ksmbd, AF_XDP, and BPF stack fixes; arm64 128-bit PTEs

Stable trees and subsystem maintainers spent the day on security backports for ksmbd, AF_XDP, BPF stack maps, and IPv6 NDISC, while larger series advanced arm64 page-table width, KVM clock cleanup, and DMAEngine workqueue migration. Several of the fixes close out-of-bounds or race windows reachable from unprivileged or userspace-shared paths.

ksmbd DACL overflow fix fails stable backport

A patch restoring DACL size checks after check_add_overflow() failed to apply cleanly to the 7.1-stable tree. Discussion of the rejection highlights an out-of-bounds read risk stemming from unchecked ACE fields in ksmbd. Readers tracking SMB server hardening or stable backports will want the series rebased before the fix lands in long-term kernels.

arm64 adds 128-bit page-table entry support

A 17-patch series introduces CONFIG_ARM64_D128 and the machinery for 128-bit PTEs under FEAT_D128 (VMSAv9-128). The work widens the arm64 memory-management path so future hardware can use the larger descriptor format. Anyone building for newer Arm cores or maintaining arch/arm64 mm code should review the configuration and PTE layout changes.

AF_XDP TX metadata validation hardened against races

Six patches close a KASAN-reported out-of-bounds read and TOCTOU races in AF_XDP transmit metadata handling. The bugs arise when userspace supplies undersized or concurrently modified metadata buffers shared with the kernel. High-performance packet paths that rely on XSK TX metadata need the tightened validation to avoid memory-safety issues under concurrent load.

KVM clock cleanup reaches v7

David Woodhouse posted the seventh revision of a 36-patch series that removes pvclock_gtod_data, tightens TSC and guest-clock APIs, and addresses imprecision, discontinuities, and migration problems in the KVM clock. The changes affect both host and guest timekeeping paths. KVM developers and anyone shipping live-migration support should examine the new clock interfaces.

BPF stack maps disable preemption around callchain

An 11-patch set refactors BPF stack helpers so preemption is disabled across get_perf_callchain. The change prevents a potential out-of-bounds write when concurrent tasks reuse the same per-CPU buffer. BPF programs that capture stack traces on busy systems are the immediate beneficiaries.

DMAEngine moves channel completions to WQ_BH

Version 2 of a 64-patch series migrates DMAEngine client completion handling from per-driver tasklets to a centralized per-channel WQ_BH workqueue. The conversion covers virt-dma and more than ten drivers. Driver authors still using tasklets for DMA callbacks will need to adopt the new completion model.

BPF trampolines and kprobes marked permanent ftrace ops

An RFC proposes FTRACE_OPS_FL_PERMANENT for BPF trampolines and kprobes so that ftrace_enabled=0 cannot silently disable them. Linus Torvalds weighed in on the possibility of deprecating the sysctl entirely. Tracing and BPF infrastructure maintainers should follow the discussion before the flag or sysctl semantics change.

IPv6 NDISC NULL dereference fixed for 6.6 stable

A single stable patch corrects a NULL pointer dereference in accept_untracked_na() that an unprivileged user can trigger through a network namespace. The fix is targeted at the 6.6 series. Operators running unprivileged netns workloads on that kernel should obtain the backport promptly.