Linux and open source 2025–2026: what happened and why it matters

Early in 2026 the debate was almost anecdotal: Linus Torvalds admitted using an AI tool for an audio visualizer in a personal project. In March, Greg Kroah-Hartman described a sharp shift: review tools went within weeks from unreliable novelty to a source of good reports, and security teams across several projects saw the same wave at once.

May brought the side effect. Torvalds said the kernel security list had become almost unmanageable because of duplicate reports, and kernel 7.1 documented what deserves treatment as a security bug and that AI-assisted reports are public by default. Around then Torvalds also described a love-hate relationship with AI and commit rates running roughly 20% higher.

Distributions reacted unevenly. GNOME banned AI-generated extensions, Fedora paused its AI developer desktop after community pushback, and Ubuntu users asked for a kill switch for its AI features. In July Torvalds told critics that Linux will not join anti-AI projects and that anyone who disagrees can fork the code.

A run of local privilege escalations followed in May and June. CopyFail affected practically every version; Dirty Frag, found by Hyunwoo Kim, chains two page-cache write bugs and reached the major distributions; another bug came down to a single misplaced exclamation mark, and an exploit called pedit poisoned the cache of binaries. US agency CISA also added a root-granting Linux flaw to its exploited-vulnerabilities catalog.

Community repositories were the other front. Arch AUR packages delivered an infostealer and an eBPF-based rootkit: first more than 400 packages were reported and later at least 1,579, with Arch conceding its list was incomplete. Reports also covered a hijacked Red Hat namespace on npm, a Quasar trojan aimed at developer credentials, and China-linked intruders said to have tampered with login software for almost a decade.

Infrastructure suffered too: Ubuntu and Canonical were offline for more than 24 hours after a DDoS attack in the middle of a security incident. In August, Debian 13 received a kernel update with 68 fixes, when the previous one had resolved only a dozen.

Industry answered with big numbers. Anthropic said its Mythos model flagged 23,000 potential vulnerabilities across more than 1,000 open source projects; IBM and Red Hat announced Project Lightwell, worth $5 billion and backed by more than 20,000 engineers; and the Linux Foundation unveiled Akrites, with a shared response team and a maintainer of last resort for abandoned packages.

Rust is the other lever. Kroah-Hartman argues the language prevents the typical C mistakes, which account for around 60% of kernel vulnerabilities. Linux 7.0 dropped Rust's experimental label, and Debian had already announced that APT will depend on Rust from May 2026 to parse archives and verify signatures.

There is also a sustainability problem: a Linux Foundation working group is studying how to fund and govern package registries swamped by automated traffic, and Sonatype's Brian Fox estimates 10 trillion downloads in 2025.

Linux advanced where usage is measured. Lansweeper put its desktop share above 6% using data from more than 15 million machines, and Phoronix data on Steam showed 5.33% one month and 4.52% the next, against 2.27% a year earlier: more than double. Wine 11 and its NTSYNC support rewrite how Windows games run, with notable performance gains.

The application ecosystem is reshuffling too. Mozilla will drop Firefox for 32-bit Linux in 2026, with version 144 as the last and ESR 140 as the fallback; GIMP now ships its own Snap package, built from its CI pipeline instead of relying on Snapcrafters; and T2 SDE launches a desktop ready for daily use after a decade focused on embedded systems and servers.

In June the European Union put open source at the centre of its tech sovereignty package: more than a third of the 29 pages deals with it, with procurement reform, the principle of public money, public code, and the aim of relying less on non-EU providers.

Age-verification laws opened another front: distributions such as Ubuntu, Fedora and Mint, together with System76 and the EFF, debated how to respond, and Colorado amended its bill to exempt open source software.

AI also presses on licensing. Cal[.]com moved from AGPL to a proprietary licence, arguing that AI-equipped attackers exploit public code more effectively, and two researchers showed, partly as satire, how to reproduce open projects in minutes as seemingly distinct versions, which strains clean-room reverse engineering.