Alibaba Cloud Linux 4 Pro image release notes

Platform support

Alibaba Cloud Linux 4.0.3 Pro supports the following CPU platform vendors:

• X86_64 architecture:

  • Intel Xeon: 3rd Gen Ice Lake and Cooper Lake; 4th Gen Sapphire Rapids (SPR); 5th Gen Emerald Rapids (EMR); 6th Gen Granite Rapids (GNR-AP, GNR-SP) and Sierra Forest (SFR)

  • AMD: Zen 3 Milan, Zen 4 Genoa, and Zen 5 Turin

  • Hygon C86: Hygon 3 (C86-3G) and Hygon 4 (C86-4G)

  • Zhaoxin: KH-40000

• AArch64 architecture:

  • Yitian: 710

  • Phytium: FT-2000+, Tengyun S2500, Tengyun S5000C, and Tengyun S5000C-E

  • Kunpeng: 920 and 920 V200

Kernel features

Alibaba Cloud Linux 4.0.3 Pro ships with the kernel-6.6.102-005.3.pro.ali6000.alnx4 kernel series (Ali6000-005.3.pro) by default. This kernel series, based on the ANCK 6.6.102-005.3 code baseline, is deeply optimized for scenarios such as AI large model training and inference, cloud native, and virtualization. It features the following optimizations:

Memory management

• Introduces the MGLRU page reclamation framework, which replaces traditional active/inactive lists with a multi-generational aging model. This change improves page reclamation accuracy and performance stability under memory pressure, enhances memory efficiency in big data scenarios, and reduces end-to-end latency.

• Introduces maple trees to manage VMAs, replacing the red-black tree implementation. It also optimizes batch copying with dup_mmap(), reducing lock contention in the fork() and mmap() paths.

• Introduces per-VMA locks, refining page fault handling by replacing the global mmap_lock with more granular, per-VMA locks. This change significantly improves concurrent page fault performance in multi-threaded applications.

• Fully adopts the folio abstraction to unify page management interfaces. The conversion to folios is complete in subsystems such as the file system, swap, and shmem.

• Introduces multi-size THP (mTHP), enabling transparent huge pages to use intermediate sizes such as 16 KB, 32 KB, and 64 KB. This change reduces memory waste and expands the use cases for THP.

• Optimizes batch unmap, reclamation, and free operations for large folios, which reduces TLB flushes and improves large-page reclamation efficiency.

• Adds the cachestat system call, which allows user-space applications to query the page cache status of a file efficiently.

• Adds support for memory tiering. Based on HMAT, the system automatically detects the distance characteristics of DRAM, CXL, and PMEM to enable cross-tier migration and tiered placement.

• Enables memcg-level accounting and limits for zswap. This change isolates zswap usage between containers and prevents interference.

• Enhances DAMON memory access monitoring with support for control via sysfs and NUMA access statistics, providing fine-grained monitoring of memory hotness.

• Disables proactive compaction by default by setting the default value of compaction_proactiveness to 0. This change reduces unnecessary overhead from proactive memory compaction and prevents system performance fluctuations.

• Optimizes build_id parsing logic by supporting memfd_secret files and relaxing constraints on the location of the Program Header Table (PHDR). This change improves system robustness when handling special memory files.

• Optimizes memory mapping and huge page alignment by honoring the THP alignment of mmap hint addresses. This change avoids performance loss from improper alignment and improves floating-point performance in the SPEC CPU2017 benchmark.

• Restricts anonymous huge page alignment to PMD alignment to prevent memory waste or performance degradation from over-alignment.

• Accelerates bad access page fault handling.

• Adds support for the Huge Vmemmap Optimization (HVO) feature for hugetlb. This optimization reduces the page struct metadata overhead for hugetlb, lowering memory costs.

• Introduces a per-memcg LRU lock mechanism, which provides an independent LRU lock for each memcg, reducing global lock contention during page reclamation and improving memory management efficiency in containerized environments.

• Adds support for the cgroup min_cache_kbytes setting. This feature allows setting a minimum cache reservation for a cgroup, which helps prevent unnecessary memory-reclamation thrashing.

• Implements a lock-free design for the slab shrinker. This design removes the global lock and uses a dynamic, RCU-based allocation mechanism, resulting in higher scalability and lower lock contention on multi-core systems.

• Adds support for page table retention. This feature allows contiguous allocation of page tables and supports pre-reservation for specific memory spaces, optimizing memory access for large-memory applications.

• Asynchronous fork support is now enabled by default (CONFIG_ASYNC_FORK). This feature copies page tables asynchronously, which significantly improves process creation efficiency in high-concurrency fork scenarios.

• Adds support for the kidled cold memory reclamation feature. This feature introduces the kidled daemon, which identifies and reclaims long-unused pages and slabs to reduce memory waste from resident cold data.

