[Testing Update] 2025-11-06 - Kernels, Mesa, Grub, Nvidia, Plasma 6.5, LibreOffice

Manjaro Linux
2 months 3 weeks ago

Hello community, here we have another set of package updates. Welcome to our new development cycle of Manjaro 25.1.0, code-named ‘Anh-Linh’.We will focus on Plasma 6.5 series and will introduce GNOME 49, maybe Cosmic 1.0 (Beta).

Current Promotions Recent News Valkey to replace Redis in the [extra] Repository (click for more details) Previous News Finding information easier about Manjaro (click for more details) Notable Package Updates Additional Info Python 3.13 info (click for more details) Info about AUR packages (click for more details)

Get our latest daily developer images now from Github: Plasma, GNOME, XFCE. You can get the latest stable releases of Manjaro from CDN77.

Our current supported kernels

  • linux54 5.4.301
  • linux510 5.10.245
  • linux515 5.15.196
  • linux61 6.1.158
  • linux66 6.6.116
  • linux612 6.12.57
  • linux617 6.17.7
  • linux618 6.18.0-rc4
  • linux61-rt 6.1.156_rt56
  • linux66-rt 6.6.116_rt66
  • linux612-rt 6.12.49_rt13
  • linux616-rt 6.16.0_rt3
  • linux617-rt 6.17.5_rt7

Package Changes (11/5/25, 17:43 CET)

  • testing core x86_64: 47 new and 47 removed package(s)
  • testing extra x86_64: 3198 new and 3344 removed package(s)
  • testing multilib x86_64: 35 new and 51 removed package(s)

A list of all changes can be found here.

Click to view the poll.

Check if your mirror has already synced:

16 posts - 10 participants

Read full topic

philm

How to Fix “404 Not Found” Errors in Debian During apt-get upgrade

Techmint
2 months 3 weeks ago
The post How to Fix “404 Not Found” Errors in Debian During apt-get upgrade first appeared on Tecmint: Linux Howtos, Tutorials & Guides .

The “404 Not Found” error during upgrade occurs when your system attempts to download packages from repository sources that no

The post How to Fix “404 Not Found” Errors in Debian During apt-get upgrade first appeared on Tecmint: Linux Howtos, Tutorials & Guides.
Ravi Saive

waydroid >= 1.5.4-3 update may require manual intervention

Arch Linux
2 months 3 weeks ago

The waydroid package prior to version 1.5.4-2 (including aur/waydroid) creates Python byte-code files (.pyc) at runtime which were untracked by pacman. This issue has been fixed in 1.5.4-3, where byte-compiling these files is now done during the packaging process.

As a result, the upgrade may conflict with the unowned files created in previous versions. If you encounter errors like the following during the update:

error: failed to commit transaction (conflicting files)

waydroid: /usr/lib/waydroid/tools/__pycache__/__init__.cpython-313.pyc exists in filesystem

waydroid: /usr/lib/waydroid/tools/actions/__pycache__/__init__.cpython-313.pyc exists in filesystem

waydroid: /usr/lib/waydroid/tools/actions/__pycache__/app_manager.cpython-313.pyc exists in filesystem

You can safely overwrite these files by running the following command:

pacman -Syu --overwrite /usr/lib/waydroid/tools/\*__pycache__/\*

George Hu

How to Use dpkg, apt, aptitude, synaptic, and tasksel in Debian

Techmint
2 months 3 weeks ago
The post How to Use dpkg, apt, aptitude, synaptic, and tasksel in Debian first appeared on Tecmint: Linux Howtos, Tutorials & Guides .

Debian offers several tools for managing software packages, each serving a specific purpose in the package management ecosystem, and understanding

The post How to Use dpkg, apt, aptitude, synaptic, and tasksel in Debian first appeared on Tecmint: Linux Howtos, Tutorials & Guides.
Ravi Saive

The Most Critical Linux Kernel Breaches of 2025 So Far

Linux Journal
2 months 3 weeks ago
by George Whittaker

The Linux kernel, foundational for servers, desktops, embedded systems, and cloud infrastructure, has been under heightened scrutiny. Several vulnerabilities have been exploited in real-world attacks, targeting critical subsystems and isolation layers. In this article, we’ll walk through major examples, explain their significance, and offer actionable guidance for defenders.

CVE-2025-21756 – Use-After-Free in the vsock Subsystem

One of the most alarming flaws this year involves a use-after-free vulnerability in the Linux kernel’s vsock implementation (Virtual Socket), which enables communication between virtual machines and their hosts.

How the exploit works: A malicious actor inside a VM (or other privileged context) manipulates reference counters when a vsock transport is reassigned. The code ends up freeing a socket object while it’s still in use, enabling memory corruption and potentially root-level access.

Why it matters: Since vsock is used for VM-to-host and inter-VM communication, this flaw breaks a key isolation barrier. In multi-tenant cloud environments or container hosts that expose vsock endpoints, the impact can be severe.

Mitigation: Kernel maintainers have released patches. If your systems run hosts, hypervisors, or other environments where vsock is present, make sure the kernel is updated and virtualization subsystems are patched.

CVE-2025-38236 – Out-of-Bounds / Sandbox Escape via UNIX Domain Sockets

Another high-impact vulnerability involves the UNIX domain socket interface and the MSG_OOB flag. The bug was publicly detailed in August 2025 and is already in active discussion.

Attack scenario: A process running inside a sandbox (for example a browser renderer) can exploit MSG_OOB operations on a UNIX domain socket to trigger a use-after-free or out-of-bounds read/write. That allows leaking kernel pointers or memory and then chaining to full kernel privilege escalation.

Why it matters: This vulnerability is especially dangerous because it bridges from a low-privilege sandboxed process to kernel-level compromise. Many systems assume sandboxed code is safe; this attack undermines that assumption.

Mitigation: Distributions and vendors (like browser teams) have disabled or restricted MSG_OOB usage for sandboxed contexts. Kernel patches are available. Systems that run browser sandboxes or other sandboxed processes need to apply these updates immediately.

CVE-2025-38352 – TOCTOU Race Condition in POSIX CPU Timers

In September 2025, the U.S. Cybersecurity & Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.

Go to Full Article
George Whittaker

Open Source AI Is Powering a More Inclusive Digital Economy across APEC Economies

Linux Foundation
2 months 3 weeks ago

In August, I had the honour of attending the APEC 2025 Global Digital and AI Forum’s AI & Digital Ministerial Meeting in Incheon, South Korea. I was thrilled to have the opportunity to present findings from the first phase of our research in collaboration with Meta, and to join a group of esteemed panelists discussing the numerous pathways for open source AI to transform the region’s 21 member states in different capacities.

Hilary Carter