LINUX Unplugged

We dig into the Copy Fail vulnerability and test a proof-of-concept against our own box. Plus, Jon Seager, VP of Engineering at Canonical joins us, and we kick off the BSD Challenge!
Sponsored By:
Jupiter Party Annual Membership: Put your support on automatic with our annual plan, and get one month of membership for free!
Managed Nebula: Meet Managed Nebula from Defined Networking. A decentralized VPN built on the open-source Nebula platform that we love.
Support LINUX Unplugged
Links:
💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
Copy Fail — CVE-2026-31431 — "An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root." — Theori
Copy Fail: 732 Bytes to Root - Xint — "A single 732-byte Python script can edit a setuid binary and obtain root on essentially all Linux distributions shipped since 2017." — Xint
Linux Kernel Bug Explained - Jorijn — "CopyFail is more portable. One script, every distro, no offsets. Dirty Pipe needed kernel ≥ 5.8; Copy Fail covers 2017–2026." — Jorijn"Kubernetes Pod Security Standards (Restricted) and default seccomp do NOT block the syscall used." — Jorijn
Ars: Most Severe Linux Threat in Years — "The most severe Linux threat to surface in years catches the world flat-footed." — Ars Technica
Sysdig: CVE-2026-31431 Analysis — "The flaw was introduced in 2017 via commit 72548b093ee3, which switched AEAD operations to in-place processing." — Sysdig
CERT-EU Advisory
Ubuntu Security Tracker
The Register: Crypto Flaw
Kernel Patch (reverts 2017 optimization) — "This mostly reverts commit 72548b093ee3 except for the copying of the associated data." — Kernel Commit
Buggy Commit: 72548b093ee3 (2017)
DeepWiki: AF_ALG Internals
oss-security Disclosure
PSA + GRUB Mitigation - Jan Wildeboer
Ubuntu 26.04 LTS (Resolute Raccoon) Released — "Ubuntu 26.04 LTS sets the example for providing best-in-class resilience while simultaneously embracing innovation and the advancement of open source." — Jon Seager, VP Ubuntu Engineering
The Future of AI in Ubuntu - Jon Seager — "Throughout 2026 we'll be working on enabling access to frontier AI for Ubuntu users in a way that is deliberate, secure, and aligned with our open source values." — Jon Seager
Ubuntu 26.04 Release Notes
Ubuntu AI Features Throughout 2026 - Phoronix — "Canonical's approach to AI is refreshingly thoughtful — Microsoft should take note." — ZDNet
Canonical DDoS Attack Update — "Canonical's web infrastructure is under a sustained, cross-border attack and we are working to address it." — arcticp, Canonical
Ubuntu Weekly Newsletter #942
Canonical AI Approach - ZDNet
9to5Linux: Opt-In LLM Tools
uutils/coreutils: Cross-platform Rust rewrite of the GNU coreutils
LINUX Unplugged 636: Engineering the Future
LiveCD fails to start X session on QEMU · Issue #354 · ghostbsd/issues
Monty's “rescue” drive NixOS config
Magnolia Mayhem's BSD Challenge Report
Pick: NASty — NASty is a NAS operating system built on NixOS and bcachefs. It turns commodity hardware into a storage appliance serving NFS, SMB, iSCSI, and NVMe-oF — managed from a single web UI, updated atomically, and rolled back when things go sideways.
Pick: Defuse — Defuse is a GTK4 application for removing image backgrounds locally.
Defuse on Flathub

After 26 years, we return to our roots and reflect on why LinuxFest Northwest is still a special event.
Sponsored By:
Jupiter Party Annual Membership: Put your support on automatic with our annual plan, and get one month of membership for free!
Managed Nebula: Meet Managed Nebula from Defined Networking. A decentralized VPN built on the open-source Nebula platform that we love.
Support LINUX Unplugged
Links:
💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
LINUX Unplugged 666 BSD Challenge - Rules and Regrets
LFNW2026 - Back to Root
LinuxFest Northwest 2026 Playlist - YouTube
LinuxFest Northwest - YouTube
The New Linux Kernel AI Bot Uncovering Bugs Is A Local LLM On Framework Desktop + AMD Ryzen AI Max
Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain
Bear454's Fundraiser: Support for James Mason's Family
Pick: Updo — Updo is a command-line tool for monitoring website uptime and performance. It provides real-time metrics on website status, response time, SSL certificate expiry, and more, with alert notifications.
Pick: Pake — 🤱🏻 Turn any webpage into a desktop app with one command.

