kexec
Kernel & Low-Level desk
BPF exception unwind gains cleanup pads for Rust Drop
Yonghong Song's bpf-next series lets bpf_throw() run compiler-emitted landing pads so frames can release locks and owned objects on the way out.
Linux perf drops embedded Python for standalone scripts
Ian Rogers's 49-patch series finishes moving perf analysis scripts onto a C extension module, cutting overhead and build complexity.
BPF exception cleanup pads clear path for Rust panics
Kernel support for LLVM 23 unwind tables lets bpf_throw() run Drop glue before discarding frames that hold locks or referenced pointers.
Linus demands real users before hazard pointers land
McKenney and Desnoyers floated a full RFC series; Torvalds wants core conversions and real workload numbers, not torture tests.
NOMMU GUP pin path fixed after io_uring use-after-free
On kernels without an MMU, pin and unpin refcounts were asymmetric, so repeated io_uring fixed-buffer registration could free pages still mapped by userspace.
Stable kernels need alternate fix for AF_UNIX UAF
CVE-2026-64109 still affects long-term trees after mainline removed a dangerous tail length read unsuitable before 6.5.
Virtual swap layer proposed to decouple Linux PTEs from backing
Nhat Pham's v5 series lets zswap and zero pages claim swap entries without pre-allocating physical slots, and retunes memcg swap charging to match.
perf trace stops vetoing syscalls for every concurrent tracer
Ian Rogers moves filtering into BPF maps so a single session can no longer drop raw_syscalls events system-wide, and the exclusive test tags that hid the problem can go.
Linux NUMA series unblocks promotion of hot slow-tier memory
Filters meant to calm socket placement were stranding hot pages on CXL, and Meta patches separate the two jobs.
BPF gains common cgroup attach path for struct_ops maps
A bpf-next series reuses the existing bpf_link cgroup model so groups of BPF programs can share attach, ordering, and query semantics, with TCP sock ops as the first consumer.
Google floats stealable PING futexes for Linux
RFC would trade strict PI handoff for lock stealing and proxy execution; maintainers call it premature and flag lockup risks.
Linux VFIO series adds CXL Type-2 accelerator passthrough
NVIDIA’s Manish Honap posts work that lets guests drive a virtual HDM decoder and device reset while the host keeps the physical mapping.
NVIDIA vGPU VFIO driver sparks Rust rewrite debate
A C-based variant driver for nova-core draws a full Rust counter-proposal and VFIO maintainer pushback on long-term review capacity.
Linux makes per-VMA locks unconditional across all configs
A series from Dave Hansen and Suren Baghdasaryan drops architecture gates so binder, TCP, and generic code can lock individual VMAs without mmap_lock fallbacks.
ASUS ROG Ally gamepad support lands in hid-asus
Denis Benato's v7 series brings years of out-of-tree Ally controller work into the mainline ASUS HID driver.
BPF LSM gains atomic xattr labeling at inode creation
A bpf-next series lets BPF security programs label new files before they become visible, and closes a verifier hole that allowed trusted-pointer forgery.
KVM arm64 gets basic plumbing for Arm CCA Realms
Arm posts the eighteenth revision of structural KVM changes for confidential Realm VMs, still short of a runnable guest.
Linux MM drops PG_private to free a flag bit for folios
Zi Yan's patchset replaces the page flag with pointer checks so a scarce bit can become PG_folio.
Linux kernel gains in-kernel QUIC transport infrastructure
A netdev series from Xin Long adds core socket, stream, path, and crypto building blocks so subsystems and apps can use QUIC without userspace protocol stacks.
RFC shards procfs inode lists to cut lock storms on big boxes
Huang Shijie reports a 50% Hadoop speedup on a 384-CPU Hygon system after the global procfs inode lock fell from a 90% hotspot to about 1%.
Kbuild series cuts Linux kernel build times by up to 90%
Lorenzo Stoakes targets single-threaded bottlenecks in kallsyms, modpost, nm, and make dependency checks.
NVIDIA posts vGPU manager series for nova-core kernel driver
A 32-patch v2 submission adds host-side creation, VRAM layout, and GSP plugin control for NVIDIA virtual GPUs on Linux.
Rust Binder prepares to retire its C twin as kernel rewrites move past experiment status
Binder deletion, a Rust-only SPDM requester, and unconditional per VMA locks together shift the argument from whether Rust belongs in the kernel to what happens when a Rust implementation becomes the one that wins.
Rust Binder parity makes C removal a real choice
A push to delete the legacy C Binder driver, a Rust SPDM requester for untrusted device auth, and unconditional VMA locks together force the kernel to decide whether dual maintenance ends in security-sensitive paths.
Linux drops legacy C Binder driver for Rust rewrite
Google maintainers say the 15-year-old IPC code is too fragile to keep, and the Rust port is already shipping on Android.
