Linux

Receiving a transaction notification is only the first step. Production software still has to decide whether that event is safe to turn into application state.

A WebSocket callback can arrive in milliseconds. What happens afterward is harder. The XRP Price may be the public-facing metric most people associate with the asset, but developers integrating the XRP Ledger have a different concern. A long-running service has to detect transactions, determine whether their outcomes are final, and update local application state without acting twice or acting too soon.

When an XRPL Event Actually Means Something

A WebSocket connection can save an application from constantly polling for new activity. On a Linux service, that means keeping the connection open and listening for the XRP Ledger events the application cares about.

The XRP Ledger’s subscribe documentation explains how applications can listen for ledger activity, transactions, and account-related events. The transactions stream reports transactions associated with closed ledgers. The transactions_proposed stream goes further and can include proposed activity that never reaches a validated ledger.

That makes an incoming notification useful, but not necessarily authoritative. A service that treats every notification as an instruction to change business state can act before the ledger has established a final result.

For a payment service, the event is where processing begins.

Validation Comes Before Fulfillment

Transaction notifications can include a validated field. When validated is true, the transaction has been included in a validated ledger and its outcome is final.

A service might see a payment involving an account tied to an order and immediately tell a fulfillment system to release the product. If that payment came from proposed activity and has not reached a validated ledger, the application has acted before it knows the final outcome.

Validation is only the first check. Transaction metadata also includes TransactionResult. A transaction can be final without producing the successful result the application expected, so inclusion in a validated ledger should not be treated as proof that a payment succeeded.

For payments, delivered_amount is the field that shows what actually reached the destination. That can matter when the amount requested and the amount ultimately delivered are not identical.

Before an order changes state, the service needs to know whether the transaction is final, whether it succeeded, and what value actually arrived.

Linux kernel developers are renewing efforts to retire the x32 application binary interface (ABI), a little-used compatibility feature that attempted to combine the advantages of 64-bit processors with the smaller memory footprint of 32-bit applications. A revised patch series submitted on October 8, 2026, proposes the first steps toward disabling the interface, potentially ending support for an architecture experiment introduced more than 14 years ago.

The latest proposal comes from Sebastian Andrzej Siewior, a Linux kernel developer at Linutronix who has been working on the removal effort throughout 2026. Rather than immediately deleting every component associated with x32, the proposed approach would first prevent the feature from being enabled through normal kernel configuration. This would give remaining users and distribution maintainers an opportunity to respond before the underlying implementation is removed.

The effort reflects a broader challenge in Linux development: maintaining compatibility with older or rarely used technologies while keeping the kernel manageable, secure, and efficient. Although x32 offered theoretical performance and memory advantages, it never achieved widespread adoption. With conventional x86_64 software dominating modern Linux systems, developers are increasingly questioning whether the additional maintenance burden remains justified.

Understanding the Linux x32 ABI

The x32 ABI was introduced with Linux kernel 3.4 in 2012 as an alternative to conventional 32-bit and 64-bit application environments. Its goal was to provide applications with access to the architectural improvements of x86_64 processors while retaining smaller data types and pointers associated with 32-bit software.

Traditional 32-bit x86 applications use the i386 ABI, which operates with a more limited register set and 32-bit execution conventions. Standard x86_64 applications, meanwhile, benefit from additional general-purpose registers, wider registers, and modern calling conventions, but they normally use 64-bit pointers. Those larger pointers can increase memory consumption in applications that maintain large numbers of pointer-heavy data structures.

The x32 ABI attempted to offer a compromise. Applications would execute using the x86_64 instruction set and its larger register file while retaining 32-bit integers, long values, and pointers. This programming model is commonly described as ILP32, meaning that integers, long integers, and pointers are all 32 bits wide.

The distinction can be illustrated by comparing the expected sizes of common C data types:

Google is exploring a new approach to Linux kernel security that could significantly change how device drivers interact with the operating system. The experimental project, known as Kage, uses compiler-based sandboxing to isolate drivers inside the kernel, potentially limiting the damage caused by memory corruption, programming errors, and exploitable vulnerabilities without requiring drivers to run as separate user-space processes.

The research was presented at the Linux Plumbers Conference 2026, held October 5–7, with Stanford University and Google researcher Zachary Yedidia discussing how LLVM's Lightweight Fault Isolation (LFI) technology can create restricted execution environments for native kernel code. Unlike conventional isolation techniques, which often depend on separate processes or virtual machines, Kage attempts to preserve the performance advantages of kernel-space execution while reducing the amount of memory individual drivers can access.

