Arm CCA for KVM, buffer errors, and memory patches

Kernel traffic focused on Arm confidential computing in KVM, buffer write-error semantics, and multiple memory-management proposals. A stable release also carried a broken security backport.

Arm CCA Realm support for KVM reaches v16

A 45-patch series at version 16 adds Arm Confidential Compute Architecture Realm support to KVM, including an RMI firmware layer and protected VM handling. The work continues long-running efforts to bring confidential virtualization to Arm hosts. Developers building or reviewing confidential VMs on arm64 should track the series.

Buffer layer stops clearing BH_Uptodate on write failure

A 22-patch series changes buffer write-error handling so BH_Uptodate is no longer cleared on failure and filesystems switch to BH_Write_EIO. The change aims for more consistent error state across the buffer cache. Filesystem and block-layer maintainers need to evaluate the flag transition.

Linux 6.6.149 ships broken Safe-RET backport

Stable kernel 6.6.149 included a broken backport of the x86 Safe-RET mitigation for CVE-2026-68480 caused by a config rename. The defective backport undermines the intended protection on that branch. Users of the 6.6 stable series should watch for a corrective update.

Hot-page promotion infrastructure draws maintainer debate

Version 8 of the pghot hot-page tracking and promotion subsystem for CXL tiering prompted heated discussion among maintainers over its relationship to DAMON and existing NUMA balancing. The exchange centers on whether a new promotion path is justified. Memory-management developers working on tiered memory will want the arguments.

ALLOC_UNMAPPED and direct-map management added

A 26-patch series at v3 introduces ALLOC_UNMAPPED and AS_NO_DIRECT_MAP flags to control direct-map presence for guest_memfd and ASI use cases. The patches give finer control over whether pages appear in the kernel direct map. KVM and mm contributors targeting protected guest memory should review the interface.

Proxy execution made compatible with sched_ext

A v10 patchset removes the build-time exclusion between proxy execution and sched_ext, adding the necessary hooks and context-tracking fixes. The two features can now be built and used together. Scheduler developers following extensible scheduling will care about the integration.

Null nodemask dereference fixed in hugetlb CMA

A patch corrects a null nodemask dereference in hugetlb_cma_alloc_frozen_folio that allowed unprivileged users to panic the kernel via gigantic hugepage allocation on NUMA-plus-CMA configurations. The bug is a local denial-of-service vector. Systems enabling gigantic hugepages with CMA should take the fix.

guest_memfd in-place conversion support at v9

A 41-patch series at version 9 adds in-place private-to-shared conversion to KVM guest_memfd and is under active review by virt maintainers. The work reduces the cost of changing memory visibility for confidential guests. KVM developers handling guest private memory will want to follow the review.