Kernel races, side channels, and Linus NAK on SCTP sysctls

Security and correctness work led the kernel lists, covering signal queue races, routing cache side channels, BPF use-after-free, and PE digest bounds, while Linus Torvalds rejected an SCTP sysctl refactor. Larger proposals also advanced VFIO CXL Type-2 passthrough and a migration-based redesign of anonymous page collapse.

Signal queue race in flush_sigqueue

A patch proposes list_del_init_careful() in flush_sigqueue() to close a race with lockless signal queue teardown. Discussion centered on interaction with POSIX timer delivery after non-leader execve. The change matters for signal and timer correctness when processes replace their image under concurrent delivery.

Linus NAKs SCTP sysctl refactor

Linus Torvalds rejected an RFC series converting SCTP sysctls to sysctl_field. He cited unreadable indentation and macro noise as reasons the approach was unacceptable. The exchange sets a clear bar for how net sysctl cleanups will be reviewed.

Routing exception cache side-channel mitigation

A four-patch net series hardens IPv4 and IPv6 routing exception caches against off-path side-channel UDP port discovery. Earlier mitigations had been bypassed, prompting a fresh approach. The work continues kernel efforts to limit remote information leaks through routing structures.

BPF memalloc use-after-free fix

A BPF patch fixes a use-after-free from concurrent consumption of the waiting_for_gp_ttrace list in the memalloc path. Syzbot reported new crashes against the initial version. The fix stabilizes BPF memory reclamation under concurrent grace-period waiters.

VFIO passthrough for CXL Type-2 devices

Version 4 of a 27-patch series adds VFIO PCI passthrough support for CXL Type-2 devices. Guests would manage virtual HDM decoders and device resets directly. The work extends VFIO toward emerging CXL hardware in virtualized deployments.

Collapse rebuilt on migration primitives

A 57-patch RFC rebuilds anonymous page collapse on migration primitives for multi-size THP on large-base-page architectures. It would replace the existing khugepaged anonymous collapse engine. The size of the series and active review mark a substantial shift in how huge page collapse is structured.

Lost wakeup in muxed resource wait

A patch fixes a lost-wakeup race when tasks wait for a muxed resource region. The bug can leave waiters permanently uninterruptible. Correct muxed-region handling matters for drivers that share address ranges through the resource tree.

Bounds check in PE file digest path

A crypto patch bounds section data ranges in pefile_digest_pe_contents for asymmetric key handling. Out-of-bounds reads arise when signed PE images supply data_addr or raw_data_size values outside the buffer. The change hardens PE signature verification against malformed section metadata.