Kernel networking fixes and CoCo memory work

Kernel and low-level traffic on 2026-08-20 mixed networking subsystem hardening with continued confidential-computing interface work. Security fixes for packet schedulers, nfsd, Xen grant devices, and a staging wireless driver sat alongside larger series for fwnode PCS and guest_memfd conversion.

fwnode PCS provider API at v14

A twelve-patch series reaches v14 with a fwnode PCS provider-consumer API for the networking stack. The same work adds dynamic PCS attach and detach handling inside phylink. Developers integrating firmware-node descriptions of physical coding sublayers need the revised interface.

Packet scheduler overflow fixes

A net patch corrects integer overflows affecting quantum and backlog accounting in fq, fq_codel, fq_pie, hhf, and sfq. Huge MTUs or crafted TCA_STAB values could previously trigger soft lockups or NULL dereferences. The change closes a denial-of-service path in traffic-control configuration.

Dynamic TDX guest quote buffers

A four-patch TDX guest series makes quote buffer size dynamic. The revision prompted KVM and Intel discussion of attestation scoping, DICE, and migration uAPI design. Confidential-VM attestation work now hinges on these buffer-lifetime and migration questions.

Xen gntdev private mapping lock-down

A gntdev patch blocks mprotect from upgrading private Xen mappings to writable. The change matches earlier DRM fixes for copy-on-write bugs on foreign pages. It prevents unintended write access to grant-mapped memory.

nfsd DRC slot use-after-free

An nfsd patch fixes a use-after-free of a DRC slot inside nfsd4_sequence. A malicious NFSv4.1 client can trigger the bug. The AI-assisted report is targeted at stable trees.

memcg v1 soft limit removal

A nine-patch series removes the deprecated v1 memcg soft-limit reclaim path, unused since 6.12. The same change clears a syzbot MGLRU warning. Andrew Morton took the series as a 7.4 hotfix.

guest_memfd in-place conversion

Version 10 of a forty-one-patch set adds in-place private-to-shared conversion for guest_memfd. The work supports KVM confidential-computing VMs. The high message volume reflects unfinished CoCo memory-model design.

rtl8723bs protected-frame checks

A staging patch for rtl8723bs adds length and NULL checks in the RX decrypt path. Short protected frames could previously cause out-of-bounds access or use-after-free. The hardening applies to the remaining Realtek staging driver.