• Adds support for the tmpfs zero page filling feature. When a read page fault occurs on a file hole, the system uses the shared zero page instead of allocating a new one. A new page is allocated only after a subsequent write-protection fault, preventing unnecessary memory overhead.

Process scheduling

• Introduces the EEVDF scheduler to replace the traditional CFS, providing fairer CPU allocation and more predictable latency through a virtual deadline algorithm.

• Supports the delayed dequeue mechanism, reducing unnecessary dequeue/enqueue overhead for tasks that wake up immediately after a short sleep.

• Introduces the sched_ext extensible scheduling framework, which lets you implement custom scheduling policies through BPF programs. The framework provides flexible policies and interfaces for vertical optimization in specific use cases.

• Supports core scheduling, which coordinates task scheduling between hyper-threads on the same physical core and mitigates the risk of side-channel attacks.

• Enhances core scheduling cookies with a command to clear cookies and a universal cookie.

• Removes the CPU Burst configuration limit, allowing users to set a higher cpu.cfs_burst_us value for more flexible CPU resource allocation in container scenarios.

• Supports cluster-based load balancing to improve affinity within CPU cluster affinity domains.

• Supports asynchronous de-throttling in the scheduler's bandwidth control to reduce de-throttling latency.

• Supports thread-level HT eviction through the native core scheduling feature in the 6.6 kernel.

• Dynamic CPU isolation: Isolates CPUs at runtime to reduce interference with business workloads.

• jbd2 lock-proxy execution: Mitigates priority inversion caused by jbd2 locks.

• NUMA-aware spinlock optimization (CNA): Significantly improves lock throughput by prioritizing waiting threads on the same NUMA node as the lock holder, while preventing starvation.

• Supports sched sli and rich containers, providing a kernel resource view within containers.

• ACPU (Access CPU): Tracks HT interference duration and applies compute bandwidth limits based on it.

• Supports the group identify 2.0 proactive migration policy for suppressed offline tasks. In a mixed-deployment environment, when an online task preempts a CPU, the policy automatically migrates the suppressed offline task to another available CPU to reduce resource contention.

• Supports absolute suppression in group identify 2.0. Introduces the ID_ABSOLUTE_EXPEL mechanism to enforce absolute priority of online tasks over offline tasks, strengthening performance isolation for critical services.

• Supports the group identify 2.0 load balancing policy for online tasks. The policy uses the ID_LOAD_BALANCE, avg_sched_idle, and ID_BOOK_CPU scheduling features to optimize load balancing, improving CPU utilization and task response performance.

• Supports NUMA-affine scheduling to improve memory access locality and overall performance on multi-NUMA-node systems.

• Supports group balancer 2.0, which uses a dynamic load balancing mechanism and a group balancer scheduling domain. By optimizing CPU resource allocation for task groups and online CPU management, it improves scheduling flexibility and efficiency on multi-core systems.

• Supports cgroup concurrency optimization, which resolves tail latency caused by long lock waits during cgroup creation. This accelerates container startup and improves elasticity.

Network

• NAPI kthreading: Migrates network polling from softirq to a kernel thread. This lets the scheduler manage polling and prevents excessive preemption of running processes.

• Support for tcp_shrink_window: Allows the TCP receive window to shrink dynamically, preventing excessive memory consumption when data is not retrieved promptly.

• Support for IPv4/IPv6 BIG TCP: Enables the kernel to handle larger jumbo packets, boosting single-node throughput by approximately 50%.

• skb drop reasons mechanism: Precisely identifies the cause of packet drops at any layer of the network stack, simplifying troubleshooting.

• Support for multi-buffer XDP and AF_XDP multi-buffer: Enables XDP to handle jumbo frames and LRO scenarios.

• Per-netns ehash: Reduces bucket collisions in the global hash table for high-density container scenarios.

• pfifo_fast performance optimization: Improves performance by over 20% in high-PPS scenarios. This optimization is transparent to users.

• New eBPF networking capabilities: Adds support for BPF_MAP_TYPE_USER_RINGBUF, bpf_sk_assign for SO_REUSEPORT, and BPF-tunable SYN-ACK RTO.

• libxudp library: Provides high-performance UDP communication based on XDP sockets.

• SMC loopback feature: Accelerates intra-OS communication on the SMC protocol stack by using a loopback-ism device.

• SMC memory resource limits: Provides a sysctl interface that limits the system memory used by the SMC protocol stack.

• SMC dump feature: Adds packet capture for the SMC protocol stack, enhancing its diagnostic capabilities.

• Fine-grained transparent SMC replacement: Enables flexible control and extension of the SMC handshake process through generic BPF hooks and symbol export fixes.

• In-house EEA driver support: Integrates the in-house EEA Ethernet driver, providing an NIC solution that is more hardware-friendly, more extensible, and faster to iterate on.

