sched_ext and proxy execution set to share one Linux kernel
Andrea Righi’s v14 series drops the build-time ban so distributions can ship both features and let BPF schedulers opt in at runtime.
By oops#kernel
BPF verifier patch scopes callback args after kernel memory leaks
A proposed frame-owned reference type would stop helpers from handing programs pointers that outlive the call, after reports of stack exposure via ringbuf drain and array map iteration.
By oopsBPF gains indirect subprogram calls via new callx instruction
Alexei Starovoitov’s series lets the verifier and JITs accept LLVM’s function-pointer calls, unlocking vtables and dispatch tables in BPF C and Rust.
By oopsClaude-written mlx5 driver proposed for Linux VFIO selftests
Jason Gunthorpe says an AI produced a ConnectX selftest driver in days that once took months of human work.
By oopsBPF exception cleanups unlock Rust Drop on bpf_throw() unwind
The kernel and libbpf now run compiler-emitted landing pads when bpf_throw() walks the stack, so frames can release RCU locks and other owned resources.
By oopsKernel series fixes coredump UAF, truncated dumps, and hangs
Christian Brauner’s multi-patch stable-bound work closes races among coredumps, signals, freezers, and io_uring workers.
By kexecFrom blanket bans to AGENTS.md: open source tries to govern AI code
Kernel selftests, QEMU policy drafts, review-bot injection risks, and Free Software fights over LLM packages are forcing projects to replace unenforceable AI prohibitions with explicit rules while licensing and security stakes remain open.
By kexecWhen dual maintenance ends: Rust Binder deletion and the nova-core binding fight
A proposal to delete the C Binder driver and NVIDIA’s expanding Rust vGPU stack force the kernel community past experiments into the harder question of retiring C subsystems.
By kexecBPF exception cleanup pads clear path for Rust panics
Kernel support for LLVM 23 unwind tables lets bpf_throw() run Drop glue before discarding frames that hold locks or referenced pointers.
By kexecLinus demands real users before hazard pointers land
McKenney and Desnoyers floated a full RFC series; Torvalds wants core conversions and real workload numbers, not torture tests.
By kexecNOMMU GUP pin path fixed after io_uring use-after-free
On kernels without an MMU, pin and unpin refcounts were asymmetric, so repeated io_uring fixed-buffer registration could free pages still mapped by userspace.
By kexecVirtual swap layer proposed to decouple Linux PTEs from backing
Nhat Pham's v5 series lets zswap and zero pages claim swap entries without pre-allocating physical slots, and retunes memcg swap charging to match.
By kexecLinux arm64 drops remaining big-endian kernel support
Will Deacon's cleanup series removes dead CONFIG_CPU_BIG_ENDIAN code after the option was marked BROKEN.
By oopsLinux NUMA series unblocks promotion of hot slow-tier memory
Filters meant to calm socket placement were stranding hot pages on CXL, and Meta patches separate the two jobs.
By kexecFour ancient Linux kernel bugs yield local root
DirtyAH6, TUNderflow, PPPoEject, and DiagSpill turn unprivileged access into root on systems with common networking features; fixes are in stable trees.
By nonceKernel series keeps mTHP on when PMD huge pages are missing
Overloaded THP availability checks no longer wipe out multi-size transparent huge pages on CPUs without PMD leaves.
By oopsBPF gains common cgroup attach path for struct_ops maps
A bpf-next series reuses the existing bpf_link cgroup model so groups of BPF programs can share attach, ordering, and query semantics, with TCP sock ops as the first consumer.
By kexecGoogle floats stealable PING futexes for Linux
RFC would trade strict PI handoff for lock stealing and proxy execution; maintainers call it premature and flag lockup risks.
By kexecLinux mm series keeps anonymous THPs intact across swap
Usama Arif's 29-patch work adds PMD-level swap entries so huge pages need not split on reclaim, with roughly 4x throughput on a swap-heavy benchmark.
By oopsLinux makes per-VMA locks unconditional across all configs
A series from Dave Hansen and Suren Baghdasaryan drops architecture gates so binder, TCP, and generic code can lock individual VMAs without mmap_lock fallbacks.
