kexec
Kernel & Low-Level desk
Kernel makes page-table freeing RCU-safe on every architecture
Lorenzo Stoakes finishes the conversion so lockless RCU page-table walks become safe kernel-wide.
Linux TCP fixes race UAFs when sockets flip listen and disconnect
connect(AF_UNSPEC), listen(), and IPV6_ADDRFORM left request sockets and parent state that concurrent paths could free while still in use.
Linux net stack gains fwnode PCS API for external SerDes blocks
Phylink takes ownership of PCS selection as SoCs put coding sublayers outside the MAC, with Airoha AN7581 as the first in-tree consumer.
rtl8723bs WPS copy bug allows remote stack overflow on scan
A proposed fix for attacker-controlled beacon attributes still drew maintainer objections over correctness and testing.
IBM posts KVM series to run arm64 guests on s390 hosts
A seventh-round patch set wires arm64 KVM code into s390 via shared markers and a new SAE instruction for hardware-accelerated guests.
RISC-V IOMMU gains MSI remapping, default DMA-IOMMU, and VFIO
A redesigned MSI path lets 64-bit RISC-V translate interrupt targets like DMA, unlocking default IOMMU paging and userspace device assignment.
BPF plugs three NULL derefs in BTF type show paths
Key-less hash map dumps and bpf_snprintf_btf() on void or var types could oops the kernel; Jiayuan Chen restores rejections and safe placeholders.
cfg80211 validates WEXT IE buffers to stop OOB reads
A syzbot-found flaw let malformed wireless Information Elements crash the kernel on connect; the fix is rolling through stable trees.
Kernel clamps qdisc quantum paths that let admins soft-lock hosts
Eight traffic-control schedulers still allowed tiny quanta after setup, reopening a deficit-loop DoS under the qdisc lock.
Kernel fix breaks vmalloc livelock under memory pressure
A circular lock dependency in the vmap purge path could stall the whole system when reclaim and purge work collided.
DRM scheduler fix closes unprivileged GPU fence UAF read
A core lifetime bug let userspace read freed scheduler memory via exported fences in amdxdna, nouveau, and msm.
Confidential VMs force KVM to pick sides on attestation and trust
Arm CCA realms and TDX quote plumbing are no longer vendor demos; they are mainline ABI fights over roots of trust, hardware gaps, and how much attestation the hypervisor should own.
Kernel trusted-keys path hardens TPM1 seal and HMAC checks
Forged TPM 1.x replies could overflow a fixed-size blob buffer or skip response authentication entirely.
Linux kernel panics on GSO fragments after IP reassembly
CVE-2026-80590 lets an unprivileged user trigger a BUG_ON in skb_segment via tap or virtio paths that keep GSO metadata on defragmented packets.
tmpfs casefold option leaked Unicode maps, enabling local DoS
Unprivileged users could exhaust kernel memory by repeatedly setting the casefold mount option on tmpfs.
Kernel reverts IRQ guard switch after Syzbot finds nested lock hazards
Refcounted interrupt disable lands for safer nesting and Rust SpinLockIrq, but wiring it into scoped cleanup guards is rolled back until stronger tooling exists.
Kernel user_events fork path fixed for use-after-free
A failed memory allocation during process duplication could free tracing state still held by the parent.
Kernel patches close UDP port side channel in routing caches
Always creating exceptions for ICMP errors stops off-path attackers from probing connected UDP sockets after earlier defenses were bypassed.
Stable kernel USB hub change crashes Threadripper under ADB load
A 6.12 stable backport meant to wake nested USB3 devices is blamed for hard MCE resets when Android tooling hammers the root hub.
BPF cgroup link update fixed for stack out-of-bounds write
Replacement programs were matched only by type, so incompatible sock_addr and LSM hooks could clobber adjacent stack state.
Nova-core moves toward stable r000 NVIDIA GSP firmware ABI
An early-review Linux series would drop versioned GSP firmware names once the still-unreleased r000 blobs ship.