• XDP zero-copy for virtio-net: Improves network transmit and receive performance.

• eBPF-based tcprt and vtoa (ANSE): Reimplements in-house networking features such as tcprt and vtoa in eBPF, improving programmability and flexibility.

• PTP driver support: Adds the Alibaba CIPU PTP clock driver for time synchronization within 100 microseconds.

Storage and I/O

• Enhanced io_uring with new features such as asynchronous hybrid polling, multishot (accept/recvmsg/timeout), network zero-copy sending, and large page mapping for submission queues (SQ) and completion queues (CQ). These updates expand its use cases and improve asynchronous I/O performance.

• Added support for io_uring passthrough (uring_cmd), enabling direct NVMe I/O that bypasses the kernel block layer to reduce latency.

• Added support for userspace block device (ublk), enabling high-performance userspace block drivers based on io_uring passthrough.

• Optimized fundamental io_uring mechanisms. These changes include using a lockless list for task work, which improves multi-threaded performance by approximately 20%, and batching multishot completion events, which increases RPS by 2.3 times.

• Added support for per-CPU sqthread in io_uring. This feature binds sqthreads to CPUs instead of io_uring instances, allowing different io_uring instances to share the same sqthread.

• Added support for the CXL 1.1 protocol, leveraging the Linux 6.6 kernel's native implementation to provide more efficient memory access for Tair databases.

• Added support for large folios in XFS, which significantly improve buffered I/O performance by enhancing LRU management efficiency, reducing page faults, and lowering TLB miss overhead. XFS now supports this feature by default in the 6.6 kernel via the iomap framework.

• Added support for large folios in Ext4. This feature, which builds on iomap support for Ext4 buffered I/O, is currently marked as EXPERIMENTAL and can be enabled for trial use with the -o buffered_iomap option.

• Strengthened support for a 64 KB block size in Ext4, which allows rund to boot a rootfs by using virtio-pmem in a kernel environment with a 64 KB page size.

• Ported and optimized the XFS DAX reflink feature from the 5.10 kernel to support Tair database instances that use persistent memory.

• Added support for virtio-blk device passthrough. This feature provides a virtio-blk character device that applications can access directly via uring_cmd, optimizing access to virtio-blk devices.

• Optimized FUSE writeback performance, increasing it from 3.5 GB/s to 10 GB/s by refining mechanisms such as temppage.

• Optimized single-client IOPS in FUSE io_uring mode to exceed 1.1 million by separating read and write paths, improving writeback fairness, and introducing a per-queue max_background mechanism.

• Optimized QPS for small file open/read and create/write operations in FUSE, improving the FUSE kernel module's efficiency with small file I/O to meet the high-concurrency demands of AI workloads.

• Optimized single-client throughput for both buffered and direct I/O in FUSE, enhancing storage performance in high-load scenarios.

• Reduced latency for small file read and write operations in FUSE by eliminating redundant getattr/setattr requests during open, direct write, close, and unlink operations, and by improving the default readdirplus policy.

• Added support for RWF_DONTCACHE, which immediately releases the page cache after I/O completion. This approach avoids memory reclamation latency caused by a high memory watermark and significantly improves performance in scenarios involving cached reads and writes on high-speed devices.

• Enabled writeback I/O throttling in cgroup v1 by building a radix tree to link memcg and blkcg.

• Enabled the iocost feature in cgroup v1 and added a cost.stat interface to observe the iocost scheduling process.

• Added support for I/O hang detection. By extending core data structures, this feature can quickly locate and detect I/O hangs with minimal system overhead.

• Enhanced block throttle statistics. cgroup now provides additional statistics, such as io_service_time, io_wait_time, io_completed, total_io_queued, and total_bytes_queued, to help analyze and troubleshoot issues in I/O throttling scenarios.

• Enhanced jbd2 features. A new force_copy kernel interface avoids waiting on shadow status pages by forcibly copying them. Additionally, new stats and stall_thresh interfaces are now available to track slow transactions.

• Added d2c latency tracking by extending /proc/diskstats data and providing a corresponding bcc tool, allowing system administrators to quickly analyze I/O latency.

• Optimized TCMU copy operations, achieving a 100% I/O performance improvement. These optimizations include bypassing the data area, using zero-copy techniques, and reducing lock granularity.

• Added compression support for erofs. This feature reduces I/O on the link, lowers end-to-end I/O latency, decreases the size of container and system images, and reduces cloud storage costs.

• Added support for subpage blocks in erofs. This allows images with a 4 KB block size to be mounted in a kernel environment with a 64 KB page size.

• Added support for the libublk library, a lightweight userspace library that simplifies the development and integration of ublk block devices.

Cgroup and resource isolation

• Enhanced cgroup v2 provides unified management of resource controllers for CPU, memory, I/O, and PIDs.

