traces back to the same 2013 root CA. The coordinated industry response has been in motion for months, with Microsoft, Canonical, Red Hat, and the Linux Foundation all working on the transition. Debian 13.6 is one of the clearest concrete examples of a major distribution shipping a packaged fix that users can actually apply.

If you're running any Linux distribution and haven't checked your Secure Boot certificate status recently, now is the time to look. The problem won't crash your machine today, but the window for an easy, graceful migration is narrowing as OEM firmware updates begin rolling out the new CA requirements in earnest.

Beyond the Secure Boot story, Debian 13.6 also brings updated Trixie live images with RAM sandboxing improvements, a GeoIP database rollback that resolves location detection regressions introduced in 13.5, and the steady accumulation of upstream bugfixes that keep Trixie on solid footing. For a point release, it's unusually consequential.