This page covers advisories, notably in relation with security and changes that may have broken earlier versions of the book.
Sometimes, not every security vulnerability for an advisory will be available. Sometimes, upstream does not issue an ID with security authority, like a CVE. Sometimes, they don't wish to talk about the vulnerability in detail. What's listed is all that can be gathered from upstream and GitHub/Mitre/NVD.
For security, most of the packages in GLFS are in BLFS, and GLFS for the most part gets the same updates as BLFS gets. Thus, you should check the BLFS Advisories. This page covers GLFS-specific issues, or when the BLFS issues hit GLFS the hardest.
This page was generated from an XML file with XSLT processing. You can easily track updates and view the XML by viewing the advisories GitHub repository.
This page is ordered like the Changelog of the book, with newest items first.
Previously, the book installed OCL-ICD from OCL-Dev for the OpenCL ICD loader. Ruby was required as a result. KhronosGroup has a compatible loader called OpenCL-ICD-Loader. Its only dependencies are CMake and the OpenCL headers. The book has since switched to it and that plus the headers have been moved into a package collection page, like Vulkan-SDK, called OpenCL-SDK.
As a consequence, OCL-ICD has been removed and Ruby, having no use in the book, has also been removed. Ruby often sees security releases, so read BLFS for Ruby updates.
Two security vulnerabilities were fixed that could allow for a denial of service (DOS) attack via a kernel crash.
There are no IDs with security authority.
Update by following the NVIDIA installation page.
A security vulnerability was fixed that could allow for a denial of service (DOS) attack via a kernel crash through a NULL pointer dereference. The issue affects the open kernel modules.
There are no IDs with security authority.
Update by following the NVIDIA-r580 installation page.
The book previously installed files for both Pkgconf and Meson to aid with installing 32-bit variants of packages on 64-bit. Upgrading MLFS revealed that those files would be very useful for packages like Systemd. They have now been moved to MLFS in the Pkgconf and Meson pages in Chapter 8. The Meson files also add a libdir parameter, in which MLFS and GLFS now rely on.
Major version r590 was released, dropping support for pre-Turing NVIDIA GPUs. Since pre-Turing GPUs are still very common, especially for Steam users, the book now includes two NVIDIA and CUDA drivers: r580 and the current NVIDIA major version.
Read NVIDIA Revisions for a list of drivers.
Support has been cut from Mesa-25.3, removing all the drivers from Mesa. NVIDIA thus is practically the only way to use it, and NVIDIA can use VA-API via another package, and has the existing CUDA technology. Thus, libvdpau and related packages have been removed. Use VA-API instead.
Previously, the book had instructions for installing just the libgbm library from Mesa. Now, it installs a standalone package, called libgbm, with less dependencies and a quicker build time that's up-to-date and ABI+API compatible with Mesa's libgbm. The book now installs it by default and Mesa now uses it. The development version of the book doesn't need any other files from Mesa, making NVIDIA-only a breeze.
Mesa's core OpenGL libraries (libGL, libEGL, etc.) used to be supported. The book was equipped with instructions to choose between either Mesa or libglvnd. Now the book chooses libglvnd by default and Mesa's OpenGL is unsupported. The book still documents options needed to go with Mesa's OpenGL libraries, however.
These packages have been moved to LFS and Multilib LFS.
590.48.01 and 580.126.09 fixed a security vulnerability that could allow for integer overflows in the nvidia.ko kernel module.
Assigned vulnerabilities: CVE-2025-33219.
Read NVIDIA Revisions for your driver and update it.
Three security vulnerabilities were fixed that could allow for out-of-bounds write operations, use-after-free write operations, and integer overflows.
Assigned vulnerabilities: CVE-2025-59733, CVE-2025-59734, and CVE-2025-63757.
Update by following the NVIDIA installation page.
Eight security vulnerabilities were fixed that could allow for arbitrary code exectution (ACE), denial of service, privilege escalation, data tampering, and information disclosure.
Assigned vulnerabilities: CVE-2025-23280, CVE-2025-23282, CVE-2025-23300, CVE-2025-23309, CVE-2025-23330, CVE-2025-23332, CVE-2025-23345, and CVE-2025-23347.
Update by following the NVIDIA installation page.
The package has been moved to Supplemental LFS. No packages in GLFS use it.
AMDGPU PRO has been removed from GLFS and there are no plans for it to return. Replace the AMDGPU PRO stack with libva, libvdpau, and Mesa.
seatd has been removed from GLFS and has been moved to Supplemental LFS. No packages in GLFS use seatd. Originally, it was added in a time when SLFS (originally LFS-QOL) did not exist. But now it exists to offload such packages, so it got moved.
Git has been removed from GLFS. All downloading instructions now rely on the Wget or cURL packages when pages instruct the user to download files in bulk. No package in GLFS depends on Git otherwise, and no lib32 installation instructions have been present for it as the package does not provide libraries. Follow BLFS for updates to Git.
libxml2-2.13 has upgraded to libxml2-2.14, which has broken ABI. While you can reinstall every package that uses libxml2, or do a complete upgrade, you can instead opt to apply patches which fix security issues without breaking ABI. The patches will be linked in the BLFS advisories.
Support for 32-bit CPUs (ix86) has been removed from GLFS. This is because there is no testing being done for 32-bit by the GLFS development team due to lack of proper hardware. Another big reason is Steam and its CEF sandboxing is unclear on how to properly bypass and what happens beyond that point. Regardless, beyond Steam, the normal installation instructions generally work on 32-bit hardware; you just will be on your own to work around the edge cases.
The luit package has been removed from GLFS as no packages in the book used it. It had no lib32 installation instructions, so feel free to follow BLFS for updates to the luit package.
A heap buffer overflow was fixed that when the package is compiled with sanitized addresses, it will cause fc-cache to bail when using the -f option when generating the font cache. If a font is malformed as a result of the bail, Steam will crash. Fontconfig-2.16.x is not affected.
There are no IDs with security authority.
Either stay on Fontconfig-2.16.x or update by following the Fontconfig installation page.
A vulnerability was fixed that could allow for a use-after-free operation in the kernel for pre-Turing NVIDIA GPUs.
The latest r570, r565, and r560 releases fix this vulnerability.
There are no IDs with security authority.
Update by following the NVIDIA installation page.
A vulnerability was fixed that could allow for exploitation in the xmlBuildQName() function, used most in GLFS by Wine. If you're on libxml2-1.13, install libxml2-1.13.8 with this patch.
There are no IDs with security authority.
Update by following the libxml2 installation page.