Kernel: Arm CCA in KVM, signal and BPF fixes

Kernel traffic on 2026-08-25 focused on Arm confidential computing in KVM and a cluster of memory-safety fixes across signals, BPF, x86 page attributes, and networking. Large RFCs and stable regression reports rounded out a technically dense day.

Arm CCA support for KVM at v16

A 45-patch series at version 16 adds Arm Confidential Compute Architecture support to KVM, covering confidential VMs and RMM integration. Hardware testing feedback and continued review accompany the submission on linux-kernel. arm64 confidential virtualization depends on this path landing cleanly.

Signal queue flush race under discussion

A patch switches flush_sigqueue to list_del_init_careful to close a race with lockless POSIX timer delivery after non-leader execve. The linux-kernel thread examines interactions between signal queue teardown and timer paths. Correctness here affects process lifecycle under concurrent signal delivery.

BPF cgroup link stack bounds fix

A bpf-next v3 patch validates replacement programs against attach type, fixing a stack out-of-bounds write during cgroup link update. Five participants reviewed the change on bpf.vger.kernel.org. The fix hardens the BPF cgroup attachment path against memory corruption.

Queue and stack map u32 overflow restored

A two-patch bpf series restores a u32 index bound check removed earlier in queue and stack maps, blocking wrap when max_entries times value_size reaches or exceeds U32_MAX. Discussion on bpf.vger.kernel.org covers the overflow class introduced by the prior removal. Large map configurations regain a necessary guard.

Stable 6.12 USB hub regression on Threadripper

A bisected report on stable.vger.kernel.org ties MCE resets on Threadripper to a USB hub post-resume change in 6.12, with prior reports noted. Participants weigh a targeted fix against a revert. Resume-path stability on affected AMD systems is the practical stake.

x86 CPA page attribute fixes

A five-patch v2 series corrects races, use-after-frees, and an RWX check bug in the x86 change_page_attr code. Six participants discussed the work on linux-kernel. Reliable page attribute transitions underpin kernel memory protection.

Migration-based anonymous collapse RFC

A 57-patch RFC rebuilds khugepaged anonymous collapse on migration primitives to support multi-size THP on large-base-page architectures. The proposal drew 109 messages across eight participants. The redesign targets more robust huge-page collapse under mixed page sizes.

TCP and IPv6 listen-state completion races

An eight-patch net v2 series fixes use-after-free and out-of-bounds races when requests complete on sockets that no longer listen, spanning IPV6_ADDRFORM, connect(AF_UNSPEC), and listen transitions. Two participants drove the discussion on linux-kernel. Rapid socket state changes remain a source of connection-path corruption without these guards.