sched_ext proxy work, reclaim fixes, and stable CVEs

Kernel traffic centered on scheduler and memory management patch series plus a cluster of stable CVE fixes. sched_ext proxy execution compatibility and defrag_mode reclaim behavior led the technical discussion, with NTFS, binder, CCP, ksmbd, and swap_cgroup security updates close behind.

sched_ext made compatible with proxy execution

A ninth revision of a patchset removes the mutual exclusion between SCHED_PROXY_EXEC and SCHED_CLASS_EXT. It adds new hooks, DSQ changes, and SCX_OPS_ENQ_BLOCKED so blocked donors can be handled under sched_ext. Extensible scheduler developers gain a path to run proxy execution without class conflicts.

Reclaim storms under defrag_mode fixed

A four-patch v2 series stops reclaim storms that appear when defrag_mode is set to 1. Non-movable requests are now allowed to participate in pageblock production, which removes the storm trigger. Memory management code that enables defragmentation under load depends on this correction.

NTFS invalid index_block OOB access (CVE-2026-64431)

Stable kernels fix an out-of-bounds access in the NTFS driver. The bug called post_write_mst_fixup on an invalid index_block and could be reached with a malicious filesystem image. Hosts that mount untrusted NTFS volumes should take the update.

rust_binder offset stride refcount corruption (CVE-2026-64467)

A stable fix corrects refcount corruption in rust_binder on 32-bit kernels. Cleanup walked a u64 offsets array with a usize stride, which is the wrong width on those platforms. Binder users on 32-bit kernels are the affected population.

CCP SEV ioctl SNP initialization (CVE-2026-64310)

The CCP crypto driver no longer initializes SNP when handling SEV ioctls. The previous path could clear MSR_VM_HSAVE_PA under SNP and crash the host. Operators of SEV-capable machines need the stable patch.

ksmbd caseless LOOKUP_BENEATH bypass (CVE-2026-64400)

ksmbd now restricts caseless retry so path traversal cannot bypass LOOKUP_BENEATH. The change closes the caseless path lookup hole reported under CVE-2026-64400. Deployments running the in-kernel SMB server should apply it.

swap_cgroup NULL deref on swapless hosts (CVE-2026-64416)

A backport fixes a NULL dereference in lookup_swap_cgroup_id when the host has no swap. The crash appeared after a recent batch-free change in swap_cgroup. Swapless configurations that hit the new path require the fix.

zswap global shrinker fixes and batch writeback

A v2 two-patch series repairs the zswap global shrinker when cgroups are disabled and adds batch writeback. mm maintainers have reviewed the changes. Workloads that rely on zswap under pressure get more predictable reclaim behavior.