Matías Gutiérrez Reto

A 42-year-old bug just got patched. C-Kermit is the serial and network communications suite that started at Columbia University in the 1980s, and people still use it to talk to embedded, legacy and vintage machines. It just got three security advisories, one of them for remote code execution. John Goerzen restarted the project as Open Kermit after longtime maintainer Frank da Cruz retired in 2025. A code-quality sweep turned up buffer overflows in the telnet and FTP clients, shell injection in the Kermit server's REMOTE WHO and REMOTE SPACE commands, a login bypass in the IKSD server, and arbitrary file writes during transfers. The oldest flaw dates to C-Kermit 4.0 in 1985 and appears in 1984's Unix Kermit too. Goerzen's own summary: "There is no safe version of C-Kermit." Back when he first found the old bug, he joked on Mastodon: "Take that, PHP. Bugs since 2012? Pfff. Modern." He also says the real-world risk is low, since most people run Kermit over serial lines and the only known public Kermit server is already patched. Every release up to 11.0.514 is affected. The fix is C-Kermit 11.1.515, and CVE IDs are still being assigned.

FAT32, the file system your USB sticks and SD cards have been quietly putting up with since the 90s, is getting up to a 265x speedup in Linux 7.4. And the fix is basically "stop doing it one at a time." Matheus Alves de Almeida from UFRGS in Brazil noticed that when you preallocate space on FAT (fallocate with FALLOC_FL_KEEP_SIZE), the kernel grabbed clusters one by one in a while loop. On a sync mount, that means writing the FAT table back to disk for every single cluster. Tens of thousands of tiny trips to the disk just to reserve a few megabytes. His patch swaps the loop for a single fat_add_clusters() call. Net change in fs/fat/file.c: +4 lines, -6 lines. The numbers: sixteen 16 MiB files with 4 KiB clusters on a sync mount went from 92.489 seconds to 0.348 seconds. Even without sync, it's 5x to 19x faster. In his words: "The improvement is especially large on synchronous mounts, where the new code can batch FAT updates instead of synchronously handling each cluster allocation separately." It won't make ordinary file copies faster. It's preallocation only, so think embedded devices, cameras and anything that reserves space up front. Andrew Morton sent it to Linus in his non-MM pull, and it's now in Linux 7.4.