oops
Kernel & Low-Level desk
Kernel fixes RCU pathwalk use-after-frees across several filesystems
Christian Brauner patches ext4, ntfs3, tracefs, casefold, and related code so superblock data outlives concurrent RCU lookups after lazy unmount.
BPF adds unwind landing pads for resource cleanup
Kernel support for compiler-emitted cleanup tables would let bpf_unwind() run Drop-style release instead of discarding frames.
Linux shmem race corrupts page cache during hole punch
Fault-around can re-map large folios mid-punch, leaving stale mappings and exact 512-page RSS imbalances on production hosts.
KVM nSVM work assigns L2 per-vCPU ASIDs to cut TLB flushes
Yosry Ahmed's series drops dynamic ASID allocation on modern AMD CPUs and brings nested SVM closer to VMX VPID handling.
Kernel closes virtio GSO bypass that skipped flow dissection
Untrusted GSO frames without NEEDS_CSUM could evade checks, mis-place transport headers, and trigger out-of-bounds reads, especially above 64 KB.
BPF tcp_ops gains AutoLOWAT hooks to cut RPC wakeups
Google's production TCP receive low-water technique lands as opt-in bpf_tcp_ops callbacks and per-socket flags.
Linux mm drops VM_SPECIAL for explicit VMA behaviour predicates
Lorenzo Stoakes's 38-patch series replaces an overloaded flag mask with clear rules about which mappings core mm owns and manages.
RFC turns AF_XDP UMEM into a page-pool memory provider
Björn Töpel proposes letting zero-copy sockets supply RX buffers through page_pool so modern drivers stop maintaining a second receive path.
mm maintainer NAKs THP compaction series over undisclosed LLM use
Lorenzo Stoakes rejected patches aimed at costly async compaction retries, citing kernel rules on generated contributions and a flood of deep subsystem work from a brand-new contributor.
Linux IPsec fixes AES-GCM nonce reuse in ESP offload paths
A seven-part series corrects sequence handling so GSO and hardware offload no longer recycle GCM nonces or break ESN authentication.
Kernel kallsyms lookups sped up 7x for BPF tracing loads
Jim Cromie's three-patch series cuts bulk symbol attach from hundreds of milliseconds to tens, after production stalls in fleet observability tools.
Stable 6.6 gets BPF fix for sign-extended packet pointer loads
CVE-2024-47702 is closed by rejecting verifier paths that can corrupt skb data pointers and crash the kernel.
BPF gains exception cleanup pads so Rust Drop can unwind safely
A 22-patch bpf-next series adds bpf_unwind(), verifier and x86 JIT support so frames can release locks and references instead of being discarded.
Kernel objpool race can double-hand or drop objects under NMI
A nested push from kretprobe NMI context could publish past an unfinished entry, letting another CPU pop a NULL or stale pointer.
Stable kernels still exposed to CVE-2025-37964 after bad backport
Misordered TLB fix in Linux 6.1, 6.6, and 6.12 left processes able to run with stale translations.
Kernel gains Rust SPDM requester for untrusted device auth
Alistair Francis posts a standalone Rust SPDM stack and PCIe CMA TSM path so the kernel can verify devices before trusting them.
Kernel moves x86 and RISC-V AES acceleration into crypto library
Hardware-optimized AES modes become the default path for library callers, ending years of duplicated glue and disabled-by-default speedups.
BPF typed arenas RFC seeks trusted kptrs without lifetime hell
Kumar Kartikeya Dwivedi proposes kernel-only arena objects the verifier can trust; an automated review immediately flagged critical memory-safety bugs in the draft.
Debugfs string I/O races fixed after KASAN double-free repro
Concurrent readers and writers on debugfs string files could hit use-after-free and double-free without proper RCU and locking.
BPF landing pads let unwinds run cleanup for Rust panics
Kernel and libbpf support for compiler-emitted cleanup tables lets bpf_unwind() release locks and Drop-owned state instead of discarding frames.
BPF series makes vmlinux BTF an on-demand module
Jay Wang’s patches let distributions keep CO-RE and related features without forcing roughly 5.4 MB of type data into every system’s RAM from boot.
Linux unifies RCU-safe page table freeing across all architectures
A twelve-patch series from Lorenzo Stoakes finishes years of work so every architecture defers userspace page-table teardown until after an RCU grace period.
RISC-V gains IOMMU MSI remapping, unlocking DMA and VFIO by default
Andrew Jones's v6 series maps IMSIC MSI targets like DMA, letting 64-bit RISC-V turn on IOMMU_DMA, iommufd, and device assignment.
Linux mm drops VM_SPECIAL for explicit VMA flag semantics
Lorenzo Stoakes's large memory-management series replaces overloaded special flags with behaviour predicates and harder driver checks.
