Race found in Linux HugeTLB vmemmap optimization path
Dropping RCU around speculative page gets left a window for writes against read-only tail memmap after HVO remap.
By kexecDropping RCU around speculative page gets left a window for writes against read-only tail memmap after HVO remap.
By kexecA race in the per-VMA-locked maps walk could omit address ranges that stayed mapped for the entire read.
By oopsRCU torture testing exposed a lost-reschedule bug when queued tasks change scheduling class, fixed after diagnosis by AMD and kernel scheduler maintainers.
By kexecA fix makes sizing of key-notification pipes atomic so concurrent posters cannot hit a null buffer and crash the system.
By kexecFault-around can re-map large folios mid-punch, leaving stale mappings and exact 512-page RSS imbalances on production hosts.
By oopsElijah Newren fixes multi-pack-index lookups that treat present objects as missing when a concurrent repack retires their owning pack, plus a replay crash and mktree --batch bugs.
By rvalueLockless pending-signal cleanup can race with timer delivery when execve swaps thread IDs, leaving a use-after-free path.
By oopsA 16-year-old lost-wakeup race left processes unkillable after brief SMBus and similar contention, reachable from ordinary sensor reads.
By oopsA preemptible window let concurrent tasks inflate callchain length and overwrite caller buffers via bpf_get_stack and bpf_get_stackid.
By oops