TLDR: The Linux 7.1 merge window was the week’s biggest story, pulling in a new NTFS driver, FRED enabled by default for Panther Lake, scheduler improvements, and the removal of i486 and Baikal CPU support. Claude Code found a 23-year-old NFS heap overflow, which is either impressive or alarming depending on your threat model. <a href="http://Cal.com" target="_blank" rel="noopener nofollow">Cal.com</a> closed its source citing AI-driven vulnerability scanning, and Discourse immediately pushed back. KDE Plasma 6.7 finally shipped per-screen virtual desktops after a 21-year-old bug report.
<hr>
<h2>Linux 7.1 merge window</h2>
The 7.1 merge window closed with a lot of ground covered. The headline item is a new NTFS driver — four years in the making by Namjae Jeon — that replaces the stagnant NTFS3 driver with write support, better XFStests coverage, and multi-threaded write speeds 35–110% faster than its predecessor. FRED (Flexible Return and Event Delivery) is now on by default for Intel Panther Lake, delivering measurable gains in I/O-heavy workloads. The HRTIMER subsystem got a significant overhaul from Thomas Gleixner, the scheduler picked up incremental improvements from Intel and AMD engineers, and WQ_AFFN_CACHE_SHARD landed from Meta — showing roughly 5x throughput improvement on NVIDIA Grace’s 72-core single-LLC design. Intel i486 support is being removed, Baikal CPU support is gone (the company went bankrupt after sanctions cut off TSMC access), and the Sheaves performance regression from 7.0 is fixed.
<h2>Claude Code finds a 23-year-old kernel vulnerability</h2>
Anthropic researcher Nicholas Carlini ran Claude Code against Linux kernel source files with a simple bash script — no custom tooling — and turned up multiple confirmed vulnerabilities including a 23-year-old heap buffer overflow in the NFS driver. Five bugs across NFS, io_uring, futex, and ksmbd have been patched. Kernel maintainers report security list volume jumping from 2–3 reports per week to 5–10 per day, with the quality of AI-assisted reports now meaningfully better than the noise of earlier months. The dual-use concern here is real: the same process runs equally well for attackers.
<h2><a href="http://Cal.com" target="_blank" rel="noopener nofollow">Cal.com</a> closes source, Discourse refuses</h2>
<a href="http://Cal.com" target="_blank" rel="noopener nofollow">Cal.com</a> announced it’s moving its production codebase to a private repo, citing AI-powered vulnerability scanning as the trigger. The old codebase lives on as Cal.diy under MIT, but without enterprise features. Discourse co-founder Sam Saffron responded directly: after 13 years, Discourse is staying GPLv2. His argument is that closed source removes defenders without removing attackers, and that Discourse already runs GPT-5.4 and Claude Opus in multi-day deep scans every release cycle. The debate is worth watching — <a href="http://Cal.com" target="_blank" rel="noopener nofollow">Cal.com</a>’s reasoning is at least coherent, but the security community is mostly unconvinced that obscurity helps here.
<h2>KDE Plasma 6.7 ships per-screen virtual desktops</h2>
A bug first filed in June 2005 is finally closed. KDE Plasma 6.7 lets each monitor show a different virtual desktop independently — Wayland only, X11 won’t get it and is being dropped in Plasma 6.8 anyway. The fix was implemented by Hynek Schlindenbuch, a PHP developer with no prior KDE contributions and minimal C++ experience. The release also adds Wayland session restore (apps remember their sizes and positions after logout) and per-GPU display in System Monitor.
<hr>
<h2>Also notable</h2>
<ul>
<li>GIMP 3.2.4 fixes a bug in the XCF file format that has been sitting there since 1999, plus a Wayland cursor fix and the replacement of the old TWAIN scanner plugin with WIA on Windows.</li>
<li>Fedora 44 delayed again to April 28 due to blocker bugs including a black screen on ThinkPad X1 Carbon Gen 13 and btrfs installation failures; four more proposed blockers could push it further.</li>
<li>CachyOS ships Linux 7.0 with backported extras including Intel FRED enabled by default for Core Ultra Series 3 and the new NTFS driver ahead of mainline.</li>
<li>WireGuard for Windows hits v1.0 after resolving all identified blockers, with bug fixes and improved MTU change notifications.</li>
<li>Thunderbolt (MZLA/Mozilla) launched as an open-source, self-hostable enterprise AI client under MPL 2.0, targeting organizations that want to run models on their own infrastructure; security audit not yet complete, so not production-ready.</li>
