Kernel bounds fixes, async shutdown, CXL passthrough

Security patches addressing out-of-bounds writes and integer overflows led kernel traffic, spanning BPF cgroup links, traffic control, USB gadgets, and packet sockets. Parallel work advanced asynchronous device shutdown, CXL Type-2 VFIO passthrough, and the 8250 nbcon console conversion.

BPF cgroup link stack out-of-bounds fix

A bpf-next patch fixes a stack out-of-bounds write during cgroup link update. The change validates replacement programs against the attach type before applying them. BPF users attaching programs to cgroups should treat the correction as a memory-safety fix.

Traffic control quantum and backlog overflows

A netdev v2 patch fixes integer overflows in fq, fq_codel, fq_pie, hhf, and sfq. Huge MTUs or crafted TCA_STAB values could produce soft lockups or NULL dereferences. The issue matters on hosts that expose traffic-control configuration to untrusted or automated inputs.

USB gadget f_printer GET_DEVICE_ID OOB write

A USB gadget patch prevents a one-byte out-of-bounds write in f_printer GET_DEVICE_ID handling. The bug appears when the configfs pnp_string sits at maximum length. Gadget and embedded maintainers should apply it to close a straightforward memory corruption path.

Asynchronous device shutdown

Version 20 of a patchset adds opt-in asynchronous device shutdown so slow devices can power down in parallel. On NVMe-heavy systems the change can reduce reboot time from minutes to seconds. Operators running large storage fleets have a direct latency reason to watch the series.

VFIO CXL Type-2 device passthrough

A 27-patch v4 series adds VFIO/PCI passthrough support for CXL Type-2 devices. Guests gain the ability to drive virtual HDM decoders and device resets. The work opens virtualization paths for emerging CXL memory and accelerator hardware.

8250 UART conversion to NBCON

Version 11 of the 8250 nbcon console conversion was reposted after an earlier revert. Greg KH has queued the series. Moving the common 8250 driver onto non-blocking console infrastructure affects serial console reliability under load.

Muxed resource allocator lost-wakeup race

A resource-core patch fixes a lost-wakeup race when tasks wait for a muxed region. The race can leave waiters permanently uninterruptible. Drivers that share muxed I/O or memory regions benefit from the hang prevention.

Packet socket hard_header_len race (CVE-2026-74582)

A kernel CVE fix addresses a race in packet_snd() that allowed an out-of-bounds write when hard_header_len changed during skb allocation. Non-ring send paths now use a consistent hard_header_len value. Distributors and packet-socket users should track backports under the assigned CVE.