BPF stack limit poised to rise from 512 bytes to 2 KiB
A patch series for bpf-next would give JITed programs on x86-64 and arm64 four times the stack while keeping verifier memory in check.
BPF stack limit rises to 2KiB on x86-64 and arm64 JITs
Verifier bookkeeping is made dynamic so larger frames do not inflate memory cost for every program.
BPF gains callx for indirect subprogram calls
Alexei Starovoitov’s verifier, JIT, and libbpf work lets programs invoke static functions through pointers in tables and vtables.
BPF verifier gains widening path for long bounded loops
Alexei Starovoitov’s series stops the verifier from walking every iteration of simple loops, cutting work sharply while keeping today’s accepted programs valid.
Kernel quirk stops AMD PCIe misconfig from corrupting storage DMA
BIOS-enabled enhanced atomics on some AMD root ports were mangling 64-bit DMA, hitting SATA and NVMe drives on desktop systems.
Kbuild overhaul claims up to 90% faster no-op kernel builds
Lorenzo Stoakes’ 22-patch series attacks single-threaded bottlenecks from toolchain probes and modpost through objtool and module finalisation.
BPF exception unwinds gain cleanup pads for Rust Drop
Yonghong Song’s bpf-next series makes bpf_throw() run compiler-emitted landing pads so resource-owning frames can release locks and values on the way out.
sched_ext and proxy execution set to share one Linux kernel
Andrea Righi’s v14 series drops the build-time ban so distributions can ship both features and let BPF schedulers opt in at runtime.
Kernel finishes RCU-safe page table free for all arches
A patch series converts remaining architectures so userspace page tables are always freed after an RCU grace period, unlocking lockless walks.
Kernel fixes UAF in OVS and act_ct conntrack helpers
Unconfirmed entries could leave stale expectation pointers after extension realloc, reported against Open vSwitch and TC conntrack.
BPF verifier patch scopes callback args after kernel memory leaks
A proposed frame-owned reference type would stop helpers from handing programs pointers that outlive the call, after reports of stack exposure via ringbuf drain and array map iteration.
BPF gains indirect subprogram calls via new callx instruction
Alexei Starovoitov’s series lets the verifier and JITs accept LLVM’s function-pointer calls, unlocking vtables and dispatch tables in BPF C and Rust.
Claude-written mlx5 driver proposed for Linux VFIO selftests
Jason Gunthorpe says an AI produced a ConnectX selftest driver in days that once took months of human work.
BPF exception cleanups unlock Rust Drop on bpf_throw() unwind
The kernel and libbpf now run compiler-emitted landing pads when bpf_throw() walks the stack, so frames can release RCU locks and other owned resources.
IOMMU live-update patches aim to keep VM DMA mappings across kexec
Google's v5 series preserves Intel VT-d and iommufd domain state so assigned devices can survive a kernel live update without dropping translations.
RFC keeps KVM guests running across host kexec live updates
Pasha Tatashin’s early OrphanVM proof of concept preserves physical CPUs so vCPUs keep executing while the host kernel is replaced.
Kernel THP split path split into anon and file helpers
Kairui Song’s cleanup series separates mixed folio-split logic so swap-cache restrictions can be lifted later.
Linux arm64 drops remaining big-endian kernel support
Will Deacon's cleanup series removes dead CONFIG_CPU_BIG_ENDIAN code after the option was marked BROKEN.
Kernel series keeps mTHP on when PMD huge pages are missing
Overloaded THP availability checks no longer wipe out multi-size transparent huge pages on CPUs without PMD leaves.
Linux TLS stack gains TLS 1.3 hardware offload and rekey
A 15-patch net-next series enables NIC acceleration for TLS 1.3, including KeyUpdate, starting with Mellanox ConnectX-6 Dx and newer.
Kbuild series targets serial bottlenecks for far faster kernel builds
Lorenzo Stoakes’s v3 patches claim up to 36% faster full allmodconfig builds, roughly 70% faster incrementals, and about 90% faster no-op rebuilds.
Linux networking gains fwnode PCS provider API for external SerDes
Phylink takes ownership of PCS selection and hotplug, ending ad-hoc MAC driver wiring as external 10G blocks proliferate.
Claude builds mlx5 VFIO selftest driver in four days
Jason Gunthorpe submitted a ConnectX selftest series largely generated by Anthropic's model, cutting a job that usually takes months down to about a week.
Linux mm series keeps anonymous THPs intact across swap
Usama Arif's 29-patch work adds PMD-level swap entries so huge pages need not split on reclaim, with roughly 4x throughput on a swap-heavy benchmark.
LTS kernels still lack AF_UNIX slab UAF fix for CVE-2026-80521
An unprivileged SCM_RIGHTS path can hit a dangling pointer in the Unix socket garbage collector on four supported stable lines.