<li>Switzerland plans to reduce Microsoft dependency after spending CHF 1.1 billion on licenses over the past decade, with a feasibility study confirming open-source migration is viable.</li>
<li>France’s DINUM is requiring all ministries to submit Linux migration plans by Autumn 2026, with 100,000 machines already running Ubuntu.</li>
<li><a href="http://X.Org" target="_blank" rel="noopener nofollow">X.Org</a> Server 21.1.22 patches five new CVEs including an XKB buffer overflow and an XSYNC use-after-free, some tracing back to X11R6.6.</li>
<li>Archinstall 4.2 fixes a critical security bug where encryption keyfiles were written as plaintext to unencrypted root partitions — reported in June 2023, fixed now.</li>
<li>Mailcow XSS vulnerabilities patched in version 2026-03b, including an unauthenticated account takeover via unescaped email addresses in Autodiscover logs.</li>
<li>Proton 11.0 Beta 1 adds ARM64 support via FEX-2604, enabling Windows-on-ARM game compatibility; a modder already used it to run Steam on the original Nintendo Switch.</li>
<li>SDL bans AI-generated code contributions, citing unknown code origins potentially conflicting with the Zlib license and hallucination risks; AI can still be used to identify issues.</li>
<li>GhostBSD 26.1 rebases on FreeBSD 15.0 and switches to XLibre as the default display server for MATE.</li>
<li>Forgejo 15.0 released as an LTS version supported through July 2027, with repository-specific access tokens and Actions improvements.</li>
<li>Linux Mint 23 targets December 2026 on Ubuntu 26.04 LTS, dropping Ubiquity for the LMDE live-installer and laying Wayland groundwork in Cinnamon 6.7.</li>
<li>AMD FP-DSS vulnerability disclosed for Zen 1 and Zen 1+ processors — a transient execution bug allowing potential data leakage via floating point divisor units; Linux kernel already patched.</li>
<li>Attackers impersonating Linux Foundation leaders on Slack to phish open source developers, using Google Sites for credential harvesting and delivering malware disguised as root certificates; TODO Group and CNCF projects were targeted.</li>
<li>HR8250 (Parents Decide Act) introduced in the US House, proposing OS-level age verification with language broad enough to potentially cover Linux distributions and embedded systems; still in committee.</li>
<li>KeePassChi forked from KeePassXC 2.7.10, the last release before KeePassXC adopted an LLM-assisted development policy; first formal release expected by end of May.</li>
<li>Sruthi Chandran elected Debian Project Leader for 2026, running unopposed; she has contributed to Ruby, JavaScript, Go, and font packages since joining as a Debian Developer in 2016.</li>
<li>Valve enables Radeon HD 7870 XT on Linux nearly 14 years after launch, fixing TCC cache partial disable handling that had blocked open-source driver support since 2013.</li>
<li>GNOME screencasting H.264 bug fixed — VA-API H.264 recordings were producing files roughly 18x larger than VP8 due to missing rate control settings; a two-line fix resolves it.</li>
<li>Raspberry Pi OS now requires a password for sudo on new installs, ending the open-door policy that had been the default since the project’s early days.</li>
</ul>

Linux distro releases, open source project news, and FOSS community updates.

Open Source Digest

The Linux 7.1 merge window closed with major changes including a new NTFS driver (35–110% faster writes), FRED enabled by default for Intel Panther Lake, scheduler improvements, and removal of i486 and Baikal CPU support. Anthropic researcher Nicholas Carlini used Claude Code to find a 23-year-old NFS heap buffer overflow and four other kernel vulnerabilities, raising dual-use concerns as AI-assisted security scanning scales. Cal.com moved its production codebase to a private repo citing AI-driven vulnerability scanning risks; Discourse co-founder Sam Saffron publicly refused to follow suit, arguing obscurity removes defenders without stopping attackers. KDE Plasma 6.7 finally resolved a 21-year-old bug by adding per-screen virtual desktops (Wayland only). Other notable items include GIMP 3.2.4 fixing a 1999 XCF bug, Fedora 44 delayed again, WireGuard for Windows hitting v1.0, France requiring Linux migration plans from all ministries, SDL banning AI-generated code contributions, and attackers phishing open source developers by impersonating Linux Foundation leaders on Slack.

Linux 7.1 merge window dominates, Cal.com goes closed source over AI security fears