Arm CCA in KVM, mm flags, pahole Rust, and kernel CVEs

Kernel traffic on 2026-08-11 was dominated by large patch series for Arm confidential computing in KVM and unmapped allocation controls, plus pahole work for Rust debug info. Several CVEs landed in the stable announcements, and maintainers disputed a hot-page promotion design for CXL tiering.

Arm CCA Realm support for KVM reaches v16

A 45-patch series at version 16 adds Arm Confidential Compute Architecture support to KVM, including an RMI firmware layer and protected VM handling for Realms. Multiple participants on linux-kernel reviewed the stack. arm64 virtualization developers should watch it because it extends KVM toward confidential guest isolation on CCA hardware.

pahole adds Rust DWARF tags and dwz alternate files

Arnaldo Carvalho de Melo posted a 12-patch pahole series that teaches DWARF about Rust variant_parts and enums and improves references to dwz alternate debug files. Rust-for-Linux maintainers joined the thread on BTF mapping implications. Kernel and BPF tooling users care because richer Rust debug info feeds more accurate BTF and observability.

ALSA timer blocks re-entrant instance callbacks

CVE-2026-68200 fixes an ALSA utimer use-after-free in which concurrent TRIGGER ioctls could re-enter a callback still running on an instance. The change reached the kernel stable tree. Distributors and audio stack maintainers need the fix to close the race on timer instances.

ALLOC_UNMAPPED and AS_NO_DIRECT_MAP for guest_memfd

Version 3 of a 26-patch mm series introduces ALLOC_UNMAPPED and AS_NO_DIRECT_MAP to manage the direct map for guest_memfd and ASI workloads. Discussion on linux-kernel covered allocation and mapping edge cases. Confidential computing and guest memory developers gain explicit control over whether pages appear in the linear map.

Proxy execution made compatible with sched_ext

A v11 patchset removes the build-time mutual exclusion between SCHED_PROXY_EXEC and SCHED_CLASS_EXT, adding hooks and SCX_OPS_ENQ_BLOCKED so proxy donors work with sched_ext. The series targets the sched_ext/for-7.3 branch. Scheduler developers can now combine proxy execution with extensible scheduling classes without a compile-time choice.

Exec arg copy fixes unsigned counter wrap

CVE-2026-68187 corrects an unsigned loop counter wrap in transfer_args_to_stack() during exec argument copying that could kmap arbitrary memory. The announcement went to linux-cve-announce. Process startup paths need the fix to prevent the wrap-driven mapping abuse.

ksmbd defers prior session destroy until after NTLM

CVE-2026-68130 changes ksmbd so destroy_previous_session() runs only after NTLM authentication succeeds rather than before validation. The flaw allowed pre-auth session teardown. ksmbd operators should take the update to close the authentication ordering window.

Hot-page promotion infrastructure draws maintainer pushback

Version 8 of the pghot hot-page tracking and promotion series, aimed at CXL memory tiering, met heated debate against DAMON and existing NUMA balancing. Seven participants on linux-kernel contested scope and overlap. mm and CXL tiering developers should track whether a dedicated subsystem is accepted or folded into current tools.