We all have data to rescue, you just don't realize it yet. This week we build our own custom live rescue distros, recover real data, and show you how to make your own.
Sponsored By:
Jupiter Party Annual Membership: Put your support on automatic with our annual plan, and get one month of membership for free!
Managed Nebula: Meet Managed Nebula from Defined Networking. A decentralized VPN built on the open-source Nebula platform that we love.
Support LINUX Unplugged
Links:
💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
LinuxFest Northwest 2026 - Back to Root — April 24-26, 2026 - Bellingham, Washington
6 ultimate boot CDs (system rescue) for troubleshooting Windows PCs
SystemRescue — A Linux system rescue toolkit available as a bootable medium for administrating or repairing your system and data after a crash.
Finnix — Debian-based, CLI-focused with a comprehensive set of repair tools. Recent updates improved modern hardware support, boot speed, zram compression, and SSH remote access.
Changes/ModernizeLiveMedia - Fedora Project Wiki — Modernize the live media by switching to the "new" live environment setup scripts provided by livesys-scripts and leverage new functionality in dracut to enable support for automatically enabling persistent overlays when flashed to USB sticks.
Fedora 41: Modernize the live media Overlay Features?
aegis-boot — A signed UEFI Secure Boot rescue environment that lets operators pick any ISO from a USB stick's data partition and kexec into it — without leaving the chain of trust.
netboot.xyz — A network-based bootable operating system installer based on iPXE.
Greg's nixos-config
Self-Hosted 129: Forged Alliance — The battle for code forges is heating up. We chat about HexOS' big promises and get excited about Meshtastic.
pocket-id — A simple OIDC provider that allows users to authenticate with their passkeys to your services.
What Is Claude Mythos—And Why Anthropic Won’t Let Anyone Use It
v4call — v4call is a decentralised video, voice and text platform built on the Hive blockchain. Users set their own rates for receiving calls and messages.
Pick: Metadata Cleaner — View and clean metadata in files
Metadata Cleaner on FlatHub
Pick: mat2 — mat2 is a metadata removal tool, supporting a wide range of commonly used file formats, written in python3
Pick: Little Snitch for Linux — Every time an application on your computer opens a network connection, it does so quietly, without asking. Little Snitch for Linux makes that activity visible and gives you the option to do something about it.
littlesnitch-linux-flake — A Nix Flake for Little Snitch for Linux
Pick: PCAPdroid — No-root network monitor, firewall and PCAP dumper for Android

