Kernel CCA, frag CVE, and swap work

Arm confidential computing support advanced in KVM while several security fixes landed for networking, filesystems, signals, and tracing. Virtual swap and console conversion patches also moved forward.

Arm CCA support reaches KVM patch v16

A 45-patch series (v16) adds Arm CCA support to KVM, covering confidential VMs and the Realm Management Monitor. Hardware testing feedback and review continued on the list. The work matters for systems that need hardware-backed isolation of guest memory and state on Arm platforms.

CVE-2026-80590 strips GSO state from inet fragments

A kernel CVE fix strips GSO state from fragments before reassembly in the inet path. The change prevents an skb_segment BUG_ON crash after reassembly. Operators should care because the crash is reachable from ordinary fragmented traffic handling.

tmpfs casefold unicode_map leak fixed

A patch corrects unicode_map refcount leaks in tmpfs casefold option handling. The leak allowed an unprivileged local memory denial of service. The fix closes a straightforward resource-exhaustion path on systems that expose casefold tmpfs mounts.

Race fix in flush_sigqueue for POSIX timers

Discussion centered on a race between lockless flush_sigqueue and POSIX timer delivery after a non-leader execve. The proposed change uses list_del_init_careful() in flush_sigqueue(). Correct signal queue teardown after exec avoids missed or corrupted timer deliveries.

user_events fork path clears stale tracing state

A v2 patch clears copied tracing state before fork duplication in user_events. It prevents a use-after-free from a stale mm pointer on allocation failure and was reviewed by Rostedt. The change protects processes that use user_events across fork under memory pressure.

Routing exception caches hardened against side channels

A four-patch net series mitigates a side channel in IPv4 and IPv6 routing exception caches. Prior mitigations had been bypassed, allowing off-path UDP port discovery. The hardening reduces information leakage from the exception cache to remote attackers.

Virtual swap space v4 adds large device and tables

Nhat Pham posted v4 of the virtual swap patches, introducing a 16 TB virtual device and swap-table indirection for zswap and zero backends. The design separates swap addressing from physical backing. It aims to improve flexibility for compressed and synthetic swap without enlarging physical swap devices.

8250 serial driver moves toward NBCON again

Version 11 of the 8250 NBCON console conversion was posted after an earlier revert. Greg KH queued the series. Completing the conversion aligns the long-lived 8250 driver with the newer non-blocking console infrastructure.