Early prototypes have already demonstrated the concept using NVMe storage, networking, and Wi-Fi drivers. However, Kage remains an experimental research project rather than a feature available in mainstream Linux distributions. Its developers are still investigating performance, hardware access, and compatibility with more complicated drivers, including graphics hardware.

Why Device Drivers Remain a Major Linux Security Challenge

Linux device drivers are responsible for connecting the operating system to hardware components, including graphics cards, network adapters, storage controllers, USB devices, and wireless chipsets. Most traditional Linux drivers execute in kernel space, giving them privileged access to system resources and the ability to interact directly with hardware. This architecture is one reason Linux can deliver high performance across such a broad range of devices, but it also creates a significant security challenge.

When an ordinary application encounters a memory error, the operating system can often terminate that process without affecting the rest of the system. Kernel drivers operate under different conditions. Because they typically share the kernel's address space and privileges, an invalid memory access or exploitable vulnerability can affect unrelated kernel components, potentially resulting in a system crash, privilege escalation, or complete compromise of the operating system.

The challenge becomes more complicated when considering the enormous number of drivers supported by Linux. Some are maintained by large organizations with extensive testing infrastructure, while others receive contributions from smaller development teams or individual maintainers. Even carefully reviewed drivers can contain bugs, particularly when they interact with complicated hardware, asynchronous operations, and memory-management mechanisms.

Linux users have long had a pragmatic relationship with text-to-speech. The classic open-source engines have been available for years, wired into accessibility tools and the occasional script, dependable but unmistakably robotic. They do the job where the job is simply to convert text to some kind of speech, but the mechanical output has kept them out of anything where the voice actually matters. The arrival of high-quality speech synthesis delivered over an API changes what is possible, letting Linux users add genuinely natural voices to scripts, services, and applications without hosting a heavyweight model themselves.

The Familiar Trade-Off

Anyone who has used the traditional Linux speech engines knows the trade-off. They are free, local, and scriptable, which fits the Linux ethos perfectly, but the voices are clearly synthetic. For accessibility and for utilitarian tasks where intelligibility is all that counts, that has been acceptable. For anything user-facing where the quality of the voice shapes the experience, it has not.

The alternative of running a modern, high-quality speech model locally is possible but comes with real costs: significant computational requirements, model management, and the ongoing maintenance of a demanding piece of infrastructure. For many use cases, particularly on servers, embedded systems, or ordinary workstations, that overhead is disproportionate to the need. This is the gap that an API-based approach fills, offering the quality of a large modern model without the burden of hosting one.

The API Approach on Linux

Delivering speech synthesis over an API fits naturally into how Linux users already build things. Rather than installing and maintaining a model, you make a request to a service and receive audio back, which you can then play, save, or pipe into whatever comes next. A text to speech api turns text into natural-sounding audio through a simple network call, which means a script or service can produce high-quality speech with nothing more than the ability to make an HTTP request and handle the response.

This composability is what makes it appealing in a Linux context. The request can come from a shell script, a systemd service, a cron job, a Python program, or any application that can talk to a network endpoint. The returned audio slots into the familiar toolchain of files, pipes, and media players. For users accustomed to assembling capabilities from small, cooperating parts, a speech API is just another well-behaved component that happens to produce audio, and it drops into existing workflows without disturbing them.

The Arch Linux project has released Archinstall 4.5, the latest version of its guided text-based installer, bringing expanded AArch64 support, new real-time Linux kernel options, additional translations, security improvements, and numerous fixes for installation workflows.

Archinstall 4.5 was released on September 29, 2026, roughly three months after Archinstall 4.4. The new version arrives just ahead of Arch Linux's October installation media refresh and has already been packaged as archinstall 4.5-1 for Arch Linux repositories.

While Archinstall remains optional, it provides users with a guided way to configure an Arch Linux installation without manually performing every step described in the Arch installation guide. Version 4.5 concentrates primarily on hardware support, installer reliability, security, and expanding the range of systems that can use the guided installation process.

AArch64 Support Gets a Major Upgrade

One of the biggest changes in Archinstall 4.5 is improved support for AArch64, the 64-bit ARM architecture.

The installer can now handle GRUB and Limine EFI installations on AArch64 systems. It also gains support for the proper AArch64 root partition type GUID.

Previously, parts of Archinstall's bootloader configuration were more heavily oriented toward x86_64 installations. The latest changes make its guided installation workflow more useful on ARM64 hardware.

AArch64 has become increasingly important throughout the Linux ecosystem. The architecture can now be found in cloud servers, development boards, laptops, workstations, and specialized computing platforms.

Supporting both GRUB and Limine EFI installations gives Archinstall more flexibility when preparing these systems.