• PSI pressure metrics quantify resource pressure for CPU, memory, and I/O, enabling overload protection and fine-grained scheduling.

• The memory cgroup supports active memory reclaim via the memory.reclaim interface and enables precise per-cgroup accounting for zswap.

BPF, eBPF, and perf

• struct_ops can now be registered from a kernel module, extending their scope within BPF.

• Adds an open-code iterator with implementations for task, task_vma, task_css, css, and bits.

• Adds the BPF_F_TIMER_CPU_PIN flag to pin a bpf timer to a specific CPU.

• Adds support for the __nullable configuration for struct_ops input parameters to enhance their flexibility.

• Enables a bpf skel to directly access members of struct_ops maps, simplifying their use in BPF programs.

• Allows calling a subprogram while holding a spinlock or rculock.

• The perf tool now parses JSON metrics for Arm CMN PMU and supports the event alias mechanism, enhancing performance analysis.

Bug and CVE fixes

• CVE-2026-31431: A local privilege escalation vulnerability in the kernel algif_aead module.

• CVE-2026-43284: An ESP in-place decryption vulnerability, part of the "Dirty Frag" local privilege escalation exploit chain.

• CVE-2025-38248: A use-after-free issue in the bridge multicast router port configuration.

• CVE-2025-38502: Fixes an out-of-bounds access issue in BPF cgroup local storage.

• CVE-2025-38616: Addresses a use-after-free vulnerability in TLS ULP caused by the unexpected consumption of underlying data.

• CVE-2025-38678: Fixes a bug where nf_tables failed to reject duplicate devices during updates, leading to incomplete hook unregistration.

• CVE-2025-39682: Addresses improper handling of zero-length records on the TLS rx_list, which could lead to data corruption.

• CVE-2025-39946: Fixes a bug where a TLS stream was not aborted upon receiving a malformed header, preventing a potential skb buffer overflow.

• CVE-2025-39964: Prevents concurrent writes to an af_alg socket, which could cause data interleaving and an inconsistent internal state.

• CVE-2025-40018: Fixes a use-after-free vulnerability caused by the premature unregistration of ip_vs_ftp during ipvs netns cleanup.

• CVE-2025-40019: Adds a missing ssize check in the decryption and in-place encryption paths of the crypto essiv module.

• CVE-2025-40214: Fixes an issue in AF_UNIX garbage collection (GC) where an uninitialized scc_index could cause the receive queue of a live socket to be incorrectly reclaimed.

• CVE-2025-40215: Fixes an issue where deleting an xfrm SA did not synchronously delete the associated fallback tunnel, which could lead to lingering references and trigger warnings.

• CVE-2025-40297: Fixes a use-after-free vulnerability during port deletion caused by a bypass of the bridge MST port state.

• Fixes an index alignment error in the shared memory huge page allocation fallback loop to prevent returning an incorrect folio, which could lead to user space data corruption.

• Fixes a race condition involving multiple mTHP swap-in operations in the shared memory and swap paths, which could cause a soft lockup or system hang.

• Fixes a soft lockup triggered by running mprotect on a large hugetlb memory region.

• Fixes a "schedule-while-atomic" bug and associated RCU warnings related to the scheduler's dynamic CPU isolation feature.

• Fixes issues related to IDPUSHEXPELLEE and ID_ABSOLUTE_EXPEL, including task_struct leaks, ineffective eviction, and hard lockups caused by conflicts with DELAY_DEQUEUE.

• Fixes a kernel panic caused by a BPF LSM program returning an illegal value.

• Fixes ineffective slab reclamation during shrink_slab.

• Fixes an xarray update issue during shared memory migration to ensure the index structure for a shmem large folio is correctly updated.

• Fixes a performance regression in page fault handling by improving the counting mechanisms in filemap_map_pages() and set_pte_range().

• Fixes a context switch regression that caused a 13% to 50% performance drop in the lmbench benchmark.

• Fixes a null pointer access issue in the task_is_idle function to prevent a crash when writing to disk under low-priority scheduling and small CPU quotas.

• Fixes a null pointer access caused by an unregistered pstore backend, preventing a potential system crash during stress testing.

• Fixes unnecessary TLB flushes during fork() in the memory management (mm) module to improve process creation performance.

• Fixes a compatibility issue with crash vmcore parsing by correcting the vmcore tool's logic for parsing dump files, which improves debugging and analysis efficiency.

• Fixes a task starvation issue for SCHED_IDLE tasks caused by ID_LOAD_BALANCE, which prevented low-priority tasks from being scheduled.

• Fixes a kernel panic triggered by stress-ng vm, which involved an abnormal scheduling interaction with systemd and a SIGSEGV.

• Fixes a crash caused by a null pointer access in ID_LOAD_BALANCE where the function did not return early when 'rf' was null.

