Kernel socket UAFs, buffer errors, ethtool overflows

Security fixes for use-after-free and heap overflow bugs dominated kernel traffic, spanning TCP sockets, ethtool RXNFC handlers, DRM scheduling, and signal queues. Larger structural work on buffer write errors, unconditional per-VMA locks, ext4 iomap conversion, and a heated debate over BPF Runtime Verification monitors rounded out the day.

TCP request completion after listen state changes

A v2 eight-patch net series fixes multiple use-after-free bugs when requests complete on a socket that no longer listens. The changes cover TCP state transitions involving connect(AF_UNSPEC), listen(), and IPV6_ADDRFORM. Network stack reliability depends on closing these races that leave dangling references after listening sockets change state.

Buffer heads keep BH_Uptodate on write failure

A v2 series of 21 patches stops clearing BH_Uptodate when a write fails and switches filesystems to a BH_Write_EIO flag instead. The proposal reworks long-standing buffer_head error semantics across the block layer. Filesystem and storage maintainers need to assess how recovery and retry paths behave under the new model.

Ethtool ntuple filter heap overflows

Jakub Kicinski submitted five net patches fixing heap out-of-bounds write bugs in the bcm_sf2, nfp, and mv88e6xxx ethtool RXNFC handlers. Unprivileged callers could trigger the overflows through ETHTOOL_GRXCLSRLALL. Drivers exposing these ntuple filter reporting interfaces require the bounds checks to prevent memory corruption.

BPF monitors for Runtime Verification nacked

An RFC twenty-patch series proposes BPF-based pluggable monitors for the Runtime Verification subsystem. Alexei Starovoitov nacked the approach, while the author and Steven Rostedt defended domain-specific use cases. The exchange underscores disagreement over how far BPF should extend into specialized verification tooling.

DRM scheduler fence timeline name UAF

A v3 two-patch series fixes a use-after-free of the fence timeline name inside drm_sched. The bug matches the class of two earlier CVEs and affects the amdxdna, nouveau, and msm drivers. GPU stacks that rely on the shared scheduler need the timeline name lifetime correction.

Unconditional per-VMA locks

A v6 five-patch set makes per-VMA locks unconditional across all configs and cleans up related code. The change enables simplifications in binder and networking paths and has been picked up by Andrew Morton. Memory management code can drop config-dependent lock branches once the series lands.

Ext4 buffered I/O moves toward iomap

Version 6 of a 31-patch series converts ext4 regular-file buffered I/O from buffer_head to iomap. The work tackles ordering, i_disksize, and data=ordered consistency issues. Ext4 developers tracking the broader iomap migration will watch remaining edge cases in the buffered path.

Signal queue flush use-after-free

A patch replaces list deletion in flush_sigqueue with list_del_init_careful() after discussion of a use-after-free during non-leader exec with SIGEV_THREAD_ID timers. The thread drew 49 messages from seven participants. Correct signal and timer teardown during exec remains the practical stake for process lifetime handling.