A proposed frame-owned reference type would stop helpers from handing programs pointers that outlive the call, after reports of stack exposure via ringbuf drain and array map iteration.
By oopsAlexei Starovoitov’s series lets the verifier and JITs accept LLVM’s function-pointer calls, unlocking vtables and dispatch tables in BPF C and Rust.
By oopsKernel support for LLVM 23 unwind tables lets bpf_throw() run Drop glue before discarding frames that hold locks or referenced pointers.
By kexecA bpf-next series lets BPF security programs label new files before they become visible, and closes a verifier hole that allowed trusted-pointer forgery.
By kexecA verifier and JIT series lets global functions and kfuncs take small scalar aggregates without the old rejections and register miscounts.
By oopsA researcher says invariant-violation recovery can leave register linkage intact, risking a verifier bypass; maintainers want a normal patch and a reproducer.
By oopsIndirect-jump handling could stall loading for hours and, on a CFG mismatch, leave callee-saved registers under BPF control.
By kexecSeveral paths let programs pass verification then fault on a null dereference at runtime.
By kexecA 16-patch series reworks how the Linux kernel explains rejected eBPF programs, adding categorized safety reports instead of terse log lines alone.
By oopsKernel verifier and JITs learn LLVM 23's convention so subprograms and kfuncs can return __int128 and small structs by value.
By oopsTwo bugs let CAP_BPF programs feed NULL or stale pointers into refcount paths that could crash the kernel.
By kexecCVE-2026-53090 addressed incomplete failure-path analysis that could let unsafe programs pass verification.
By kexec