GRUB Can Now Be Installed on AArch64

GRUB remains one of the most widely used Linux bootloaders, and Archinstall 4.5 extends its installation logic to AArch64 EFI systems.

This allows ARM64 installations to use a bootloader workflow much closer to what Archinstall already provides on conventional x86_64 UEFI computers.

The change doesn't mean every ARM device will automatically become compatible with Arch Linux. ARM hardware can still have highly platform-specific firmware and boot requirements.

It does, however, remove an important Archinstall limitation for AArch64 machines that provide conventional UEFI environments.

Limine EFI Support Expands to ARM64

The same architectural expansion applies to Limine.

Limine is a modern multiprotocol bootloader supported as one of Archinstall's bootloader choices. Archinstall 4.5 extends its EFI installation support to AArch64 as well.

The systemd project has officially released systemd 262, delivering another substantial update to the system and service manager used by most major Linux distributions. The final release was tagged on September 22, 2026, following three release candidates earlier in the month.

Systemd 262 introduces improvements across service management, containers, virtualization, encrypted storage, TPM security, networking, journal recovery, system updates, and unattended installations. Among the most interesting additions are the ability to build systemd as a single statically linked PID 1 binary, Intel TDX support in systemd-vmspawn, Live Update Orchestrator integration, improved TPM-backed encryption, and new fallback unit files embedded directly into the systemd manager.

The release also contains a rather unusual development safeguard: an AI/LLM canary intended to help identify code contributions generated by AI that haven't been properly reviewed by a human before submission.

systemd 262 Is Officially Available

The final systemd 262 source was tagged by systemd developer Luca Boccassi on September 22.

The upstream tag identifies commit 8cc40e0c5e9234bf45084751ac53b1fbfe70b492 as systemd v262, following release candidates published throughout September.

The release has already begun reaching Linux distribution development repositories.

Debian accepted systemd 262-1 into Debian Unstable on September 22, while Fedora has prepared systemd 262 packages for Fedora 45.

As usual, the speed at which systemd 262 reaches ordinary users will depend on each distribution's update policy.

systemd Can Now Become a Single Static PID 1 Binary

One of the most interesting changes in systemd 262 is support for building systemd as a single statically linked PID 1 and executor binary.

The feature is primarily intended for extremely small container environments.

Normally, systemd depends on a collection of dynamically linked libraries and supporting components. That architecture makes sense for a complete Linux distribution, but containers sometimes need a much smaller runtime environment.

The new static configuration makes it possible to create a more self-contained systemd executable suitable for minimal container images.

These builds avoid dynamically loading optional libraries and use simplified mechanisms for resolving users and groups rather than relying on the complete Name Service Switch infrastructure.

This doesn't mean normal Linux distributions will suddenly replace their standard systemd packages with a giant static executable. The capability is specifically useful for specialized container and minimal-system deployments.

Ubuntu administrators running containerized workloads have a new Linux kernel security problem to watch closely. Public exploit code is now available for CVE-2026-80521, a Linux kernel use-after-free vulnerability that can allow an unprivileged process inside a container to escape and obtain root privileges on the underlying host.

Security firm DepthFirst published its research and exploit on September 22, 2026, demonstrating the attack against Ubuntu 26.04 LTS. The underlying Linux kernel vulnerability had already been fixed upstream on August 6, but as of September 23, Ubuntu's security tracker still lists the main kernel package in Ubuntu 26.04 LTS as "Vulnerable, work in progress," while Ubuntu 24.04 LTS is also listed as vulnerable.

The situation is particularly important for Docker, Kubernetes, cloud infrastructure, and other environments that run potentially untrusted workloads because the vulnerable kernel functionality can be reached through ordinary operations available inside standard containers.

There is currently no confirmed evidence that CVE-2026-80521 is being actively exploited in real-world attacks, and the vulnerability isn't listed in CISA's Known Exploited Vulnerabilities catalog. The availability of working public exploit code nevertheless makes the patch gap considerably more important.

CVE-2026-80521 Is a Linux Kernel Vulnerability

Although Ubuntu is receiving much of the attention because the newly published exploit specifically targets it, CVE-2026-80521 is fundamentally a Linux kernel vulnerability.

The problem exists in the kernel's AF_UNIX socket subsystem, specifically within its garbage collection mechanism.

AF_UNIX sockets, commonly called Unix-domain sockets, provide local inter-process communication between applications running on the same system.

Unlike conventional network sockets, they don't need to communicate across a network. They are widely used by Linux applications and services for fast communication between local processes.

They also support passing file descriptors between processes through SCM_RIGHTS messages, and it is the kernel's management of these references that creates the conditions for CVE-2026-80521.