Kernel net maintainer flags LLM patches in PTP time-card series
Jakub Kicinski says AI-generated submissions are hurting review capacity as a seven-patch ptp_ocp series draws process and technical pushback.
ext4 moves buffered I/O onto iomap in 32-patch series
Zhang Yi’s v5 conversion drops buffer_head for regular-file buffered paths and reworks EOF zeroing so size updates cannot expose stale data.
Linux starts killing off the little-used x32 ABI
Maintainers will disable the config option first, with full removal planned after this year's final LTS kernel unless users object.
VFIO patches add CXL Type-2 accelerator passthrough for guests
A 27-patch series from NVIDIA lets VMs program virtual HDM decoders and resets while the host keeps physical memory decode.
Linux adds fwnode PCS API and dynamic phylink attach for external serdes
Christian Marangi’s v14 work gives PCS drivers a clock-style provider model and lets phylink gain or lose coding layers at runtime, with Airoha AN7581 as the first user.
Linux neighbour tables become per-network-namespace
ARP and ND tables move out of the global scope, so each netns can tune neighbour defaults and control paths need less global locking.
mlx5 VFIO selftest lands after four days of Claude-assisted coding
Jason Gunthorpe submitted a 10-patch series that brings ConnectX DMA and MSI coverage to the kernel VFIO tests, cut from the usual multi-month effort.
HP BIOS config driver gets heap overflow and OOB fixes
Nine patches harden hp-bioscfg against out-of-bounds memory access and broken ACPI attribute parsing on HP machines.
Linux 7.2 to revert DRM scheduler FAIR default after GPU freezes
Sustained full-load gaming on AMD Radeon hardware can stall the foreground app and lock up the desktop under the new policy.
Linux proxy execution gains optional sched_ext BPF support
Andrea Righi's series ends a build-time mutual exclusion so one kernel can ship both features and let BPF schedulers opt in at runtime.
Linux makes per-VMA locks unconditional across all configs
A Hansen/Baghdasaryan series drops architecture guards so binder and TCP paths can stop falling back to mmap_lock.
Linux kTLS adds TLS 1.3 hardware offload and KeyUpdate
A net-next series extends kernel TLS device offload beyond TLS 1.2, with full rekey support on capable Mellanox NICs.
Pahole gains Rust enum DWARF support and dwz alternate debug handling
Arnaldo Carvalho de Melo’s series stops Rust Option and Result types from collapsing to empty BTF structs and unblocks type loading on dwz-compressed debuginfo.
RISC-V IOMMU gains MSI remapping, unlocking DMA and VFIO
A 19-patch series from Qualcomm lets RISC-V translate device MSIs like DMA traffic and opens the door to PCIe device assignment in KVM guests.
Kernel debugfs string helper headed read-only after double-free
Greg Kroah-Hartman wants write support dropped rather than more locking after concurrent writers could free the same string twice.
Kernel buffer layer to stop marking good data stale on write failure
A 19-patch series stops clearing BH_Uptodate when metadata writes fail, fixing silent data loss and spurious warnings across multiple filesystems.
Incomplete nftables backport leaves UAF in Linux stable kernels
Omitted commits from a 2024 pipapo series leave use-after-free and double-free bugs in 6.6.y and older trees.
Arm CCA protected VMs advance in KVM review
Steven Price's 37-patch series brings realm guests to arm64 KVM, targeting RMM v2.0-bet2 under maintainer scrutiny.
Kernel staging maintainer will reject LLM-generated patches
Greg Kroah-Hartman says automated cleanups defeat the subsystem's role as a training ground for new developers.
KVM gains Arm CCA support for confidential Realm VMs
Steven Price’s 45-patch series wires Linux KVM to the Realm Management Monitor so hosts can run protected Arm guests.
Kernel RFC aims to drop PG_private for a new folio flag bit
Zi Yan’s series would free a scarce page-flag bit by treating a non-NULL private pointer as the sole signal that a page carries filesystem or driver state.
Linux mm gains ALLOC_UNMAPPED for direct-map-free pages
Brendan Jackman's v3 series lays allocator and mapping groundwork for guest_memfd isolation and Address Space Isolation.