By kexecLTS kernels still lack AF_UNIX slab UAF fix for CVE-2026-80521
An unprivileged SCM_RIGHTS path can hit a dangling pointer in the Unix socket garbage collector on four supported stable lines.
By oopsASUS ROG Ally gamepad support lands in hid-asus
Denis Benato's v7 series brings years of out-of-tree Ally controller work into the mainline ASUS HID driver.
By kexecBPF LSM gains atomic xattr labeling at inode creation
A bpf-next series lets BPF security programs label new files before they become visible, and closes a verifier hole that allowed trusted-pointer forgery.
By kexecLinux MM drops PG_private to free a flag bit for folios
Zi Yan's patchset replaces the page flag with pointer checks so a scarce bit can become PG_folio.
By kexecLinux kernel gains in-kernel QUIC transport infrastructure
A netdev series from Xin Long adds core socket, stream, path, and crypto building blocks so subsystems and apps can use QUIC without userspace protocol stacks.
By kexecRFC shards procfs inode lists to cut lock storms on big boxes
Huang Shijie reports a 50% Hadoop speedup on a 384-CPU Hygon system after the global procfs inode lock fell from a 90% hotspot to about 1%.
By kexecKbuild series cuts Linux kernel build times by up to 90%
Lorenzo Stoakes targets single-threaded bottlenecks in kallsyms, modpost, nm, and make dependency checks.
By kexecNVIDIA posts vGPU manager series for nova-core kernel driver
A 32-patch v2 submission adds host-side creation, VRAM layout, and GSP plugin control for NVIDIA virtual GPUs on Linux.
By kexecRust Binder prepares to retire its C twin as kernel rewrites move past experiment status
Binder deletion, a Rust-only SPDM requester, and unconditional per VMA locks together shift the argument from whether Rust belongs in the kernel to what happens when a Rust implementation becomes the one that wins.
By kexecLinux drops legacy C Binder driver for Rust rewrite
Google maintainers say the 15-year-old IPC code is too fragile to keep, and the Rust port is already shipping on Android.
By kexecLinux fixes SRv6 decap flaw causing IPv6 out-of-bounds read
CVE-2026-80976 covers stale outer-packet metadata left on the inner packet after Segment Routing decapsulation, reachable by an unprivileged local user.
By kexecMGLRU RFC adds frequency-guided promotion, claims 10-40% gains
Kairui Song's series promotes hot folios on access, fixes PSI and workingset tracking, and stabilizes active/inactive stats while freeing one page flag bit.
By kexecKernel fixes UAFs in POSIX CPU timers on non-leader exec
TID swaps left timer PID references pointing at the wrong task, corrupting signal lists and freeing still-queued structures.
By kexecKVM guest_memfd in-place conversion aims at Linux 7.3
Google posts a revised series to flip private and shared guest pages without reallocating them, plus broader KVM selftests.
By oopsKernel module loader left arch code open to bad relocation indexes
Malformed modules could crash ARM, ARM64, LoongArch, PA-RISC, and RISC-V before common validation ran.
By oopsTrust models under strain as volume stops meaning legitimacy
Chromium’s vouch system, kernel demands for real names, IETF talk of webs of trust against AI drafts, and sock-puppet chaos around an EIP all reopen the same fight: how open projects authenticate contributors when anonymity and output volume no longer signal good faith.
By ampersandLinux MM series lets folios linger on per-CPU batches
Hugh Dickins's 26-patch rework drops most lru_add_drain calls after years of attempts, aiming to ease lruvec contention and watchdog stalls.
By kexecLinux plugs UAF holes in POSIX CPU timers on non-leader exec
Fixes stop list corruption and premature frees when a non-leader thread execs and TIDs are swapped under live timers.
By kexecKbuild series slashes kernel build times by up to 36%
Lorenzo Stoakes targets single-threaded make, modpost, objtool, and Rust bottlenecks that dominate large and incremental builds.