Image-level notes

• Enables auditd to start automatically at boot. The alinux-base-setup package is updated from alinux-base-setup-4.1-6.alnx4 to alinux-base-setup-4.1-7.alnx4, adding auto-start configuration for the auditd service. This provides continuous security monitoring and reliable data for troubleshooting, compliance audits, and security protection. The configuration uses -a task,never to skip audit events for process creation and execution, conserving system resources and preventing overload — keeping the impact controllable.

• The default root file system remains ext4. After comprehensive evaluation, Alibaba Cloud Linux 4 Pro continues to use ext4 as the default root file system, consistent with Alibaba Cloud Linux 3. Key considerations: ext4 has proven higher stability in long-term production environments and the community stable branch; it delivers better performance in several key scenarios; and it provides a smoother migration path for users of Alibaba Cloud Linux 3 and earlier versions.

User-space component updates

Core OS enhancements

• Base image: The first version of alinux-release is alinux-release-4p-13.2.alnx4, marking the initial release of Alinux 4 Pro.

• Toolchain and compilers: GCC 12.3.0, glibc 2.38, annobin 12.33, binutils 2.41, LLVM 17.0.6, Rust 1.84.1, and Go 1.24.0.

• Dynamic programming languages: Python 3.11, Ruby 3.3, Node.js 18, Perl 5.36, and PHP 8.3. Dragonwell supports five major version series: java-1.8.0-alibaba-dragonwell, java-11-alibaba-dragonwell, java-17-alibaba-dragonwell, java-21-alibaba-dragonwell, and java-25-alibaba-dragonwell.

• Cloud native support: This release enhances the performance of core cloud native components, provides Docker capabilities with Moby 28.3.3, and includes upgrades to Kubernetes 1.27.8, containerd 1.6.20, and runc to 1.1.12.

• Virtualization support: This release enhances virtual machine stability and performance with upgrades to QEMU 8.2.0 and libvirt 9.10.0.

• Other user-space components include:

  • ossfs-1.91.9: A command-line tool for Alibaba Cloud OSS that simplifies managing objects and sharing data through a local file system interface.

  • ossfs2-2.0.6: An alternative command-line tool for Alibaba Cloud OSS. This version contains breaking changes from the 1.91.x series and cannot be used concurrently.

  • vtoa-2.2.0: A tool that enables the server side to retrieve the true client address in FullNAT scenarios.

  • idlemd-2.5.2: A tool for monitoring and scheduling memory resources to manage idle resources.

  • fuse317-3.17: A component that provides the latest community-contributed FUSE over io_uring capability, introduces the usrbio engine, and supports interfaces similar to deepseek 3fs.

  • tongsuo3-8.5.0: A component that provides support for quantum-resistant cryptography and the SM series cryptographic algorithms.

Key proprietary features

The self-developed modules in Alibaba Cloud Linux 4.0.3 Pro edition have been updated with enhanced features. The updated modules are as follows:

• Intelligent computing module (Longqi): This module integrates proprietary optimizations for the kernel, drivers, SDKs, toolchains, base container components, and tuning tools. It delivers four key features: hardware-software co-optimization for AI compute, an optimized data engine for large AI models, co-optimization for AI models and frameworks, and enhanced O&M capabilities for AI workloads. The integrated components include:

  • Version 1.0.5 of the kmod-fuse out-of-tree (OOT) kernel module, which improves the performance, quality of service (QoS), and stability of CPFS.

  • Version 1.0.7-2.12 of the cachefs high-speed caching file system component, which adds support for the Kangaroo kernel.

  • Version 0.5.2 of gx, a GPU diagnostics and fault isolation tool that improves fault analysis for GPU, CPU, and Remote Direct Memory Access (RDMA) tasks.

  • The new gocryptfs-2.4.0 file system encryption component, which works with cachefs to provide data encryption.

  • The new ecos-ctl-1.2.2.3060925 GPU profiling tool, which provides operating system performance analysis for AI workloads.

  • The new pas-modelsight-0.0.1 performance analysis tool for Large Language Model (LLM) training and inference workloads.

  • The new memboost-1.1.0 all-in-one memory solution component, which provides enhanced memory management.

  • The rasdaemon RAS event logging tool is updated to version 0.8.3 to support GPU RAS error collection.

  • The criu process checkpoint and restore component is updated to version 4.1 to support task migration and fast startup for AI workloads.

• Security suite (Longdun): This release integrates the new Security Suite (Longdun) by default. It provides three tiers of features: foundational security capabilities such as identity authentication and access control; enhanced security features such as dynamic privilege management and support for SM algorithms; and advanced data protection capabilities, including runtime security, security for large models, and AI confidential computing. The integrated components include:

  • The new loongshield 1.0 component, which provides foundational security, enhanced protection, and data protection capabilities.

