Kali Linux 2026.3: kernel 7.1.5, KDE Plasma 6.7, six new tools and how to upgrade

Kali Linux 2026.3 is out. The third Kali release of 2026, announced on 26 October, moves the penetration-testing distribution to KDE Plasma 6.7 and Linux kernel 7.1.5, adds six tools, and, as its headline change, rewrites the scripts the Kali team uses to build its own images. If you already run Kali, an ordinary apt full-upgrade brings you to 2026.3; there is no reinstall.

Key points

• Kali Linux 2026.3 was announced on 26 October 2026, the third release of the year and the first since 2026.2 in June.
• The kernel moves from 6.19 to 7.1.5, as part of 126 package updates, and the desktop moves to KDE Plasma 6.7.
• Six new tools arrive in the network repositories: dalfox, katana, qsreplace, rustscan, sdrangel and snaffler-ng.
• The build-scripts refresh adds Docker and Podman support through a build-in-container.sh script; not every build-script is refreshed yet, and the team says it is sorry for any CI pipelines it broke.
• Existing installs update with sudo apt update && sudo apt -y full-upgrade; the new version shows as VERSION_ID="2026.3" in /etc/os-release.

What to do

If you run Kali already (bare metal, VM or WSL). Make sure your APT source is the Kali rolling repository, then update. The release notes give this sequence:

sudo apt update && sudo apt -y full-upgrade
cp -vrbi /etc/skel/. ~/
[ -f /var/run/reboot-required ] && sudo reboot -f

The cp line copies the newest default dotfiles into your home directory and keeps backups of any files it replaces (the -b flag), so review the backups before you delete them. Afterwards, check the version with grep VERSION /etc/os-release, which should show 2026.3, and the kernel with uname -r, which should show 7.1.5+kali-amd64 on a 64-bit PC (it may differ on other architectures).

If you are downloading a fresh image. Get it from the Kali download page and verify it. Kali's documentation says to download the SHA256SUMS and SHA256SUMS.gpg files from the same directory as the image, import Kali's signing key and check the signature on the checksum file before you compare the checksum of the image. That protects against a tampered mirror.

If you maintain automation that builds Kali. Read the next section before you update: the team says the refresh may have broken some CI pipelines and workflows.

If you run NetHunter on a phone or watch. See the NetHunter section below; the update addresses compatibility between modern systemd/udev and older kernels.

What happened

Kali's team published the 2026.3 notes on the Kali blog on 26 October 2026. The post frames the release around three themes: a refresh of the build-scripts, desktop updates, and new tools.

The build-scripts are the public scripts the team says it uses to create every official image offered on kali.org. The refresh gives each script the same features, command-line arguments, structure and layout where possible. The container route is new: each refreshed script ships a build-in-container.sh that detects whether Docker or Podman is installed, creates a build container and runs the build inside it. Until now, the team writes, it had recommended building Kali on Kali, "which caused a bit of a chicken-and-egg problem". Its documentation for building on Debian-based systems has also been improved.

The post's worked example builds the installer image from the kali-installer repository. After installing git and the build dependencies (simple-cdd, debian-cd, cpio, mtools, dosfstools, xorriso), sudo ./build.sh produces a Kali rolling installer for AMD64 by default. Options include a different hostname, extra packages, another branch such as kali-dev, a variant such as netinst, or another architecture such as arm64.

Background

Kali is a Debian-based distribution maintained by OffSec for security testing and digital forensics. 2026.3 follows 2026.2 in June, where the team first gave what it called a sneak peek of the build-scripts work. The new post says the refresh is only a first milestone: the team had hoped to finish every build-script in time but did not, and aims to have the rest ready for 2026.4. After that, it says, it will look at automating builds and workflows and then show different setups and customisation options.

How it works: what changed in the system

Desktop. Kali moves to KDE Plasma 6.7. KDE's own announcement, dated 16 June 2026, lists per-screen virtual desktops as a headline feature, noting they arrived "After 21 years". Kali's notes pick out the same feature as useful on multi-monitor setups where you want terminals, browsers, Burp or documentation kept apart without switching workspaces on every display. They also mention better Wayland protocol and portal support, optimisations for integrated Intel GPUs and multiple full-screen windows, and the ability to duplicate network connections. The release also adds or updates icons for tools in the applications menu and on kali.org/tools, which now follows the category structure introduced in Kali 2025.2.

Kernel and packages. The release contains 126 package updates, including the Kali kernel moving from 6.19 to 7.1.5. The example output in the post shows the kernel build dated 29 July 2026.

New tools. The six additions, as the team describes them:

Tool	What it does
dalfox	open-source XSS scanner and utility focused on automation
katana	next-generation crawling and spidering framework
qsreplace	reads URLs on stdin and replaces all query string values with a value you supply
rustscan	modern port scanner
sdrangel	Qt-based software-defined-radio front end for various devices
snaffler-ng	SMB share scanner for credentials and sensitive data

These are security tools meant for systems you own or are authorised to test.

NetHunter. Kali's mobile platform gets several changes. The update fixes compatibility between modern systemd/udev and older kernels without extensive patches. Wardriving is now supported on the TicWatch Pro 3 series, using an updated libnexmonkali library for internal monitor mode on the watch. An experimental feature called WearHunter controls a NetHunter watch from a phone over ADB via Wi-Fi or Bluetooth. NFC access from the Kali chroot lets users read, clone and edit Mifare Classic cards without an external adapter, and KernelSU is now supported. Nine new device kernels are listed, from a Google Pixel on LineageOS 22.2 to a Sony Xperia 10 V on LineageOS 23.2. The notes also say the Bluetooth Arsenal airplane mode is back and the Kali NetHunter app crash triggered by its storage request has been fixed.

Documentation and mirrors. The notes list three new documentation pages (including importing a premade Kali QEMU VM and NetHunter EvilTwin) and nine updated ones. Four new mirrors were added, in the Netherlands (two), Portugal and Switzerland.

What it means

For most users this is a routine upgrade: a new kernel, a new desktop version and a handful of new tools. The change with the longest reach is behind the scenes. People who make custom Kali images, such as pre-seeded installers for training labs or automated test rigs, now get one consistent set of scripts that can run in a container, which should make reproducible builds easier. The cost is the transition: until every script is refreshed in 2026.4, the layouts and options differ between images, and the team has apologised for broken pipelines.

For people learning security, the new tools are a useful snapshot of what testers currently use: katana for web crawling and qsreplace for rewriting query strings, dalfox for XSS, rustscan for port scanning, snaffler-ng for SMB shares. All of them can do harm if used without permission, so practise on your own labs or on platforms that explicitly allow testing.

What we don't know yet

• Which build-scripts remain unrefreshed. The team says only that some were not ready and should be in 2026.4.
• Which specific CI setups broke. The post does not list them.
• Whether any of the 126 package updates carries security fixes people should know about; the notes list changes by theme, not by package.
• A date for 2026.4. The team has not given one in this post, and we will not guess.

What to watch next

Kali 2026.4, which the team says will complete the build-scripts refresh and then move on to automating builds. If you rely on custom image builds, test your pipeline against the new scripts before the next release rather than after. Keep an eye on the NetHunter pages if you use a watch or an older phone, since device support is added release by release.

Sources

• Kali Linux Blog, Kali Linux 2026.3 Release (Build-Scripts Refresh), 26 October 2026 (primary source)
• KDE, Plasma 6.7 announcement, 16 June 2026
• Kali Linux Documentation, Download Kali Linux Images Securely