fwupd 2.1.9 ships with enterprise tweaks and a wave of fuzzing fixes
The latest Linux firmware updater gets server telemetry, a wave of parser hardening fixes, and a single new touchpad. Most of the 54 commits are defensive.
The folks behind Linux's firmware updater have released fwupd 2.1.9, and if you were hoping for a pile of new hardware support, you'll be underwhelmed. Of the 54 commits since the last tag, most are defensive memory-safety fixes. There's a single new touchpad, a server-oriented telemetry bump, and a new build requirement. Nothing more.
Lead developer Richard Hughes (known as hughsie, a Red Hat and GNOME maintainer) published the release earlier today at roughly 13:30 UTC. It lands about a month after 2.1.8, continuing fwupd's near-monthly habit for feature releases.
A small change set in disguise
fwupd is a daemon that installs firmware updates on Linux systems. It handles UEFI firmware, SSDs, CPU microcode, and Android firmware. If your machine shows up in the GNOME Software update list, there's a decent chance fwupd is the engine doing the work.
This release does add a few genuine features. Hughes is now including whether the host is a container or hypervisor in fwupd's telemetry data, a change aimed squarely at virtualized and server environments. There's also a Redfish instance ID added for each HPE device pair, letting HP Enterprise admins track firmware components over the Redfish management API more precisely. And the daemon now requires libusb at or above 1.0.27 to build from source.
The public-facing hardware add is a lone PixArt touchpad controller, PID 38CA. It builds on the PixArt support Hughes expanded in 2.1.8, which itself added four new PIDs.
There are also the usual smattering of smaller fixes, and some are worth a look. Vishnu Raghav's work stops 64-bit values from being truncated when exporting firmware as XML, a change that matters for anyone parsing fwupd's output in a pipeline. Rolv Apneseth fixes a CoreOS mount-ordering race by adding After=local-fs.target to fwupd.service. Not much to write home about, but real.
The real work: fuzzers and hardening
Look past the curated notes and the shape of the release becomes clear. A large share of the commits target memory safety in the device protocol parsers. Several commits literally chase "almost impossible" crashes found by fuzzers: the logitech-tap, himax-tp, egis-moc, and amd-kria plugins all got defensive patches against malformed input.
It's a pattern that has defined fwupd for a while now. The 2.0.21 release famously addressed more than 250 potential security issues, many surfaced through AI-assisted code review, and this update reads as more of the same discipline. Alongside the fuzzing fixes you get the unglamorous but necessary work: steelseries gains a maximum firmware size, dell-dock's left-shift overflow is corrected, and fastboot's write helpers finally free their buffers.
As hard as it tries, though, this is still mostly Hughes doing Hughes things. He authored 39 of the 54 commits. The rest came from a spread of Red Hat-adjacent developers and outside contributors: Mario Limonciello, Peter Hutterer, Simon Glass, plus a handful of one-timers. It's community-sourced in name, but the maintainer carries the load.
Head here to the release download page.
