Arm CCA, Apple USB4, and kernel race fixes

Kernel development on 2026-09-07 centered on a large Arm confidential-computing series for KVM, first USB4 enablement for Apple Silicon, and several race and use-after-free fixes across memory management and networking. Review traffic was heaviest on the CCA patches and on urgent x86 page-attribute corrections.

Arm CCA support for KVM reaches v16

A 45-patch series at version 16 adds Arm Confidential Compute Architecture support to KVM, covering confidential virtual machines and the Realm Management Monitor. Hardware testing feedback and review continued across 105 messages from 12 participants. The work matters for anyone building hardware-backed isolation on Arm servers, because CCA is the platform path for confidential VMs.

Initial USB4 and Thunderbolt for Apple M1/M2/M3

Version 2 of a 22-patch series introduces the first USB4/Thunderbolt driver and device-tree nodes for the ACIO and NHI blocks on Apple M1, M2, and M3 SoCs. The series is the initial mainline enablement of that high-speed fabric on these chips. Developers tracking Apple Silicon Linux ports need it for external docks, storage, and peripherals.

BPF proactive memcg reclaim

A seventh-round, two-patch series for bpf-next adds a SYSCALL-restricted bpf_proactive_reclaim kfunc so BPF programs can trigger memory-cgroup reclaim. The mm maintainer raised nesting questions during the 12-message review. The change gives BPF finer control over memory pressure without leaving reclaim entirely to the kernel heuristics.

Urgent x86 CPA race and UAF fixes

A five-patch series fixing change-page-attribute races and use-after-free bugs on x86 was merged to tip/x86/urgent after misapplied commits and tree problems were straightened out. Forty-two messages from ten participants tracked the corrections. The fixes close concurrent page-attribute update bugs that can corrupt or free memory under load.

POSIX CPU timer UAFs on non-leader exec

Version 2 of an eight-patch series fixes use-after-free bugs in POSIX CPU timers when a non-leader thread calls exec(), plus related cleanups. Three participants reviewed the 15-message thread. Correct timer teardown on exec prevents crashes or corruption when a process image is replaced.

ip6_tunnel encap state race

A fourth-version net patch snapshots ip6_tunnel encapsulation state in the transmit path to close a changelink race that can underflow skb_push. Five participants discussed the single-patch change. The fix stabilizes IPv6 tunnel xmit against concurrent configuration updates.

Stable TCP IPv6 syn_recv race fix

A v2 stable backport for 6.12 fixes a potential race in tcp_v6_syn_recv_sock() after a syzbot report and CVE assignment. The short two-message exchange covers the backport itself. Long-term kernels need the change to keep IPv6 TCP connection setup aligned with mainline security fixes.

TCP fast-path old-ACK validation

A patch adds RFC5961-style validation of old ACKs before TCP fast-path data processing, closing a gap left by the earlier CVE-2023-52881 fix. Two participants discussed the proposal. Strengthening the fast path reduces remaining ACK-related attack surface on receive.