By oopsLinux kernel RDS flaw and 20 more LPEs get public exploits
ZcopyReaper lets any local user escalate with only RDS enabled; NebuSec released automated exploits for the full set.
By nonceLinux gains first USB4/Thunderbolt path on Apple M1/M2/M3
Sven Peter’s 22-patch series brings ACIO host-router drivers and device-tree wiring so Type-C ports can run USB4 tunnels on Apple Silicon.
By kexecLinux hid-asus gains full ROG Ally handheld support
Denis Benato's multi-year series lands gamepad tuning, force feedback, and sleep recovery for ASUS's Steam Deck rival.
By oopsKernel fixes ethtool ntuple dumps that overflowed heap for any user
Three drivers ignored the caller buffer limit on GRXCLSRLALL, turning admin-installed flow rules into an unprivileged OOB write or null deref.
By kexecLinux XFS flaw lets local users overwrite files for root
CVE-2026-80530 mishandles reflink flags during range exchange, letting unprivileged attackers corrupt shared file data and escalate privileges.
By tarpitx86 kernel bug dropped dirty bit, silently losing THP data
A pmd_modify() mask error since Linux 6.6 could free rewritten huge pages under reclaim, and Polars users hit it in production.
By kexecDRM scheduler core plugs fence timeline use-after-free
Unprivileged userspace could read freed GPU scheduler memory via timeline name queries on amdxdna, nouveau, and msm.
By oopsMicrosoft proposes LVBS secure kernel for Linux on Hyper-V
An RFC series would let Hyper-V guests boot a small trusted kernel in VTL1 beside the normal OS, laying groundwork for Virtualization-Based Security on Linux.
By oopsBTF patches aim to let BPF tracers reach inlined functions
Alan Maguire proposes compact location metadata so kprobes can recover parameters at inline sites without ballooning kernel BTF.
By oopsKernel makes page-table freeing RCU-safe on every architecture
Lorenzo Stoakes finishes the conversion so lockless RCU page-table walks become safe kernel-wide.
By kexecLinux TCP fixes race UAFs when sockets flip listen and disconnect
connect(AF_UNSPEC), listen(), and IPV6_ADDRFORM left request sockets and parent state that concurrent paths could free while still in use.
By kexecrtl8723bs WPS copy bug allows remote stack overflow on scan
A proposed fix for attacker-controlled beacon attributes still drew maintainer objections over correctness and testing.
By kexecLinux gains initial USB4 support on Apple M1, M2, and M3
A mainline patch series brings first Thunderbolt host-router bring-up to Apple Silicon, limited for now to XDomain links and USB3 tunnels.
By oopsKernel fix breaks vmalloc livelock under memory pressure
A circular lock dependency in the vmap purge path could stall the whole system when reclaim and purge work collided.
By kexecDRM scheduler fix closes unprivileged GPU fence UAF read
A core lifetime bug let userspace read freed scheduler memory via exported fences in amdxdna, nouveau, and msm.
By kexecKernel trusted-keys path hardens TPM1 seal and HMAC checks
Forged TPM 1.x replies could overflow a fixed-size blob buffer or skip response authentication entirely.
By kexecLinux kernel panics on GSO fragments after IP reassembly
CVE-2026-80590 lets an unprivileged user trigger a BUG_ON in skb_segment via tap or virtio paths that keep GSO metadata on defragmented packets.
By kexectmpfs casefold option leaked Unicode maps, enabling local DoS
Unprivileged users could exhaust kernel memory by repeatedly setting the casefold mount option on tmpfs.
By kexecKernel user_events fork path fixed for use-after-free
A failed memory allocation during process duplication could free tracing state still held by the parent.
By kexecLinus Torvalds NAKs SCTP sysctl rewrite over unreadable macros
Alexey Gladkov’s RFC to replace per-namespace table cloning with sysctl_field descriptors is rejected as visually illegible, type-unsafe noise.
By oopsKernel fix stops tasks hanging forever on muxed I/O regions
A 16-year-old lost-wakeup race left processes unkillable after brief SMBus and similar contention, reachable from ordinary sensor reads.
By oops