Arm CCA in KVM, stable UAF, BPF and XDP fixes

Kernel traffic focused on Arm confidential computing support in KVM and several memory-safety fixes in networking and BPF. Stable backport gaps and a staging subsystem policy note also appeared.

Arm CCA protected VMs for KVM

Successive revisions of the arm64 KVM series for Arm Confidential Compute Architecture reached v15 (37 patches) and then v16 (45 patches), remaining under active maintainer review. The work adds Realm support, an RMI firmware layer, and handling for protected virtual machines. The series matters for anyone building confidential computing stacks on arm64 KVM.

nft_set_pipapo UAF in stable backports

A report identifies missing backport commits in the 5.15.y, 6.1.y and 6.6.y stable trees that leave a use-after-free and double-free in nft_set_pipapo. The flaw arises from a stranded garbage-collection batch tied to commit 9df95785d3d8. Operators of those long-term kernels face an incomplete fix until the remaining commits land.

BPF refcount_acquire verifier bugs

A two-patch BPF series corrects verifier handling of bpf_refcount_acquire on borrowed RCU kptrs. The bugs permitted NULL returns and stale PTR_UNTRUSTED pointers. The changes close paths that could undermine reference-counting safety for BPF programs.

AF_XDP TX metadata race hardening

Six patches harden AF_XDP TX metadata validation against races that produced KASAN out-of-bounds reads and TOCTOU conditions. The issues stemmed from undersized or concurrently modified metadata shared with userspace. The fixes protect high-performance packet paths that rely on XDP sockets.

LLM cleanups barred from staging

Greg Kroah-Hartman stated that LLM-generated cleanup patches will not be accepted in drivers/staging/. Such patches undermine the subsystem's role as a place for new developers to learn. The note sets an explicit policy boundary for future contributions there.

IPsec and XFRM security fixes

Steffen Klassert submitted an eight-patch pull request containing XFRM and IPsec fixes. The set addresses an out-of-bounds write, use-after-free, double-free, deadlock and NULL dereference. The changes close multiple memory-safety and stability holes in the IPsec stack.

KVM clock cleanup continues

David Woodhouse posted v7 of a 36-patch series that cleans up KVM clock handling. The work fixes imprecision, discontinuities and migration problems, removes pvclock_gtod_data, and introduces TSC and guest clock APIs. More reliable guest timekeeping is the practical result for KVM users.