Skip to content

Release 2026_018 (2026-05-18)

Impact

25.05

Machines will reboot to activate a changed kernel.

25.11

Machines will reboot to activate a changed kernel.

NixOS 25.05 platform

  • linux kernel: mitigate "dirty frag" vulnerabilities (CVE-2026-43500, CVE-2026-4328)

  • Pull upstream NixOS changes, security fixes, and package updates:

    • linuxKernelStable: 6.12.85 -> 6.12.87
    • linuxKernelVerify: 6.12.85 -> 6.12.87

NixOS 25.11 platform

  • linux kernel: mitigate "dirty frag" vulnerabilities (CVE-2026-43500, CVE-2026-4328)

  • fc-collect-garbage: warn about unknown/human users with gcroots. (PL-134227)

  • router: remove various deprecated and obsolete role options. (PL-135248)

  • nix: use redundant object storage gateways as binary cache while removing superfluous old binary cache (PL-135325)

This change leads to a better performance for Nix invocations that are not in any binary cache.

  • Pull upstream NixOS changes, security fixes, and package updates:
    • apacheHttpd: 2.4.66 -> 2.4.67
    • chromedriver: 147.0.7727.137 -> 148.0.7778.96
    • chromium: 147.0.7727.137 -> 148.0.7778.96
    • firefox: 150.0.1 -> 150.0.2
    • gitaly: 18.11.1 -> 18.11.2
    • gitlab: 18.11.1 -> 18.11.2
    • gitlab-ee: 18.11.1 -> 18.11.2
    • gitlab-pages: 18.11.1 -> 18.11.2
    • gitlab-runner: 18.11.1 -> 18.11.2
    • gitlab-workhorse: 18.11.1 -> 18.11.2
    • linuxKernelStable: 6.12.85 -> 6.12.87
    • linuxKernelVerify: 6.12.85 -> 6.12.87
    • matrix-synapse: 1.152.0 -> 1.152.1
    • php82: 8.2.30 -> 8.2.31
    • php83: 8.3.30 -> 8.3.31
    • php84: 8.4.20 -> 8.4.21
    • php85: 8.5.5 -> 8.5.6
    • redis: 8.2.3 -> 8.6.3

Detailed Changes