Private NUMA nodes, guest_memfd, SEV/SNP stable fix

Kernel traffic focused on memory isolation for devices and confidential VMs, with large revision cycles on private NUMA nodes and guest_memfd plus a stable SEV/SNP init fix. BPF return and metadata work, dma-buf and kdump secret hygiene, and x86 FPU signal-frame portability rounded out the day.

Private memory NUMA nodes reach v5

A 36-patch v5 series on linux-kernel proposes N_MEMORY_PRIVATE nodes so device memory stays default-isolated while remaining eligible for opt-in mm services. Nine participants worked through the design across 67 messages. Heterogeneous-memory and device-isolation users should track how the kernel will expose and manage these nodes.

guest_memfd in-place conversion at v10

A 41-patch v10 series adds in-place private/shared conversion to guest_memfd for KVM confidential computing VMs. Eleven participants debated the conversion path and CoCo integration over more than a hundred messages. Operators of confidential guests care because state changes can proceed without full remapping overhead.

SEV/SNP platform init restored on 6.12.y

A four-patch series queued for stable 6.12.y restores a missing SEV/SNP platform-init dependency in crypto ccp and KVM SVM and includes two related bugfixes. A prior commit had left initialization broken and crashed SNP guests. AMD SEV/SNP hosts on that stable line need the backport for reliable confidential guests.

BPF aggregate returns up to 16 bytes

A ten-patch v6 series for bpf-next extends the verifier, JIT, and BTF so subprograms and kfuncs can return aggregates up to 16 bytes via R0:R2. Three participants reviewed the approach on the BPF list. Authors of richer BPF helpers gain a cleaner multi-value return path.

Persistent BPF skb metadata extensions

Fourteen net-next patches propose an skb extension that carries BPF metadata through tunnel and veth scrubbing, with selftests. Three participants discussed keeping metadata attached where scrubbing currently drops it. Networking BPF programs that depend on end-to-end metadata are the direct audience.

dma-buf fd leak after failed copy_to_user

A two-patch v3 series fixes an fd leak and race in dma-buf when copy_to_user fails after fd_install by reserving the fd first and installing only on success. Six participants examined the subtle lifetime issue on linux-kernel. Shared dma-buf exporters and userspace avoid a hard-to-spot resource leak.

CRASH_WIPE_SECRETS before kdump

A 13-patch v2 series introduces CONFIG_CRASH_WIPE_SECRETS to zero selected secret material in crypto and key subsystems before kdump. Six participants refined the former CRASH_ZEROIZE approach. Deployments that collect crash dumps can reduce secret exposure in captured images.

x86 FPU signal-frame portability restored

An eight-patch v4 series restores x86 FPU signal-frame portability across heterogeneous CPUs, adds selftests, and includes a bounds-check fix aimed at CRIU-style migration. The work was posted as a single-author series on linux-kernel. Checkpoint and live-migration tools that move processes between different x86 CPUs depend on stable frames.