Kernel security fixes and hardware driver work

Security-related patches dominated kernel traffic, covering BPF cgroup handling, NFSd, and TCP/IPv6 socket state races, alongside a reported stable regression. Driver and subsystem proposals continued for handheld HID support, Rust GPU firmware boot, network steering, and fabric-attached memory.

BPF cgroup link stack bounds fix

A v3 patch for bpf-next addresses a stack out-of-bounds write during cgroup link updates. The change validates replacement programs against the attach type before proceeding. Readers tracking eBPF safety should note the correction closes a write beyond allocated stack space in that path.

Stable 6.12 USB hub resume regression

Discussion on stable lists covers a regression in 6.12, bisected to a USB hub post-resume change, that triggers MCE resets on Threadripper systems. Prior reports were noted while participants weighed a targeted fix against a revert. The issue matters for users of affected AMD platforms who rely on stable kernels after resume cycles.

NFSd DRC slot use-after-free

A patch fixes a use-after-free of a DRC slot inside nfsd4_sequence. The flaw is reachable by a malicious NFSv4.1 client. The report was AI-assisted and targets stable trees, relevant to anyone running the in-kernel NFS server.

TCP/IPv6 socket completion races

A v2 eight-patch net series corrects multiple use-after-free and out-of-bounds races when requests complete on a socket that no longer listens. The races arise around IPV6_ADDRFORM, connect with AF_UNSPEC, and listen state changes. Networking maintainers and anyone shipping TCP stacks should track the series for race closure under those transitions.

HID support for ROG Ally handhelds

A v3 twelve-patch series extends the hid-asus driver with support for ASUS ROG Ally handhelds. The work covers the extensive device-specific handling required for those platforms. Handheld Linux users and HID subsystem contributors gain a clearer path to mainline Ally coverage.

Nova-core r000 GSP firmware boot

A v2 thirty-one-patch series for the nova-core Rust GPU driver adds boot support on r000 GSP firmware. Discussion involved multiple participants refining the approach. The series advances open NVIDIA GPU bring-up for systems using that firmware generation.

PSP Rx steering via virt cookie

An RFC six-patch net-next series from Jakub Kicinski proposes using the undefined PSP virtualization cookie field as a peer-assisted Rx queue steering hint. The idea aims to improve receive-side placement without new protocol machinery. Network stack developers evaluating PSP offload paths have a concrete design to review.

Famfs standalone patchset v13

Version 13 of the standalone famfs patchset was submitted for the Fabric-Attached Memory File System. The work targets CXL-style disaggregated memory appliances. Readers following CXL and shared-memory filesystems can follow the latest standalone submission.