October Community Monthly Report | deepin 25 Security Updates & Community 7.3 Kernel Early Access Release

Key points

deepin's October community report covers two urgent security updates for deepin 25, a community preview of the Linux 7.3 kernel, changes to XiaoU Assistant 3.3.0 and the month's work across the project's SIGs.

Security updates

• October 12: deepin 25 patched CVE-2026-96512 (CVSS 7.8) in sudo. A local user could set the TZ variable to an extreme offset, shift sudoers time-window rules by up to about 25 hours and gain root outside the permitted period.
• October 21: deepin 25 addressed CVE-2026-111943 (CVSS 9.1). Eight eMudhra intermediate CA certificates expose their own private keys, allowing forged TLS and code-signing certificates for any domain.
• Chrome, Edge and Firefox already block these certificates remotely, but curl, wget, git, pip and apt rely on the system trust store, so the report calls this update mandatory.

Linux 7.3 preview

• Linux 7.3 was released upstream on October 19. deepin offers it as a community technical preview in the deepin 25 community repository for AMD64, ARM64 and Loong64.
• It must be installed manually and is not pushed through system updates.
• It adds support for recent Intel and AMD processor features and updates drivers for new Realtek wired Ethernet and MediaTek Wi-Fi adapters.
• It also brings cache-aware scheduling, btrfs and ntfs improvements, and configuration changes that improve micro-benchmark results.
• Upstream is still fixing regressions, so it is not recommended for production or primary machines. Back up important data and keep a stable kernel for rollback.

XiaoU Assistant 3.3.0

• A sidebar account card allows deepin ID login, status view and logout. Free model entitlements are granted after login.
• When several solutions exist, the assistant now asks the user to choose one.
• A third-column panel previews files and resources referenced in a conversation.
• Conversations created inside a workspace inherit its context and memory and can be renamed. Hovering over a workspace row shows session count and local directory path.
• Model selection moved to the input box, which collapses during review or answer workflows.

Kernel SIG

• Kernels updated to 6.18.53–6.18.57 and 6.6.155–6.6.159, 4,515 patches in total.
• New drivers: Intel RPL integrated graphics, Realtek RTL8851BE Bluetooth, AIC8800M80X2P Wi-Fi, and ZTE Dinghai network adapters with their RDMA modules.
• Fixes: boot problems on some models after Phytium touchpad driver updates, suspend-resume on MediaTek MT7921 / 7922 / 7920 Wi-Fi, and Glenfly audio.
• Zhongguancun HAOC 4.0 security features were merged into 6.6, and support for obsolete 802.11b Wi-Fi adapters was removed.
• 6.18 gained better build compatibility for Loongson integrated-graphics drivers. Loongson performance was tuned and preparatory sched_ext commits were merged.

System packages

• 93 repositories received functional or security updates, including pulseaudio, systemd, curl, glibc, ffmpeg, bluez, pipewire, mesa, cups, qt6 base and Linyaps.
• 111 CVEs were fixed across 33 repositories: curl 21, libsoup3 13, cups 12, ffmpeg 8, with the rest in packages such as poppler, unbound, xorg-server, podman and bind9.
• systemd builds deepin81 to deepin85 backport 40 upstream patches for root-mount switching and abnormal user-service exits.
• linux-firmware gained Intel wireless firmware and SOF firmware v2026.09.2.
• wireplumber configuration directories were migrated, gvfs gained FTP file monitoring, and an fcitx5 crash on restart was fixed.
• sw64 support was added to webkit2gtk and librsvg, and loong64 support improved in kexec-tools and kdump-tools.
• Reproducible-build fixes covered binutils, python3.12, ffmpeg, qtbase, shared-mime-info and others.
• New packages: atomgit-cli, python-cvss, python-maturin, rust-asn1, rust-asn1-derive, rust-futures-timer, tig.

DDE and Treeland

• dde-shell: resizable taskbar in compositor-driven sessions, Show Desktop and Multi-Task View moved to the compositor-action protocol, and fixes for notification-centre buttons and panel flicker.
• dde-launchpad: fixes for application IDs ending in .desktop and for dark-mode text inversion; the launcher now reads autostart status.
• dde-control-center: options to hide or disable modules, new touchpad edge-tap gestures and accessibility improvements.
• dde-daemon: shell command execution removed for security, a touchpad extension toggle added, and brightness persistence and long Bluetooth filename bugs fixed.
• dde-services: redundant polkit prompts suppressed and hardware sleep hotkeys restored.
• Treeland 0.11.0 adapts to the dde-shell-unstable-v2 protocol, splits Helper into a separate service, and fixes XWayland focus, lock-screen and input-method issues.
• ddm 0.4.0 moves configuration to DConfig and adds pam_deepin_keyring support.

Ports, community and events

• deepin-ports continued RVA23 / next repository updates and is investigating boot and Ethernet instability on the Phytium Pi Pro, with 40-pin header support in progress.
• Translations were updated for Spanish, Japanese, Italian, German, Arabic, Ukrainian, French, Indonesian, Russian and other languages.
• User feedback totalled 85 entries: 65 bug reports (4 resolved, 7 in development, 22 pending) and 20 feature requests (13 added to the backlog).
• The App Store published 546 apps, 327 of them new, and opened a Community Original section for independent developers.
• At the RISC-V China Summit (October 18-20, Shenzhen), deepin 25 was shown on K3 hardware with fully offline local model inference in XiaoU Assistant.
• Linyaps was presented at MiniDebConf Beijing on October 24. It reports more than 7000 adapted applications and support on over 25 distributions.

Summary by DistroNews, based on the original post.