kernel Archives

Winsage

April 13, 2026

Microsoft tightens Windows 11 driver security rules

Microsoft will enforce a new mandate requiring all hardware drivers to comply with the Windows Hardware Compatibility Program (WHCP) standards starting April 1, 2026. This change will eliminate the "cross-signing" system that allowed older drivers with expired certificates to remain trusted. The enforcement of WHCP certification will apply to various versions of Windows 11 and Windows Server 2025. Users may face blocks when installing older drivers on new systems, but existing installations will not be immediately disrupted. Microsoft plans to introduce an "allow list" for vetted legacy drivers to ensure essential equipment remains operational during the transition. The initial rollout will occur in "evaluation mode," allowing Microsoft to monitor driver behavior without blocking software. For corporate environments, Microsoft offers "Application Control for Business" to allow specific software while maintaining security measures.

Winsage

April 13, 2026

The engineer who built Windows Task Manager in the 90s says its 80KB footprint was a feature not an accident

David Plummer, a veteran Microsoft engineer, created the original Windows Task Manager (Taskmgr.exe) in the 1990s, which had a file size of only 80KB. This small size was crucial for its functionality during system freezes. Plummer used a mutex to check if another instance of the program was running, allowing for efficient operation without complex process lists or loops. His recent reflections in early 2026 have sparked discussions about the evolution of software, particularly criticizing Windows 11 for straying from its foundational purpose and emphasizing resource efficiency. The 1990s hardware constraints forced developers to innovate, contrasting with today's environment where abundant resources allow for less efficient applications. Plummer's mutex technique is now seen as a benchmark in application design, highlighting a generational shift in development practices. The discourse around his 80KB Task Manager raises questions about the future of software procurement and the importance of memory footprint in purchasing decisions.

Winsage

April 12, 2026

Original Windows Task Manager Was Just 80 KB, Says Microsoft Engineer

The original Windows Task Manager was 80 KB in size, while its current version is 4 MB. Dave Plummer designed it to remain operational during system freezes, emphasizing that every line of code has a cost. The Task Manager could manage multiple instances by sending private messages to existing ones and launching new instances if the original was unresponsive. It utilized global strings and direct access to the kernel’s process table for speed and efficiency. Users have noted that modern systems consume more resources for similar tasks compared to older versions like Windows 7.

Winsage

April 10, 2026

Microsoft Locked Out VeraCrypt, WireGuard, and Windscribe from Pushing Windows Updates

Microsoft implemented a mandatory account verification process for all partners in the Windows Hardware Program who had not completed verification since April 2024, effective October 16, 2025. This requirement necessitated that partners verify their identities using a government-issued ID matching the name of the primary contact in the Partner Center. Failure to meet this deadline or pass verification resulted in account suspension, preventing further submissions. This affected the ability of developers to sign Windows kernel drivers, leading to suspensions for notable open source projects like VeraCrypt, WireGuard, and Windscribe. Mounir Idrassi, the developer of VeraCrypt, reported his account was terminated without notice, and Jason Donenfeld of WireGuard faced similar issues. Windscribe experienced a prolonged resolution process despite having a verified account for over eight years. Following these suspensions, Scott Hanselman from Microsoft announced that the accounts would be reinstated and corrective measures were being taken.

Winsage

April 8, 2026

Linux gamers didn’t do anything wrong, but they might pay for Windows piracy anyway

Gaming on Linux has advanced significantly due to Valve's Proton compatibility layer and the Steam Deck, allowing most single-player PC games to run on the platform. Data from ProtonDB indicates that nearly every Windows game is now playable on Linux. However, hypervisor-based DRM bypass techniques have emerged, weakening Denuvo's anti-tamper protections and reviving day-zero piracy. Hypervisors operate beneath the operating system, allowing pirates to manipulate Denuvo's validation checks, drastically reducing the time to crack games. This resurgence of piracy poses security risks, as users must disable kernel-level security features, exposing their systems to vulnerabilities. Irdeto, the company behind Denuvo, recognizes the need for updated security measures, but these could complicate the gaming experience for Linux users. Linux's open-source nature complicates enforcing kernel integrity, making effective anti-cheat and DRM systems challenging. Despite these issues, Linux gaming has seen considerable growth, but the threat of hypervisor-based piracy could jeopardize this progress and lead to tighter DRM measures that may reduce Linux compatibility.

Winsage

April 7, 2026

Windows 11 is phasing out old kernel drivers: Microsoft will permanently end cross-signing in April

On March 26, 2026, Microsoft announced that starting with the April security update, it will eliminate trust in kernel drivers from the previous Cross-Signed Program for Windows 11 versions 24H2, 25H2, 26H1, and Windows Server 2025. Only drivers that have passed the Windows Hardware Compatibility Program (WHCP) or are on Microsoft's allow list will be allowed to load by default. This change aims to enhance security by establishing a robust chain of trust and addressing vulnerabilities associated with old kernel drivers. Users of older hardware that rely on specialized drivers may face challenges, as drivers not WHCP-signed or explicitly allowed will be excluded from the trusted zone.