Stable kernel fixes AF_XDP TOCTOU race in TX checksum path
A malicious process could overwrite shared UMEM metadata between check and use, bypassing bounds validation.
Samsung RFC pitches Rust UFS driver that skips SCSI midlayer
Maintainers warn the design duplicates midlayer work and may struggle for UFS contributor adoption.
Linux fixes SRv6 decap flaw causing IPv6 out-of-bounds read
CVE-2026-80976 covers stale outer-packet metadata left on the inner packet after Segment Routing decapsulation, reachable by an unprivileged local user.
MGLRU RFC adds frequency-guided promotion, claims 10-40% gains
Kairui Song's series promotes hot folios on access, fixes PSI and workingset tracking, and stabilizes active/inactive stats while freeing one page flag bit.
Kernel fixes UAFs in POSIX CPU timers on non-leader exec
TID swaps left timer PID references pointing at the wrong task, corrupting signal lists and freeing still-queued structures.
Proxy execution and sched_ext move toward coexistence
Andrea Righi’s v13 series would end the build-time ban that forced kernels to pick one feature or the other.
BPF verifier patches close gotox DoS and register-leak paths
Indirect-jump handling could stall loading for hours and, on a CFG mismatch, leave callee-saved registers under BPF control.
Writeback drain stalls Tasks-RCU, panics hosts on BPF detach
Cgroup writeback cleanup can run for minutes without a Tasks-RCU quiescent state on lazy-preempt kernels, blocking ftrace and BPF unlinks until the hung-task detector fires.
Linux MM series lets folios linger on per-CPU batches
Hugh Dickins's 26-patch rework drops most lru_add_drain calls after years of attempts, aiming to ease lruvec contention and watchdog stalls.
Linux plugs UAF holes in POSIX CPU timers on non-leader exec
Fixes stop list corruption and premature frees when a non-leader thread execs and TIDs are swapped under live timers.
Linux gains first USB4/Thunderbolt path on Apple M1/M2/M3
Sven Peter’s 22-patch series brings ACIO host-router drivers and device-tree wiring so Type-C ports can run USB4 tunnels on Apple Silicon.
BPF gains kfunc to drive proactive memcg reclaim
A sleepable SYSCALL-only helper lets policy programs reclaim from chosen cgroups without writing memory.reclaim.
BPF verifier fixed to stop false non-NULL pointer inference
Several paths let programs pass verification then fault on a null dereference at runtime.
DRM scheduler fence UAF still open after two driver CVEs
A core use-after-free in timeline-name handling still hits amdxdna, nouveau, and msm, and a proposed cache fix was pulled after lifetime objections.
Kernel fixes ethtool ntuple dumps that overflowed heap for any user
Three drivers ignored the caller buffer limit on GRXCLSRLALL, turning admin-installed flow rules into an unprivileged OOB write or null deref.
Ext4 buffered I/O shifts from buffer_head to iomap
Zhang Yi posts v6 of a 31-patch series that modernizes regular-file buffered reads and writes while reworking EOF and journal ordering.
x86 kernel bug dropped dirty bit, silently losing THP data
A pmd_modify() mask error since Linux 6.6 could free rewritten huge pages under reclaim, and Polars users hit it in production.
Arm64 adopts generic syscall entry in the Linux kernel
A long-running conversion brings AArch64 in line with x86 and RISC-V, shrinking arch-specific tracing code and unlocking shared syscall features.
util-linux 2.41.6 fixes three CVEs in mount, nsenter, unshare
The point release stops failed mount helpers from still running privileged post-mount hooks, closes a local TOCTOU on source paths, and seals fd leaks plus a leftover wall/write hostname injection.
Kernel makes page-table freeing RCU-safe on every architecture
Lorenzo Stoakes finishes the conversion so lockless RCU page-table walks become safe kernel-wide.
Linux TCP fixes race UAFs when sockets flip listen and disconnect
connect(AF_UNSPEC), listen(), and IPV6_ADDRFORM left request sockets and parent state that concurrent paths could free while still in use.
Linux net stack gains fwnode PCS API for external SerDes blocks
Phylink takes ownership of PCS selection as SoCs put coding sublayers outside the MAC, with Airoha AN7581 as the first in-tree consumer.
rtl8723bs WPS copy bug allows remote stack overflow on scan
A proposed fix for attacker-controlled beacon attributes still drew maintainer objections over correctness and testing.
IBM posts KVM series to run arm64 guests on s390 hosts
A seventh-round patch set wires arm64 KVM code into s390 via shared markers and a new SAE instruction for hardware-accelerated guests.