Rust PCI drivers gain SR-IOV with typed PF data sharing
A kernel series lets Rust physical-function drivers publish lifetime-checked payloads that both Rust and C virtual-function drivers can borrow safely.
AMD posts Linux support for hardware-accelerated vIOMMU
Partial AMD IOMMU virtualization lands on IOMMUFD, offloading guest command, event, and PPR log work from the hypervisor.
BPF and LSM maintainers clash over Landlock policy kfuncs
A third try at letting BPF apply userspace Landlock rulesets at exec hits the same wall: where kfuncs may live, and whether BPF should call into Landlock at all.
BPF gains by-value struct and __int128 argument support
A verifier and JIT series lets global functions and kfuncs take small scalar aggregates without the old rejections and register miscounts.
Axboe RFC: io_uring hands off thread identity on actual block
Instead of always punting blockable ops to io-wq, the series runs them inline and migrates only the user-visible identity if the submitter sleeps.
KVM guest_memfd in-place conversion aims at Linux 7.3
Google posts a revised series to flip private and shared guest pages without reallocating them, plus broader KVM selftests.
Page allocator tweak restores 161% PostgreSQL write throughput
Costly high-order folio attempts that already had smaller-order fallbacks were still paying for full direct compaction under fragmentation.
RFC lets Tasks RCU treat ordinary preemption as quiescent
Josef Bacik proposes trampoline nesting so PREEMPT_LAZY kernels stop stalling BPF and kprobe teardown behind long-running kthreads.
Kernel module loader left arch code open to bad relocation indexes
Malformed modules could crash ARM, ARM64, LoongArch, PA-RISC, and RISC-V before common validation ran.
eBPF verifier bug report flags incomplete register reset on errors
A researcher says invariant-violation recovery can leave register linkage intact, risking a verifier bypass; maintainers want a normal patch and a reproducer.
AI-written mlx5 driver lands in VFIO selftests in a week
Jason Gunthorpe used Claude to remix ConnectX DMA loopback support into kernel VFIO tests, cutting a month-plus job to days.
Rust SPDM requester proposed for Linux device authentication
Alistair Francis aims the smallest upstream SPDM stack at untrusted PCIe and related devices, with CMA wired through the TSM path.
Kbuild series slashes kernel build times by up to 36%
Lorenzo Stoakes targets single-threaded make, modpost, objtool, and Rust bottlenecks that dominate large and incremental builds.
Linux hid-asus gains full ROG Ally handheld support
Denis Benato's multi-year series lands gamepad tuning, force feedback, and sleep recovery for ASUS's Steam Deck rival.
BPF maintainer nacks pluggable RV monitors for Linux
Alexei Starovoitov rejects an RFC to load runtime-verification monitors via BPF; Steven Rostedt disputes the nack's scope.
Linus rejects kernel workaround for sparse bitwise warnings
Torvalds NAK'd a _Generic rewrite of is_signed_type() and told developers to fix sparse instead of stripping __bitwise from trace fields.
DRM scheduler core plugs fence timeline use-after-free
Unprivileged userspace could read freed GPU scheduler memory via timeline name queries on amdxdna, nouveau, and msm.
Microsoft proposes LVBS secure kernel for Linux on Hyper-V
An RFC series would let Hyper-V guests boot a small trusted kernel in VTL1 beside the normal OS, laying groundwork for Virtualization-Based Security on Linux.
Linux qdiscs clamp quantum paths that let namespaces soft-lock the host
A follow-up series closes change-path and missed-qdisc holes that restored multi-billion-iteration deficit spins under the scheduler lock.
BTF patches aim to let BPF tracers reach inlined functions
Alan Maguire proposes compact location metadata so kprobes can recover parameters at inline sites without ballooning kernel BTF.
Linux gains initial USB4 support on Apple M1, M2, and M3
A mainline patch series brings first Thunderbolt host-router bring-up to Apple Silicon, limited for now to XDomain links and USB3 tunnels.
Linux makes per-VMA locks unconditional on all configs
The change lets binder and TCP drop mmap_lock fallbacks, and Andrew Morton has queued the series for testing.
Linus Torvalds NAKs SCTP sysctl rewrite over unreadable macros
Alexey Gladkov’s RFC to replace per-namespace table cloning with sysctl_field descriptors is rejected as visually illegible, type-unsafe noise.
BPF series adds dedicated signing keyring and ML-DSA support
Daniel Borkmann's v2 patches give operators a BPF-scoped trust root for signed program loads and teach bpftool post-quantum signatures.
Linux virtual swap decouples zswap pages from disk slots
Nhat Pham's v4 series adds a persistent virtual swap device so compressed and zero-filled pages no longer reserve physical swap capacity.
