The 23-Year Lawsuit That Claimed to Own Part of Linux Just Died

If you run almost any server today, you run Linux. Something like 9 in 10 of the machines serving the internet do. That dominance looks inevitable now. For most of the last two decades it was not, because a legal claim hung over the kernel’s core code, the kind of claim that, if a court had ever agreed with it, could have forced every Linux distribution on earth to either pay a private company or rip out code that had been shipping for years.

That claim is now, for all practical purposes, dead. On 10 August 2026 the US Court of Appeals for the Second Circuit rejected the final appeal, and the company behind it is left with a rehearing petition its opponent puts at a 0.03% chance of success. I want to walk through how a handshake deal from 1998 turned into a 23-year shadow over the most widely used operating system in the world.

It started with a UNIX project almost nobody remembers

In October 1998 four companies signed on to something called Project Monterey. IBM, the Santa Cruz Operation, Intel, and Sequent agreed to build one unified UNIX that would run across many processor architectures, including Intel’s upcoming 64-bit Itanium and IBM’s own POWER chips. IBM brought POWER support from its AIX system. Santa Cruz Operation brought the 32-bit Intel side. Sequent brought multiprocessing from its DYNIX system. Intel brought money and Itanium expertise.

The logic was sound for 1998. UNIX had splintered into roughly 30 incompatible variants, and a single unified standard looked like the fix. The whole thing was aimed at Itanium, which everyone expected to take over the server market.

Two things then went wrong at once. Itanium slipped badly, missing its first delivery date by about two years, which left the Monterey software without the hardware it was built for. Meanwhile Linux, which nobody in that room had treated as a serious threat, started growing faster than anyone predicted. Between 1998 and 2001 the market that Project Monterey was designed to serve got absorbed by free open source alternatives before the project ever shipped at scale. IBM sold just 32 licenses of the Monterey product in 2001 and fewer the next year.

IBM read the room and switched sides

IBM did the rational thing. It saw Linux winning and pivoted hard, shifting its strategic weight from proprietary UNIX to Linux and pouring roughly $1 billion into Linux development. In 2001 it wound down its involvement in Project Monterey.

Here is the detail that mattered later. Before IBM left, it had contributed code developed during the Monterey work into Linux itself. IBM’s partners in the joint venture would later argue that IBM only ever held a non-exclusive license to that code, meaning IBM could use it but did not own it outright, and so had no right to hand it to an open source project where anyone could copy it. IBM saw it differently. That disagreement sat quiet for about two years.

2003, the lawsuit that scared an entire industry

By 2003 the Santa Cruz Operation had sold its UNIX business and the buyer had renamed itself the SCO Group. In March 2003 SCO sued IBM in Utah, claiming IBM had improperly folded confidential UNIX source code into Linux in breach of their agreement. SCO started the damages demand at $1 billion and later raised it, eventually seeking up to $5 billion.

The suit landed like a bomb. SCO was asserting ownership over code that had been shipping inside Linux for years, running on servers across the entire internet. In August 2003 SCO said it would start sending invoices to companies running Linux, demanding per processor license fees for software those companies thought was free. SCO backed off the invoicing that October after being warned it could face mail fraud exposure, but the message had already gone out. If SCO’s theory held up in court, Linux distributions worldwide were shipping software that legally belonged to one private company. That is as close to an extinction event as the open source world has faced.

The 23-year timeline, from the 1998 UNIX project to the 2026 ruling that effectively ended it. Source: SCO-Linux disputes timeline, Wikipedia

The claims fell apart, slowly

The courts were not persuaded. Over years of litigation SCO’s arguments came apart piece by piece. A key 2007 ruling found that Novell, not SCO, actually owned the UNIX copyrights SCO had been waving around, which cut the legs out from under the whole case. IBM filed heavy counterclaims. In September 2007 SCO filed for Chapter 11 bankruptcy, and the Linux related claims were largely lost or rendered moot.

Most of the industry assumed the story was over. It was not, because intellectual property does not die when a company does. It becomes an asset that gets sold.

The claim gets a second owner

In 2011 a company called UnXis bought SCO’s UNIX business and copyrights out of the bankruptcy estate. UnXis later renamed itself Xinuos. For a while Xinuos ran the actual UNIX products it had bought, OpenServer and UnixWare, as a going business.

Then on 31 March 2021 Xinuos filed a fresh lawsuit in the US District Court of the Virgin Islands, this time naming both IBM and Red Hat. The argument was the old Monterey theory in new clothes. Xinuos claimed IBM had only ever held a non-exclusive license to the Project Monterey code and had breached that license by contributing it to Linux, and that it owned specific copyrighted code blocks that originated in Monterey and ended up in the kernel. Red Hat got pulled in as the distributor of a commercial Linux product built on that allegedly tainted code.

I want to be precise about why this was dangerous, because the stakes were not abstract. A copyright claim against code in the Linux kernel does not stop at IBM. The kernel is the one component every Linux distribution ships, from Red Hat Enterprise Linux and Ubuntu down to the hundreds of small volunteer projects tracked on DistroWatch. If a court ruled that portions of that kernel belonged to a private company, the liability would ripple out to everyone who distributes, uses, or modifies the code, which is effectively everyone.

What IBM actually argued

IBM’s defense had a striking feature. IBM did not dispute that it had contributed code from the Monterey period into Linux. What it disputed was that Xinuos owned anything that let it block that contribution or charge for it. IBM pointed to a prior settlement that SCO had reached, which IBM said broadly covered all the Linux related claims before Xinuos ever bought the assets. Xinuos said that settlement did not apply to its claims.