RISC-V IOMMU gains MSI remapping, default DMA-IOMMU, and VFIO
A redesigned MSI path lets 64-bit RISC-V translate interrupt targets like DMA, unlocking default IOMMU paging and userspace device assignment.
BPF plugs three NULL derefs in BTF type show paths
Key-less hash map dumps and bpf_snprintf_btf() on void or var types could oops the kernel; Jiayuan Chen restores rejections and safe placeholders.
cfg80211 validates WEXT IE buffers to stop OOB reads
A syzbot-found flaw let malformed wireless Information Elements crash the kernel on connect; the fix is rolling through stable trees.
Kernel clamps qdisc quantum paths that let admins soft-lock hosts
Eight traffic-control schedulers still allowed tiny quanta after setup, reopening a deficit-loop DoS under the qdisc lock.
Kernel fix breaks vmalloc livelock under memory pressure
A circular lock dependency in the vmap purge path could stall the whole system when reclaim and purge work collided.
DRM scheduler fix closes unprivileged GPU fence UAF read
A core lifetime bug let userspace read freed scheduler memory via exported fences in amdxdna, nouveau, and msm.
Confidential VMs force KVM to pick sides on attestation and trust
Arm CCA realms and TDX quote plumbing are no longer vendor demos; they are mainline ABI fights over roots of trust, hardware gaps, and how much attestation the hypervisor should own.
Kernel trusted-keys path hardens TPM1 seal and HMAC checks
Forged TPM 1.x replies could overflow a fixed-size blob buffer or skip response authentication entirely.
Linux kernel panics on GSO fragments after IP reassembly
CVE-2026-80590 lets an unprivileged user trigger a BUG_ON in skb_segment via tap or virtio paths that keep GSO metadata on defragmented packets.
tmpfs casefold option leaked Unicode maps, enabling local DoS
Unprivileged users could exhaust kernel memory by repeatedly setting the casefold mount option on tmpfs.
Kernel reverts IRQ guard switch after Syzbot finds nested lock hazards
Refcounted interrupt disable lands for safer nesting and Rust SpinLockIrq, but wiring it into scoped cleanup guards is rolled back until stronger tooling exists.
Kernel user_events fork path fixed for use-after-free
A failed memory allocation during process duplication could free tracing state still held by the parent.
Kernel patches close UDP port side channel in routing caches
Always creating exceptions for ICMP errors stops off-path attackers from probing connected UDP sockets after earlier defenses were bypassed.
Stable kernel USB hub change crashes Threadripper under ADB load
A 6.12 stable backport meant to wake nested USB3 devices is blamed for hard MCE resets when Android tooling hammers the root hub.
BPF cgroup link update fixed for stack out-of-bounds write
Replacement programs were matched only by type, so incompatible sock_addr and LSM hooks could clobber adjacent stack state.
Nova-core moves toward stable r000 NVIDIA GSP firmware ABI
An early-review Linux series would drop versioned GSP firmware names once the still-unreleased r000 blobs ship.
Kernel net maintainer flags LLM patches in PTP time-card series
Jakub Kicinski says AI-generated submissions are hurting review capacity as a seven-patch ptp_ocp series draws process and technical pushback.
ext4 moves buffered I/O onto iomap in 32-patch series
Zhang Yi’s v5 conversion drops buffer_head for regular-file buffered paths and reworks EOF zeroing so size updates cannot expose stale data.
Linux starts killing off the little-used x32 ABI
Maintainers will disable the config option first, with full removal planned after this year's final LTS kernel unless users object.
VFIO patches add CXL Type-2 accelerator passthrough for guests
A 27-patch series from NVIDIA lets VMs program virtual HDM decoders and resets while the host keeps physical memory decode.
Linux adds fwnode PCS API and dynamic phylink attach for external serdes
Christian Marangi’s v14 work gives PCS drivers a clock-style provider model and lets phylink gain or lose coding layers at runtime, with Airoha AN7581 as the first user.
Linux neighbour tables become per-network-namespace
ARP and ND tables move out of the global scope, so each netns can tune neighbour defaults and control paths need less global locking.
mlx5 VFIO selftest lands after four days of Claude-assisted coding
Jason Gunthorpe submitted a 10-patch series that brings ConnectX DMA and MSI coverage to the kernel VFIO tests, cut from the usual multi-month effort.
HP BIOS config driver gets heap overflow and OOB fixes
Nine patches harden hp-bioscfg against out-of-bounds memory access and broken ACPI attribute parsing on HP machines.
Linux 7.2 to revert DRM scheduler FAIR default after GPU freezes
Sustained full-load gaming on AMD Radeon hardware can stall the foreground app and lock up the desktop under the new policy.
Linux proxy execution gains optional sched_ext BPF support
Andrea Righi's series ends a build-time mutual exclusion so one kernel can ship both features and let BPF schedulers opt in at runtime.