BPF verifier fixes plug refcount_acquire holes for borrowed kptrs
Two bugs let CAP_BPF programs feed NULL or stale pointers into refcount paths that could crash the kernel.
Linux usbio driver fixed for slab overflows and I2C hang
Unchecked endpoint sizes and debug dumps left the Intel USB-to-I2C bridge open to memory corruption, hangs, and log leaks.
KVM nested SVM drops blanket TLB flushes with per-vCPU L2 ASIDs
Yosry Ahmed's series gives each nested guest its own ASID, matching VMX VPID practice and yielding 8-15% gains on recent AMD CPUs.
BPF and kprobe hooks may stop yielding to ftrace kill switch
An RFC would block silent disable of fentry, fexit, and ftrace kprobes; ftrace's maintainer instead floats retiring the switch entirely.
ARM posts arm64 patches for 128-bit page table entries
FEAT_D128 support would let Linux use the VMSAv9-128 translation regime on ARMv9.3 hardware.
Linux SCSI gains native multipath as dm-mpath alternative
John Garry’s v6 series groups ALUA-capable paths into multipath-aware SCSI disks with in-kernel failover and I/O policies.
Linux patchset unites proxy execution with sched_ext
Distributions can ship one kernel with both features and let BPF schedulers opt in at runtime.
Linux mm patchset unifies hot-page promotion for tiered memory
AMD's pghot v8 consolidates access tracking from hint faults and hardware samplers, then drives batched promotions via per-node kernel threads.
ext4 moves to drop inline data writes for regular files
An RFC series would deprecate the feature after years of bugs, syzbot hits, and at least eight CVEs, while keeping it for directories.
CAN BCM timer UAF patch rejected as already fixed
A reported RCU race in AF_CAN receive-op deletion was NAKed after the maintainer said mainline already closed it.
sched_ext and proxy execution no longer mutually exclusive
BPF schedulers can opt into handling mutex-blocked donors so one kernel can ship both features.
Kernel roundup: ptdump use-after-free fix, taskstats cpumask bug, RISC-V IOMMU MSI, and QCE removal fight
A memory-safety race in page-table dumping leads the week’s traffic, alongside a long-lived taskstats truncation, RISC-V IOMMU progress, and a push to delete a BROKEN Qualcomm crypto driver.
Kernel VLAN fix stops skb panics when toggling HW offload
Dynamic hard_header_len updates raced with lockless TX paths; macvlan-on-VLAN shows a related headroom gap.
Sockmap cork path double-frees under concurrent TCP sendmsg
A KASAN-reported use-after-free in the BPF TCP send path freed a shared cork message twice when two threads raced across a lock drop.
Linux shortens IPI waits that blocked preemption
Core SMP call and x86 TLB flush paths no longer pin the caller for the full remote completion wait, cutting real-time scheduling latency.
Kernel maintainers require Assisted-by tags for AI rubber-duck reviews
Greg Kroah-Hartman and Jonathan Corbet say even non-generative AI code review of the xillybus driver must be credited.
Linux mm series proposes private NUMA nodes, isolated by default
Gregory Price's v5 patchset flips device-backed memory from fully fungible to opt-in kernel services.
Btrfs folio lock leak hangs KVM guests on file-backed RAM
Large data folios dirtied via GUP without subpage bits leave writeback holding a lock forever, stalling guests and host flushers.
Stable kernels get BPF verifier fix for ld_abs/ind in subprogs
CVE-2026-53090 addressed incomplete failure-path analysis that could let unsafe programs pass verification.
Stable kernel blocks IV race in userspace skcipher sockets
An unprivileged local attacker could overwrite an in-flight IV and reuse keystream on concurrent cipher operations.
Kernel gains fwnode PCS API as external serdes become common
Christian Marangi’s net-next series gives phylink a proper producer-consumer model for Physical Coding Sublayer devices, with Airoha AN7581 as the first in-tree user.
RFC proposes in-kernel AMD GPU offload for XDP and IPsec
knod would JIT-compile packet programs on the GPU from the kernel, with no CUDA or ROCm in the data path.