The District Court for the Southern District of New York, where the case ended up being heard, dismissed it. Xinuos appealed to the Second Circuit.

The ruling, and the technicality that decided it

On 10 August 2026 a three judge panel of the Second Circuit rejected Xinuos’s appeal and upheld the dismissal. The reasoning is the part worth sitting with. The court did not rule that IBM was in the right about ownership. It ruled that Xinuos had waited too long. Although Xinuos framed its claim as a licensing dispute, the court found the real question underneath was code ownership, and that ownership question was time barred under the statute of limitations. The claim was too old to litigate.

As Tom’s Hardware put it in its coverage, IBM does not even dispute taking the code from Project Monterey. It disputes that Xinuos owns anything that makes that taking legally actionable. The court agreed, and the appeal was gone.

For the open source world the result is enormous. The exact scenario SCO started threatening in 2003, a private company using copyright to assert control over code in the Linux kernel, has now been rejected at every level of federal court where it has been tested. The Second Circuit is one of the most respected appeals courts in the country on copyright, so its word carries real weight.

Where Linux stands in 2026, the dominance the lawsuit never slowed. Figures are approximate. Source: TOP500 and industry data

Why it is not 100% over, and why that barely matters

There is a wrinkle. Xinuos has said it will petition for an en banc rehearing, meaning the full bench of Second Circuit judges would reconsider the case rather than the three judge panel that heard it. IBM’s lawyers put the odds of that petition being granted at 0.03%, which is three hundredths of 1%, not 3%. An en banc rehearing is the legal equivalent of the last option you reach for when nobody is taking you seriously, and a 0.03% success rate is about as close to over as lawyers get in public while a case is technically still pending.

There is a subtler open question too. Because the court decided on timing rather than on the merits, it never actually ruled on whether a company holding a non-exclusive license can contribute that code to an open source project without the owner’s permission. That legal principle was sidestepped rather than settled. For Xinuos it does not matter, since its path to litigate the question is closed. For the broader architecture of how code gets contributed to Linux, it means one specific question is still, strictly speaking, unanswered.

The defense that quietly made Linux hard to kill

One part of this story rarely gets told, and it is the part I find most interesting. While SCO was filing suits, the open source world built legal armor specifically to survive this kind of attack.

The Open Invention Network, founded in 2005 partly in response to the original SCO case, holds a large portfolio of patents and runs a binding framework where members cross license their patents to each other around Linux. IBM, Red Hat, Google, Sony, Philips, and many others take part. The point is to make attacking Linux expensive and risky, because a company that sues over Linux exposes itself to the network’s pooled defensive patents. A troll targeting Linux faces more than the one company it sued. It faces 20 years of accumulated legal infrastructure built for exactly that moment.

That armor is also where the real vulnerability shows. Xinuos ran into IBM’s legal team and lost. Had the same theory been aimed at a small volunteer maintained distribution with no lawyers, no network membership, and a budget measured in donations, the outcome could have looked very different. The protection that shields Red Hat and Ubuntu is not automatically there for the hundreds of tiny distributions that also ship the same kernel.

Both ship the same Linux kernel, so both can be targeted by the same claims. Only one side can afford to answer. Source: Soursen analysis

The threat that outlived this one

The Xinuos case was about copyright. The quieter, growing risk is about patents, and it hits small projects harder.

Patent assertion entities, companies that buy patents purely to extract licensing money through litigation threats and never build a product, have been circling open source for years. In 2019 a troll called Rothschild Patent Imaging sued the GNOME Foundation over its Shotwell photo app, claiming it infringed a patent. GNOME chose to fight, and the case settled in 2020 with the troll handing over a license and releasing its claims, but the episode rattled the community as a warning. Since then smaller projects have reported demand letters claiming that ordinary software practices, cryptographic protocols, interface patterns, networking behavior, infringe some patent.

The mechanism is the same one the Xinuos case exposed from the copyright side. A large distributor like Red Hat, or Ubuntu’s parent Canonical, can absorb the cost of answering a demand letter and fighting if it has to. A volunteer project cannot. The letter does not have to win to work. The cost of responding, legal review, compliance checks, possible indemnity for users, can exceed what a donation funded project can carry. The threat itself is the weapon, and the lawsuit behind it may never need to come.

Groups like Unified Patents and its open source work, backed by the Linux Foundation and others, exist to challenge bad patents before they reach that expensive stage, and they have knocked out some trolls. They cannot reach all of them, and they have little visibility into the quiet demand letters landing in the inboxes of projects too small to make noise.

What the 23 years actually bought

From March 2003, when SCO first sued and threatened per processor fees, to 10 August 2026, when the Second Circuit closed the appeal, a legal cloud sat over Linux’s core code for 23 years. The cloud was always more vapor than substance. Courts rejected the core claims again and again. The ownership theory never survived real scrutiny. But rejected and definitively resolved are different states, and the litigation kept finding new vehicles, a bankruptcy, an asset sale, a fresh plaintiff, to stay technically alive.

The open source world moved forward anyway, treating the claims as meritless, and Linux went from a curiosity to running the overwhelming majority of the world’s servers during the exact window the lawsuit was pending. The case ending well is worth something. The structural weakness it exposed, that the smallest distributions have none of the legal protection the big ones rely on, is still sitting there waiting for the next plaintiff who picks an easier target.