Linux makes per-VMA locks unconditional across all configs
A Hansen/Baghdasaryan series drops architecture guards so binder and TCP paths can stop falling back to mmap_lock.
Linux kTLS adds TLS 1.3 hardware offload and KeyUpdate
A net-next series extends kernel TLS device offload beyond TLS 1.2, with full rekey support on capable Mellanox NICs.
Pahole gains Rust enum DWARF support and dwz alternate debug handling
Arnaldo Carvalho de Melo’s series stops Rust Option and Result types from collapsing to empty BTF structs and unblocks type loading on dwz-compressed debuginfo.
RISC-V IOMMU gains MSI remapping, unlocking DMA and VFIO
A 19-patch series from Qualcomm lets RISC-V translate device MSIs like DMA traffic and opens the door to PCIe device assignment in KVM guests.
Kernel debugfs string helper headed read-only after double-free
Greg Kroah-Hartman wants write support dropped rather than more locking after concurrent writers could free the same string twice.
Kernel buffer layer to stop marking good data stale on write failure
A 19-patch series stops clearing BH_Uptodate when metadata writes fail, fixing silent data loss and spurious warnings across multiple filesystems.
Incomplete nftables backport leaves UAF in Linux stable kernels
Omitted commits from a 2024 pipapo series leave use-after-free and double-free bugs in 6.6.y and older trees.
Arm CCA protected VMs advance in KVM review
Steven Price's 37-patch series brings realm guests to arm64 KVM, targeting RMM v2.0-bet2 under maintainer scrutiny.
Kernel staging maintainer will reject LLM-generated patches
Greg Kroah-Hartman says automated cleanups defeat the subsystem's role as a training ground for new developers.
KVM gains Arm CCA support for confidential Realm VMs
Steven Price’s 45-patch series wires Linux KVM to the Realm Management Monitor so hosts can run protected Arm guests.
Kernel RFC aims to drop PG_private for a new folio flag bit
Zi Yan’s series would free a scarce page-flag bit by treating a non-NULL private pointer as the sole signal that a page carries filesystem or driver state.
Linux mm gains ALLOC_UNMAPPED for direct-map-free pages
Brendan Jackman's v3 series lays allocator and mapping groundwork for guest_memfd isolation and Address Space Isolation.
BPF verifier fixes plug refcount_acquire holes for borrowed kptrs
Two bugs let CAP_BPF programs feed NULL or stale pointers into refcount paths that could crash the kernel.
Linux usbio driver fixed for slab overflows and I2C hang
Unchecked endpoint sizes and debug dumps left the Intel USB-to-I2C bridge open to memory corruption, hangs, and log leaks.
KVM nested SVM drops blanket TLB flushes with per-vCPU L2 ASIDs
Yosry Ahmed's series gives each nested guest its own ASID, matching VMX VPID practice and yielding 8-15% gains on recent AMD CPUs.
BPF and kprobe hooks may stop yielding to ftrace kill switch
An RFC would block silent disable of fentry, fexit, and ftrace kprobes; ftrace's maintainer instead floats retiring the switch entirely.
ARM posts arm64 patches for 128-bit page table entries
FEAT_D128 support would let Linux use the VMSAv9-128 translation regime on ARMv9.3 hardware.
Linux SCSI gains native multipath as dm-mpath alternative
John Garry’s v6 series groups ALUA-capable paths into multipath-aware SCSI disks with in-kernel failover and I/O policies.
Linux patchset unites proxy execution with sched_ext
Distributions can ship one kernel with both features and let BPF schedulers opt in at runtime.
Linux mm patchset unifies hot-page promotion for tiered memory
AMD's pghot v8 consolidates access tracking from hint faults and hardware samplers, then drives batched promotions via per-node kernel threads.
ext4 moves to drop inline data writes for regular files
An RFC series would deprecate the feature after years of bugs, syzbot hits, and at least eight CVEs, while keeping it for directories.
CAN BCM timer UAF patch rejected as already fixed
A reported RCU race in AF_CAN receive-op deletion was NAKed after the maintainer said mainline already closed it.
sched_ext and proxy execution no longer mutually exclusive
BPF schedulers can opt into handling mutex-blocked donors so one kernel can ship both features.
Kernel roundup: ptdump use-after-free fix, taskstats cpumask bug, RISC-V IOMMU MSI, and QCE removal fight
A memory-safety race in page-table dumping leads the week’s traffic, alongside a long-lived taskstats truncation, RISC-V IOMMU progress, and a push to delete a BROKEN Qualcomm crypto driver.
Kernel VLAN fix stops skb panics when toggling HW offload
Dynamic hard_header_len updates raced with lockless TX paths; macvlan-on-VLAN shows a related headroom gap.