Tech Optimizer

April 5, 2026

Linux 7.0 Cuts PostgreSQL Performance in Half

An AWS engineer reported a significant drop in PostgreSQL throughput on Linux 7.0, with performance reduced to approximately half of its previous capability. Benchmark tests showed that the removal of the PREEMPT_NONE scheduling option was the main cause of this regression. On a 96-vCPU Graviton4 instance, throughput measured at just 0.51x compared to earlier kernel versions. Salvatore Dipietro from Amazon/AWS conducted benchmarking analysis of PostgreSQL 17, revealing that Linux 7.0 delivered only 0.51x the throughput of its predecessors. The root cause was traced to kernel commit 7dadeaa6e851, which eliminated PREEMPT_NONE as the default option, leading to increased contention due to the new PREEMPT_LAZY model. Profiling data indicated that 55% of CPU time is consumed by spinning in PostgreSQL’s spinlock, causing significant performance degradation. When a revert patch was applied, throughput rebounded to 1.94x the baseline. The decision to restrict preemption modes in Linux 7.0 aimed to address issues within the kernel's scheduling model. Dipietro proposed a patch to restore PREEMPT_NONE, but kernel developers suggested PostgreSQL adopt the rseq time slice extension instead. Database operators running PostgreSQL on Linux face potential performance reductions with the upgrade to Linux 7.0.

Tech Optimizer

April 4, 2026

AWS Engineer Reports PostgreSQL Performance Halved By Linux 7.0, But A Fix May Not Be Easy

An engineer from Amazon/AWS reported a significant performance regression in PostgreSQL when running on the nearly finalized Linux 7.0 kernel, with throughput dropping to about half of previous kernel versions. The regression, observed on a Graviton4 server, is attributed to increased time spent in a user-space spinlock due to changes in preemption modes in Linux 7.0. A patch to revert to PREEMPT_NONE as the default preemption model has been submitted but may not be adopted. Peter Zijlstra suggested that PostgreSQL should adapt to utilize the Restartable Sequences (RSEQ) time slice extension to mitigate the performance drop. If this adaptation is accepted, the responsibility for the performance decline may shift to PostgreSQL, potentially affecting users until the database is updated. The stable release of Linux 7.0 is expected in about two weeks, coinciding with the launch of Ubuntu 26.04 LTS.

Winsage

April 2, 2026

Wine has been translating Windows games to Linux since 1993, but Proton is what made it effortless

Wine is a compatibility layer, not an emulator, that translates Windows API calls into POSIX equivalents, allowing Windows applications to run on Linux. Proton, developed by Valve, builds on Wine and includes additional components like DXVK and VKD3D-Proton to enhance performance for Windows games on Linux through Steam. For Steam users, Proton is recommended for a streamlined gaming experience, while Lutris is suggested for those outside the Steam ecosystem. Wine has been in development since 1993, focusing on recreating the Windows API, but faced challenges with gaming compatibility. Cedega was an early attempt to improve gaming support over Wine but ultimately declined. Valve's development of Proton was motivated by the need for better compatibility for Windows games on Linux, especially highlighted by the launch of the Steam Deck. Wine struggled with synchronization issues and handling direct kernel access by Windows applications, which Proton addressed with seccomp-bpf filters and syscall user dispatch. Both Wine and Proton are crucial to the current state of Linux gaming.

AppWizard

April 1, 2026

‘NoVoice’ Android malware on Google Play infected 2.3 million devices

A new Android malware called NoVoice has been found in over 50 applications on Google Play, with more than 2.3 million downloads. The malware targets older Android versions, specifically those patched between 2016 and 2021, and attempts to gain root access by exploiting vulnerabilities. It conceals malicious components within the com.facebook.utils package and uses steganography to hide an encrypted payload within a PNG image file. NoVoice avoids infecting devices in certain regions and has checks to detect emulators and VPNs. Once activated, the malware contacts its command-and-control server to gather device information and polls it every 60 seconds for tailored exploits aimed at rooting the device. It can exploit 22 vulnerabilities, including kernel bugs, and establishes persistence by replacing key system libraries and installing recovery scripts. The malware injects code into applications, particularly targeting WhatsApp to extract sensitive data for session replication, which is then exfiltrated to the C2 server. The malicious apps containing NoVoice have been removed from Google Play, but users who installed them should consider their devices compromised. Upgrading to devices with later security patches is recommended to mitigate the threat.