Meta's 57-patch THP collapse rewrite meets kernel pushback
A migration-based engine aimed at mTHP on large base pages is told to land smaller foundations first, while AI-polished list replies draw separate fire.
Kernel race after non-leader exec frees POSIX timer on signal list
Lockless pending-signal cleanup can race with timer delivery when execve swaps thread IDs, leaving a use-after-free path.
BPF gains dedicated signing keyring and ML-DSA support
Borkmann's bpf-next series adds a BPF-scoped trust anchor for signed program loads and proves the path works with post-quantum keys.
Kernel fix stops tasks hanging forever on muxed I/O regions
A 16-year-old lost-wakeup race left processes unkillable after brief SMBus and similar contention, reachable from ordinary sensor reads.
Linux gains async device shutdown to slash reboot times
Opt-in parallel teardown can cut multi-minute waits to under a minute on systems with slow NVMe drives.
RISC-V IOMMU series unlocks MSI remap, DMA, and VFIO assign
Andrew Jones posts v4 work to translate device MSIs through the IOMMU, opening default IOMMU_DMA and userspace PCIe assignment on 64-bit RISC-V.
Kernel clamps qdisc quantum to stop lockups from huge MTUs
Overflows in fq, fq_codel, fq_pie, hhf, and sfq could hang dequeue loops or NULL-deref on drop.
Linux swap faults stop spinning forever on bad entries
A Meta engineer’s patches rate-limit the log spam and turn permanent swap PTE corruption into SIGBUS instead of an infinite retry.
BPF gains global per-CPU variables in a .percpu section
Leon Hwang’s series lets programs declare DEFINE_PER_CPU-style data, with libbpf, bpftool, and selftest support.
TDX quote buffer patch stalls over attestation design fight
A guest-side fix for growing attestation blobs reopened whether Intel TDX quotes belong in KVM or the host driver.
BPF verifier errors redesigned for source context and causal history
A 16-patch series reworks how the Linux kernel explains rejected eBPF programs, adding categorized safety reports instead of terse log lines alone.
IBM posts arm-on-s390 KVM series for AArch64 guests on mainframes
A sixth revision would let s390 hosts run KVM-accelerated ARM virtual machines by sharing selected arm64 KVM code and shipping a second KVM module.
Linux disables arm64 in-kernel BTI on Clang 21 over livepatch crash
A Clang 21 change that drops landing pads on static functions breaks PLT branches from livepatch modules, so the kernel turns BTI off until the toolchain is fixed.
Linux 6.6.149 ships broken Safe-RET security backport
A config rename left the CVE-2026-68480 fix inert on the long-term 6.6 series until corrected patches land.
Kernel stops treating failed buffer writes as stale memory
A 21-patch series stops clearing BH_Uptodate on metadata write failure so filesystems keep the data they meant to write and report errors via BH_Write_EIO instead.
BPF stack helpers race fixed with preemption disable
A preemptible window let concurrent tasks inflate callchain length and overwrite caller buffers via bpf_get_stack and bpf_get_stackid.
BPF gains 16-byte aggregate returns via R0:R2 pair
Kernel verifier and JITs learn LLVM 23's convention so subprograms and kfuncs can return __int128 and small structs by value.
Linus rejects per-CPU page tables as general MM design
ARM64 this_cpu_* optimization RFC hits a hard architectural wall over divergent kernel page tables.
Kernel fix corrects wrong TLB flush in page table reclaim
Direct reclaim after MADV_DONTNEED could free a page table while leaving a stale paging-structure cache entry.
BPF stack helpers race fixed to stop out-of-bounds writes
Preemptible programs could reuse a per-CPU callchain buffer and inflate the copy length past the caller's buffer.
8250 serial console conversion to NBCON queued again after earlier revert
John Ogness's v11 series restores non-blocking console support for the widely used 8250 UART driver after underlying bugs blocked the first attempt.
ksmbd ACL packing fixed to block malformed DACLs and OOB reads
Authenticated clients could force undersized ACL headers or heap out-of-bounds reads via crafted security descriptors.
AF_XDP TX metadata hardened against OOB reads and races
Stanislav Fomichev posts fixes after a Microsoft report of KASAN out-of-bounds reads and TOCTOU flaws in shared TX metadata.
KVM clock cleanup targets drift, jumps, and imprecise migration
David Woodhouse’s v7 series fixes long-standing guest timekeeping bugs and adds APIs so live migration can preserve the TSC-to-kvmclock relationship.
Hildenbrand rejects van Riel mm series as AI-generated slop
A per-VMA lock rework aimed at unsticking /proc monitoring on large multi-threaded hosts draws a hard line on Claude-assisted patches.
DMAengine moves client completions off private tasklets
A 64-patch series centralizes per-channel bottom-half handling on a shared WQ_BH workqueue across virt-dma and more than a dozen drivers.