Is it time to replace GitHub in our workflow? We git into it. Plus, our favorite features in the new Linux 7.0 release.
Sponsored By:
Jupiter Party Annual Membership: Put your support on automatic with our annual plan, and get one month of membership for free!
Managed Nebula: Meet Managed Nebula from Defined Networking. A decentralized VPN built on the open-source Nebula platform that we love.
Support LINUX Unplugged
Links:
💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
LinuxFest Northwest 2026 — April 24-26, 2026 - Bellingham, Washington
LFNW2026 Schedule
Linux 7.0: Btrfs — A translation layer of logical block addresses that allows changes without moving or rewriting blocks for relocation
Linux 7.0: XFS — Autonomous self-healing; delivers live filesystem health events to userspace for automatic repairs
Linux 7.0: EXT4 — Improves write performance for concurrent direct I/O writes
Linux 7.0: IO-uring — Adds support for BPF filtering to IO_uring for high performance async I/O
Linux 7.0: Scheduler — Scheduler updates land with time slice extension, performance and scalability work for high core count systems
Linux 7.0: Rust — Formally concluding the 'Rust experiment'; Rust for the Linux kernel is here to stay
Linux 7.1: i486 — Begins phasing out Intel 486 CPU support; no known Linux distributions still ship with i486 support
Give Up GitHub — We realize this is not an easy task; GitHub is ubiquitous. Through their effective marketing, GitHub has convinced FOSS developers that GitHub is the best (and even the only) place for FOSS development.
opengist — Self-hosted pastebin powered by Git, open-source alternative to Github Gist.
Forgejo on Codeberg — Beyond coding. We forge.
Forgejo — Self-hosted alternative to GitHub; liberate your software from proprietary shackles with a familiar environment
NixOS Wiki: Forgejo — Lightweight software forge; completely free software and a fork of Gitea
Forgejo Actions — Reusable pieces of code for CI workflows; compatible with GitHub Actions
NixOS Forgejo Actions Runner — NixOS configuration for turnkey deployment of Forgejo Actions runners
Forgejo Federation (PR #10453) — Work-in-progress for federated repositories; enabling decentralized software development
Forgejo Snippets (Issue #1069) — Create a shareable piece of text, be it code or plain text, publicly or privately
Git Novice Guide — Free interactive tutorial; learn version control with Git from scratch
Pick: sshroute — Network-aware SSH router - routes connections to different IPs/ports/keys/jump hosts based on active VPN or network
Pick: rendercv — Resume builder for academics and engineers
Pick: ESPHome Starter Kit — DIY sensor kit for Home Assistant with ESPHome; build your own smart home devices

The expensive, challenging, and humbling journey with open source agents.
Sponsored By:
Jupiter Party Annual Membership: Put your support on automatic with our annual plan, and get one month of membership for free!
Managed Nebula: Meet Managed Nebula from Defined Networking. A decentralized VPN built on the open-source Nebula platform that we love.
Support LINUX Unplugged
Links:
💥 Gets Sats Quick and Easy with Strike
📻 LINUX Unplugged on Fountain.FM
LinuxFest Northwest 2026 - Back to Root — April 24-26, 2026 - Bellingham, Washington
Preferring Local OSS LLMs
Qwen3.5 27B vs Gemma4 31B
Open Models have crossed a threshold
Gemma 4 — Google DeepMind
Welcome Gemma 4: Frontier multimodal intelligence on device
Gemma-4-31B-JANG\_4M-CRACK · Hugging Face
mesh-llm — Mesh LLM lets you pool spare GPU capacity across machines and expose the result as one OpenAI-compatible API.
hermes-agent: The agent that grows with you — The self-improving AI agent built by Nous Research. It's the only agent with a built-in learning loop — it creates skills from experience, improves them during use, nudges itself to persist knowledge, searches its own past conversations, and builds a deepening model of who you are across sessions.
goose — An open source, extensible AI agent that goes beyond code suggestions; install, execute, edit, and test with any LLM.
Lobehub — The ultimate space for work and life. To find, build, and collaborate with agent teammates that grow with you. We are taking agent harness to the next level; enabling multi-agent collaboration, effortless agent team design, and introducing agents as the unit of work interaction.
LibreFang — LibreFang is an open-source agent operating system written in Rust.
OpenHarness — OpenHarness is an open-source Python implementation designed for researchers, builders, and the community.
Microsoft's Newest Open-Source Project: Runtime Security For AI Agents — Microsoft proclaims their new open-source project is the first toolkit that addresses all ten agentic AI risks identified last year by the OWASP
Top 10 Risks and Mitigations for Agentic AI Security - OWASP Gen AI Security Project
googleworkspace/cli: Google Workspace CLI — One command-line tool for Drive, Gmail, Calendar, Sheets, Docs, Chat, Admin, and more. Dynamically built from Google Discovery Service. Includes AI agent skills.
Tunarr API Reference
Euro-Office launches as Europe's open-source Office rival
Pick: single-file-cli — CLI tool for saving a faithful copy of a complete web page in a single HTML file (based on SingleFile)
Pick: html-to-markdown — Convert HTML to Markdown. Even works with entire websites and can be extended through rules.
Pick: skim — Turns any HTML page into clean markdown.