Kernel: Arm CCA in KVM, stable UAFs, BPF and mm fixes

Kernel traffic on 2026-08-06 centered on Arm confidential computing support in KVM plus security fixes spanning netfilter backports, debugfs, BPF stack maps, and hugetlb. Memory management proposals for hot-page promotion and direct-map removal advanced amid maintainer debate.

Arm CCA Realm support in KVM reaches v16

A 45-patch series at version 16 adds Arm Confidential Compute Architecture support to KVM, including an RMI firmware layer and protected VM handling for Realms. Seven participants iterated on the proposal across 59 messages. The work matters to developers building confidential virtual machines on Arm hardware.

Incomplete stable backports leave nft_set_pipapo UAF

Two participants on netdev noted that missing backport commits in the 5.15.y, 6.1.y, and 6.6.y trees leave a use-after-free and double-free from a stranded GC batch in nft_set_pipapo. The gap traces to incomplete application of commit 9df95785d3d8. Stable-kernel users running netfilter sets remain exposed until the fixes land.

debugfs_create_str writers serialized

A patch serializes concurrent writers in debugfs_create_str to close a double-free. The maintainer suggested making the helper read-only as a simpler alternative. The change removes a local privilege-escalation path in debugfs.

BPF stack map preemption race closed

A 12-patch series disables preemption inside BPF stack map code, eliminating a race that permitted out-of-bounds writes through bpf_get_stack and related helpers. Five participants discussed the set before it merged to bpf-next. The fix hardens stack-trace collection used by many tracing and profiling tools.

Hot-page promotion infrastructure debated

Version 8 of the pghot hot-page tracking and promotion series for CXL tiering drew 30 messages from six participants. Maintainers disputed its value relative to DAMON and existing NUMA balancing. The outcome will shape how tiered-memory systems promote pages.

NULL nodemask crash in hugetlb CMA

A patch corrects a null nodemask dereference in hugetlb_cma_alloc_frozen_folio. Unprivileged users could trigger a kernel panic by allocating gigantic hugepages on NUMA systems with CMA. The fix closes a denial-of-service vector in huge-page setup.

KVM clock cleanup series at v7

David Woodhouse posted a 36-patch series that removes pvclock_gtod_data, adds TSC and guest clock APIs, and addresses imprecision, discontinuities, and migration problems. Two participants refined the set across 45 messages. Virtualization stacks gain more reliable guest timekeeping.

ALLOC_UNMAPPED and AS_NO_DIRECT_MAP added

A 26-patch series at version 3 introduces ALLOC_UNMAPPED and AS_NO_DIRECT_MAP to enable direct-map removal for guest_memfd and ASI. Five participants reviewed the changes. The infrastructure advances memory isolation for confidential computing and guest private memory.