Kernel UAF, BPF verifier, and driver disputes

Security-related fixes dominated the day's kernel traffic, from a page-table use-after-free race to a BPF verifier backport and a taskstats truncation bug. Separate threads covered a heated dispute over removing a broken crypto driver, plus proposals for seccomp TOCTOU hardening and RISC-V IOMMU support.

mm ptdump/vmap UAF race fixed

A five-patch mm-hotfixes series addresses a use-after-free caused by a race between ptdump and vmap or CPA page-table freeing. The fix serializes the paths with init_mm mmap locking. The change matters for anyone relying on page-table dumping or concurrent virtual mappings under memory pressure.

BPF ld_abs/ind verifier fix backported

A two-patch series targets stable branches 6.6.y, 6.12.y and 6.18.y to backport the CVE-2026-53090 verifier correction. It ensures ld_abs and ld_ind failure paths are properly simulated inside subprogs. Without the fix, the verifier can miss error paths that matter for eBPF program safety.

taskstats cpumask truncation bug

A bug report shows REGISTER_CPUMASK silently truncates the last byte of the cpumask string because of an off-by-one in the nla_strscpy destination size. Bradley Morgan identified the error after Andrew Morton had already queued an incomplete fix. Correct parsing is required for accurate taskstats CPU-mask registration.

VLAN HW offload skb_under_panic fix

A netdev patch corrects a data race on hard_header_len that produces skb_under_panic when hardware VLAN offload is toggled. The series also notes a related macvlan layering issue. Drivers and stacks that flip VLAN offload at runtime are directly affected.

Dispute over removing qce crypto driver

A patch proposing outright removal of the BROKEN qce crypto driver sparked a heated maintainer exchange covering in-kernel usage, removal policy, and possible future security features. The thread highlights tension between cleaning dead code and preserving hardware support paths that some still want kept.

seccomp pinned-memfd argument redirect

Version 7 of an eight-patch series adds kernel support for pinning sealed supervisor-owned memfd mappings into a target mm. The goal is to close TOCTOU windows in seccomp user notifications without requiring cooperation from the traced process. The work is aimed at sandboxes that need reliable argument inspection.

RISC-V IOMMU MSI remapping and IOMMU_DMA

A fourteen-patch v2 series for the RISC-V IOMMU enables MSI remapping for the IMSIC, allowing IOMMU_DMA and VFIO to be turned on by default. The changes complete a key piece of IOMMU functionality needed for device assignment and DMA isolation on RISC-V platforms.

btrfs writepage_delalloc folio lock leak

A 7.2-rc1 regression report identifies a folio lock leak in btrfs writepage_delalloc when large data folios are dirtied via GUP without subpage bits. Discussion of a proposed fix is under way. The leak can stall reclaim or writeback paths that expect the folio lock to be released.