  • This release includes modified open source components for AI confidential computing that deliver stronger encryption algorithms. These components include trustiflux 1.5.0, trusted-network-gateway 2.5.0, tee-primitives 1.0, and trustee 1.8.3.

• System O&M module (SysAK): The new version of SysAK updates the toolset for single-machine operations, offering dozens of tools for system administration, monitoring, and diagnostics. This release provides the source-compiled version sysak-3.5.0.

• System tuning module (Keentuned): The System Tuning Module is updated with enhanced algorithms and parameter tuning capabilities. It introduces a one-click tuning feature for key "Cloud + AI" scenarios, including AI, Apache Spark, and video transcoding. This release provides keentuned 3.4.0, which adds command-line support for domain-specific lifecycles, particularly the aiextctl command series. This version deprecates the separate packages for keentuned, keenopt, keentune-bench, keentune-brain, keentune-target, and keentune-ui, and consolidates their source code into the main keentuned package.

• Compiler and language enhancements: This release includes components such as AJDK, ACC, yalantinglibs, and the ACC plug-in CoreBolt which boost the performance of Java runtimes and C++ applications through foundational libraries and compile-time optimizations. The enhancements include:

  • The AJDK Java runtime is upgraded to java-11-alibaba-jdk-11.0.25.25.1.

  • The ACC C++ compiler suite is upgraded to alibaba-cloud-compiler-13.0.1.4 to improve developer productivity and speed up project builds.

  • The new ACC plug-in, corebolt-17.0.6.1, improves code layout and enhances runtime performance.

  • The yalantinglibs C++ foundational library is upgraded to yalantinglibs-0.4.0 for faster application builds.

• Intelligent agent module (Longwu): This module introduces OS Copilot, an intelligent assistant available within the system. It uses intelligent agents and smart access methods to enhance OS capabilities throughout the lifecycle—from development and use to maintenance and operations—simplifying OS development and usage. This release includes the os-copilot 1.0.0 module to provide the operating system with intelligent assistance capabilities.

Security fixes

This update resolves 288 CVEs across 87 components, including in key components such as openssl, python3, and util-linux:

Component	4.0.3 Pro version	CVE
busybox	busybox-1.36.0-6.alnx4	CVE-2026-26157, CVE-2026-26158
util-linux	util-linux-2.39.1-8.1.alnx4	CVE-2026-3184
nfs-utils	nfs-utils-2.6.3-3.alnx4	CVE-2025-12801
openssl	openssl-3.0.12-21.alnx4	CVE-2026-28389, CVE-2026-28390, CVE-2026-31790
Python 3.11	python3-3.11.6-21.alnx4	CVE-2026-6100, CVE-2025-11468, CVE-2026-4519, CVE-2026-3644, CVE-2025-12781
python-pip	python-pip-23.3.1-6.alnx4	CVE-2025-66418, CVE-2025-66471
python-requests	python-requests-2.32.3-3.alnx4	CVE-2026-25645
sudo	sudo-1.9.15p5-4.alnx4.x86_64	CVE-2026-35535
vim	vim-9.0.2092-13.alnx4	CVE-2026-34982, CVE-2026-33412, CVE-2026-39881, CVE-2026-28417
ImageMagick	ImageMagick-7.1.2.15-1.alnx4	CVE-2025-68618, CVE-2026-22770, CVE-2026-23876, CVE-2026-23952, CVE-2026-30935, CVE-2026-30937, CVE-2026-28494, CVE-2026-30883, CVE-2026-28692, CVE-2026-28687, CVE-2026-28693, CVE-2026-28493, CVE-2026-28690, CVE-2026-31853, CVE-2026-27799, CVE-2026-25986, CVE-2026-25983, CVE-2026-25971, CVE-2026-25797, CVE-2026-25967, CVE-2026-25970, CVE-2026-25969, CVE-2026-25988, CVE-2026-24485, CVE-2026-26284, CVE-2026-25799, CVE-2026-26066, CVE-2026-25966, CVE-2026-24484, CVE-2026-24481, CVE-2026-25796, CVE-2026-25794, CVE-2026-25798, CVE-2026-25637, CVE-2026-25576
NetworkManager	NetworkManager-1.44.2-5.alnx4	CVE-2025-9615
OpenEXR	OpenEXR-3.4.4-2.alnx4	CVE-2025-12840
alsa-lib	alsa-lib-1.2.9-2.alnx4	CVE-2026-25068
arm-trusted-firmware	arm-trusted-firmware-2.12.1-2.alnx4	CVE-2024-7881
avahi	avahi-0.8-10.alnx4	CVE-2025-68471, CVE-2025-68468, CVE-2025-68276, CVE-2026-24401
binutils	binutils-2.41-14.alnx4	CVE-2025-11083
capstone	capstone-4.0.2-6.alnx4	CVE-2025-67873, CVE-2025-68114
composer	composer-2.7.1-5.alnx4	CVE-2025-67746
curl	curl-8.4.0-13.alnx4	CVE-2025-14524, CVE-2025-15224, CVE-2025-14819, CVE-2025-14017, CVE-2025-15079, CVE-2025-10966
edk2	edk2-202402-24.alnx4	CVE-2025-3770, CVE-2024-38798
expat	expat-2.5.0-11.alnx4	CVE-2026-24515, CVE-2026-25210, CVE-2026-32776, CVE-2026-32777
Firefox	firefox-140.8.0-1.alnx4	CVE-2025-14321, CVE-2025-14322, CVE-2025-14323, CVE-2025-14324, CVE-2025-14325, CVE-2025-14328, CVE-2025-14329, CVE-2025-14330, CVE-2025-14331, CVE-2025-14333, CVE-2026-0887, CVE-2026-0886, CVE-2026-0890, CVE-2026-0880, CVE-2026-0885, CVE-2026-0878, CVE-2025-14327, CVE-2026-0882, CVE-2026-0879, CVE-2026-0877, CVE-2026-0884, CVE-2026-0883, CVE-2026-0891, CVE-2026-0892, CVE-2025-6965, CVE-2026-2766, CVE-2026-2783, CVE-2026-2779, CVE-2026-2773, CVE-2026-2776, CVE-2026-2782, CVE-2026-2807, CVE-2026-2804, CVE-2026-2763, CVE-2026-2805, CVE-2026-2803
fonttools	fonttools-4.61.0-1.alnx4	CVE-2025-66034
ghostscript	ghostscript-10.06.0-1.alnx4	CVE-2025-59801
gi-docgen	gi-docgen-2023.1-4.alnx4	CVE-2025-11687
giflib	giflib-5.2.2-3.alnx4	CVE-2026-23868
glib2	glib2-2.78.3-11.alnx4	CVE-2025-14087, CVE-2025-14512, CVE-2026-0988, CVE-2026-1489, CVE-2026-1485, CVE-2026-1484
glibc	glibc-2.38-17.2.alnx4	CVE-2026-0915, CVE-2025-15281, CVE-2024-33599, CVE-2026-0861, CVE-2024-33600
gnupg2	gnupg2-2.4.3-5.alnx4	CVE-2025-68973, CVE-2026-24882
go-rpm-macros	go-rpm-macros-3.6.0-4.alnx4	CVE-2025-61726
Go	golang-1.24.13-1.alnx4	CVE-2025-68121, CVE-2025-61728, CVE-2025-61731
gvfs	gvfs-1.54.4-3.alnx4	CVE-2026-28295
haproxy	haproxy-3.2.0-1.alnx4	CVE-2025-59303
harfbuzz	harfbuzz-8.4.0-2.alnx4	CVE-2026-22693
JupyterLab	jupyterlab-4.4.8-1.alnx4	CVE-2024-43805, CVE-2025-59842
libarchive	libarchive-3.7.1-10.alnx4	CVE-2026-4111
libnbd	libnbd-1.22.5-1.alnx4	CVE-2025-14946
libpcap	libpcap-1.10.4-4.alnx4	CVE-2025-11961
libpng	libpng-1.6.40-5.alnx4	CVE-2026-22801, CVE-2026-25646
librsvg2	librsvg2-2.57.4-2.alnx4	CVE-2024-12224
libsndfile	libsndfile-1.2.2-2.alnx4	CVE-2025-56226
libsodium	libsodium-1.0.18-4.alnx4	CVE-2025-69277, CVE-2025-15444
