Kernel security fixes for BPF, USB, and OVS

Security work led the day's kernel traffic with verifier and driver fixes that close crash and bounds paths, plus a stable CVE for Open vSwitch. Networking and memory management series continued in parallel with positive review on fwnode PCS support.

BPF refcount_acquire fixes for borrowed kptrs

A v2 patch series corrects two BPF verifier bugs in bpf_refcount_acquire handling for borrowed RCU kptrs. The flaws permitted NULL returns or stale PTR_UNTRUSTED access capable of crashing the kernel. The changes matter for anyone shipping BPF programs that traffic in kernel pointers under RCU.

usbio out-of-bounds accesses and hang

Patches address integer-wrap length checks in the usbio USB-I2C driver that enabled slab out-of-bounds reads and writes along with hangs. A v2 series targets u16 to size_t underflow on endpoints with small wMaxPacketSize values. Greg KH criticized the original submission as LLM-generated, underscoring review standards for driver fixes.

Open vSwitch oversized nested action rejection

CVE-2026-64531 lands a stable fix that makes Open vSwitch reject oversized nested action netlink attributes. The change stops later misparsing of generated flow actions. Operators of virtual switches gain a guard against crafted attribute streams.

fwnode PCS provider API

The v9 net-next series adds a fwnode PCS provider API and phylink internal PCS handling. The mvpp2 maintainer gave positive review. The work extends firmware-node based configuration for physical coding sublayers in network drivers.

vmalloc 32-bit truncation in vread_iter

A patch fixes unsigned-int truncation of the area size when computing vm->nr_pages shifted by PAGE_SHIFT. The bug affected vmalloc regions of 4 GiB or larger on 64-bit kernels. Correct sizing prevents truncated reads from large vmalloc areas.

ALLOC_UNMAPPED allocator flag

A v3 series introduces the ALLOC_UNMAPPED flag together with freetype and pageblock support. The additions enable direct-map removal for guest_memfd and ASI. Confidential-computing and isolated memory users gain the necessary allocator primitives.

failfs and fchroot RFC

Christian Brauner posted an RFC that adds failfs, a filesystem returning EOPNOTSUPP on every operation, plus fchroot to drop absolute path access. The pair lets a process confine itself away from the global namespace root. The design offers a minimal mechanism for path-restricted execution environments.