Kernel UAF fixes, virtual swap, and async shutdown

Security work led the day's kernel traffic, with use-after-free fixes in DRM scheduling and memcg plus a GRO validation CVE. Parallel threads advanced virtual swap redesign, asynchronous device shutdown, and Rust irq locking after a Syzbot-driven revert.

DRM scheduler use-after-free fix

A v1 patch series corrects a use-after-free read in get_timeline_name() inside the drm_sched core. The flaw is reachable by unprivileged users through exported fences and touches drivers such as amdxdna, nouveau, and msm. The change closes a concrete information-leak path in the shared GPU scheduling layer.

Virtual swap space v4

Nhat Pham posted the fourth revision of the virtual swap space series built around swap-table indirection. The patches introduce a 16 TB virtual device that can back zswap and zero-page backends. The design aims to decouple swap consumers from physical swap layout and improve flexibility for compressed and synthetic swap.

TPM1 trusted-key bounds checks

Patches add an explicit bounds check before memcpy in tpm_seal() and reject unauthenticated responses in the trusted_tpm1 path. Discussion also included maintainer requests that the submitter drop an alias and use a real name. The changes harden the legacy TPM sealing code against malformed or oversized responses.

Memcg drain_all_stock UAF

A fix addresses a use-after-free race in drain_all_stock() when asynchronous work runs during css offline without a flush of memcg_wq. Concurrent reclaim can touch freed memcg state under that window. The patch tightens teardown ordering for memory cgroups.

GRO BIG TCP validation CVE

Stable trees carried the fix for CVE-2026-80725, which concerns missing validation of BIG TCP aggregation criteria in the GRO path. Crafted AF_PACKET frames could produce an out-of-bounds write. The change prevents memory corruption from malicious or malformed packet streams.

Asynchronous device shutdown v20

The twentieth revision of the async shutdown series adds an opt-in path that parallelizes slow device teardown. On systems dominated by NVMe the approach can reduce reboot time from minutes to seconds. Default behavior remains unchanged unless drivers explicitly participate.

Vmap purge lock livelock

A v2 patch switches two reclaim paths from mutex_lock to trylock around vmap_purge_lock. Under memory pressure the previous locking could livelock the purge path. The adjustment improves vmalloc behavior when reclaim and purge contend.

Rust irq locking revert

Peter Zijlstra reverted a locking and irq-guard change after Syzbot reported unsafe nested lock patterns inside scoped_guard(spinlock_irq). The surrounding v4 series continues work on refcounted interrupt disable and SpinLockIrq helpers for Rust. The episode shows automated testing still shaping safe interrupt primitives in the Rust-for-Linux effort.