libsoup	libsoup-2.74.3-23.alnx4	CVE-2026-1539, CVE-2025-14523, CVE-2026-1801, CVE-2026-1760, CVE-2026-2369, CVE-2026-1761
libsoup3	libsoup3-3.6.5-6.alnx4	CVE-2025-12105
libssh	libssh-0.10.5-13.alnx4	CVE-2026-0967, CVE-2026-0968, CVE-2026-0966, CVE-2026-0964
libtasn1	libtasn1-4.19.0-5.alnx4	CVE-2025-13151
libvpx	libvpx-1.14.1-3.alnx4	CVE-2025-5283, CVE-2026-2447
libxml2	libxml2-2.11.5-17.alnx4	CVE-2026-1757, CVE-2026-0992, CVE-2026-0990
libxslt	libxslt-1.1.43-4.alnx4	CVE-2025-7424
linux-firmware	linux-firmware-20260110-1.alnx4	CVE-2024-36357
munge	munge-0.5.15-2.alnx4	CVE-2026-25506
mupdf	mupdf-1.25.0-5.alnx4	CVE-2026-25556
MySQL	mysql-8.0.45-1.alnx4	CVE-2026-21964, CVE-2026-21937, CVE-2026-21948, CVE-2026-21941, CVE-2026-21968, CVE-2026-21936
net-snmp	net-snmp-5.9.4-2.alnx4	CVE-2025-68615
nss	nss-3.112-2.alnx4	CVE-2026-2781
OCaml	ocaml-4.14.0-4.alnx4	CVE-2026-28364, CVE-2025-69194
OpenLDAP	openldap-2.6.5-2.alnx4	CVE-2026-22185
openssl	openssl-3.0.12-21.alnx4	CVE-2025-69420, CVE-2025-69419, CVE-2026-22795, CVE-2026-22796, CVE-2025-68160, CVE-2025-69418, CVE-2025-69421, CVE-2025-15467
openssl1.1	openssl1.1-1.1.1q-11.alnx4	CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2024-5535
PHP	php-8.3.29-1.alnx4	CVE-2025-14178, CVE-2025-14180, CVE-2025-14177
PostgreSQL	postgresql-15.16-1.alnx4	CVE-2026-2004, CVE-2026-2006, CVE-2026-2003, CVE-2026-2005
python-aiohttp	python-aiohttp-3.9.5-4.alnx4	CVE-2025-69228, CVE-2025-69227, CVE-2025-69225, CVE-2025-69229
python-cryptography	python-cryptography-42.0.5-3.alnx4	CVE-2026-26007
python-filelock	python-filelock-3.13.0-2.alnx4	CVE-2026-22701, CVE-2025-68146
python-multipart	python-multipart-0.0.22-1.alnx4	CVE-2026-24486
python-pillow	python-pillow-10.3.0-2.alnx4	CVE-2026-25990
python-pip	python-pip-23.3.1-6.alnx4	CVE-2026-1703
python-ply	python-ply-3.11-7.alnx4	CVE-2025-56005
python-pyasn1	python-pyasn1-0.6.2-2.alnx4	CVE-2026-23490
python-starlette	python-starlette-0.49.1-1.alnx4	CVE-2025-62727
python-tornado	python-tornado-6.5.2-1.alnx4	CVE-2025-67724
python-unicodedata2	python-unicodedata2-17.0.0-2.alnx4	CVE-2025-66034
python-urllib3	python-urllib3-1.26.19-5.alnx4	CVE-2026-21441, CVE-2025-66471
python-virtualenv	python-virtualenv-20.28.0-2.alnx4	CVE-2026-22702
Python 3.11	python3-3.11.6-21.alnx4	CVE-2025-13836, CVE-2025-13837, CVE-2025-15367, CVE-2025-15366, CVE-2026-0672, CVE-2026-1299, CVE-2026-0865, CVE-2025-15282
PyTorch	pytorch-2.8.0-3.alnx4	CVE-2025-55557, CVE-2025-55553, CVE-2025-55560, CVE-2025-2999, CVE-2025-46148, CVE-2025-55558, CVE-2025-63396, CVE-2025-32434, CVE-2026-24747
Ruby	ruby-3.3.9-6.alnx4	CVE-2025-58767
skopeo	skopeo-1.17.0-3.alnx4	CVE-2025-58183
tar	tar-1.35-2.alnx4	CVE-2025-45582
tracker-miners	tracker-miners-3.5.4-2.alnx4	CVE-2026-1767, CVE-2026-1765
vim	vim-9.0.2092-13.alnx4	CVE-2026-28420, CVE-2026-25749, CVE-2026-26269, CVE-2026-28418, CVE-2026-28422, CVE-2026-28421, CVE-2026-28419
WebKitGTK	webkitgtk-2.50.4-1.alnx4	CVE-2025-43434, CVE-2025-43419, CVE-2025-43440, CVE-2025-43392, CVE-2025-43427, CVE-2025-43431, CVE-2025-43443, CVE-2025-13502, CVE-2025-43425, CVE-2025-13947, CVE-2025-66287, CVE-2025-43430, CVE-2025-43429, CVE-2025-43541, CVE-2025-43529, CVE-2025-14174, CVE-2025-43535, CVE-2025-43536, CVE-2025-43531, CVE-2025-43501
Wireshark	wireshark-4.4.9-6.alnx4	CVE-2026-0959, CVE-2026-3201, CVE-2026-3203, CVE-2026-0961, CVE-2026-0962
xorg-x11-server	xorg-x11-server-1.20.14-17.alnx4	CVE-2023-6816
xpdf	xpdf-4.06-1.alnx4	CVE-2024-2971, CVE-2024-3900, CVE-2025-3154, CVE-2024-7868, CVE-2024-4141, CVE-2025-2574, CVE-2024-3248, CVE-2025-11896, CVE-2024-4568, CVE-2024-4976, CVE-2024-7866, CVE-2024-7867, CVE-2024-3247
xrdp	xrdp-0.9.23.1-3.alnx4	CVE-2025-68670
zlib	zlib-1.2.13-5.alnx4	CVE-2026-27171