A Race Condition Leads to Use-After-Free

At the technical level, CVE-2026-80521 involves a race condition inside the AF_UNIX garbage collector.

The kernel needs to track references between Unix sockets when file descriptors are passed between processes. Circular references can develop, where one socket effectively references another while that socket references something else in the same group.

Linux represents these relationships internally and periodically determines which references can safely be removed.

The Fedora Project has officially released Fedora Linux 45 Beta, giving users an early look at the technologies expected to form the foundation of the final Fedora 45 release. The beta became available on September 15, 2026, after Fedora's Quality team approved Release Candidate 1.3 for publication.

Fedora 45 Beta brings significant changes throughout the operating system, including Python 3.15, GCC 16.2, glibc 2.44, GNU Binutils 2.47, Go 1.27, LLVM 23, Podman 6, stricter RPM signature verification, improved DNF5 protections, a new userspace virtual console, standardized desktop secret storage, and substantial installer improvements.

The release is available across Fedora Workstation, KDE Plasma Desktop, Server, Cloud, IoT, Atomic Desktops, Spins, and Labs, although a few prerelease images are excluded.

Fedora 45 Beta Is Now Available

Fedora Linux 45 Beta represents the final major public testing milestone before Fedora 45 reaches stable status.

Fedora describes its beta releases as code-complete previews that closely represent what users should expect from the final version. Development isn't finished, however, and bugs or incomplete migrations can still be discovered during real-world testing.

Fedora 45 Beta is currently available in several major editions:

• Fedora Workstation 45 Beta
• Fedora KDE Plasma Desktop 45 Beta
• Fedora Server 45 Beta
• Fedora Cloud 45 Beta
• Fedora IoT 45 Beta
• Fedora Atomic Desktops
• Fedora Spins
• Fedora Labs

Existing Fedora installations can also be upgraded to the beta using Fedora's DNF system-upgrade process.

Fedora's official Workstation download page confirms Beta 1.3 images for both x86_64 and AArch64 systems.

A New Virtual Console with kmscon

One of Fedora 45's more unusual system-level changes is the replacement of the traditional in-kernel console with kmscon.

Fedora describes kmscon as a modern userspace virtual terminal implementation that provides smoother rendering, better internationalization and font handling, improved visual integration, and security improvements compared with the older console infrastructure.

This affects the virtual terminals users encounter outside their normal graphical desktop session.

Most desktop users spend relatively little time interacting directly with these consoles, but they remain important for troubleshooting, system administration, servers, recovery operations, and systems running without a graphical environment.

Moving that functionality into userspace also gives Fedora more flexibility for future development instead of relying entirely on the legacy kernel console implementation.

The Thunderbird team has officially released Thunderbird 156, bringing another round of new features, security improvements, authentication enhancements, and reliability fixes to the popular open-source email client. Released on September 15, 2026, the update is available for Linux alongside Windows and macOS.

Thunderbird 156 is not a dramatic redesign of the desktop mail client. Instead, it concentrates on improving areas that matter to everyday users and system administrators, including OAuth authentication, OpenPGP, POP3, IMAP, Exchange Web Services, SMTP, attachments, calendars, enterprise policies, and security.

For Linux users in particular, the release delivers several fixes affecting common mail protocols and account configurations while retaining support for Linux environments using GTK+ 3.14 or newer.

Thunderbird 156 Arrives on Linux

Thunderbird 156 follows version 154, which arrived in August with features including optional system tray operation and Microsoft Graph support for Microsoft 365.

Version 156 continues the project's monthly release cycle with a more targeted collection of authentication, security, compatibility, and reliability improvements.

According to Thunderbird's official release notes, version 156 requires:

• Linux: GTK+ 3.14 or newer
• Windows: Windows 10 or newer
• macOS: macOS 10.15 or newer

Thunderbird 156 was officially released on September 15.

Linux distribution availability will vary because distributions can package Thunderbird according to their own schedules. Users receiving Thunderbird through another packaging channel may therefore see version 156 at a different time.

Custom OAuth Support Expands

One of the most significant areas of development in Thunderbird 156 is OAuth authentication.

Thunderbird now supports custom OAuth configurations containing an issuer ID and client secret for IMAP and POP3 accounts. Custom OAuth support has also been extended specifically to POP3.

OAuth has become increasingly important as email providers move away from conventional username-and-password authentication toward token-based authentication.

For Thunderbird, broader custom OAuth support means users and organizations have greater flexibility when connecting the client to mail services that don't fit Thunderbird's predefined provider configurations.

This can be particularly useful in enterprise environments, self-hosted infrastructure, and organizations operating their own identity systems.

Exchange Custom OAuth Setup Fixed

Exchange users receive an important related correction.