Kernel VMA refactor, pathwalk UAFs, and swap debate

Kernel traffic centered on memory-management refactors and use-after-free hardening across filesystems and networking. A heated cgroup swap discussion and several stable-bound fixes rounded out the day.

VMA flags made explicit, VM_SPECIAL removed

A 38-patch series reframes VMA flag semantics to eliminate VM_SPECIAL and curb flag misuse in mlock, uprobes, and drivers. The change aims to make flag meaning precise rather than overloaded. Readers tracking mm core interfaces will want to watch the review for ABI and driver impact.

RCU pathwalk UAFs fixed across filesystems

Christian Brauner posted an 8-patch series that stops use-after-free races during RCU pathwalks by ensuring proper grace periods before freeing superblock data. The fixes cover ext4, afs, v9fs, tracefs, ntfs3, and the generic casefold path. The work lands on stable trees and matters for anyone running those filesystems under concurrent lookup pressure.

SKB data allocations isolated into kmem buckets

Kees Cook sent v6 of a net-next series that places skb data-area allocations into a dedicated kmem_buckets group for stronger UAF hardening. The set includes memcg and DMA corrections plus KUnit coverage. Networking and security maintainers gain a clearer isolation boundary for packet buffers.

XFS scrub fixes, LLM-assisted batch 21

The XFS maintainer submitted the 21st installment of scrub and repair fixes discovered with LLM assistance, complete with stable backports. Reviews are underway on the small, targeted changes. Operators of XFS will see incremental robustness in online repair paths.

KVM/arm64 code shared onto s390

A v9 series lets s390 host a KVM/arm64 implementation by selectively reusing arm64 KVM code and headers. The patches have already been applied, with remaining build fixups under discussion. Cross-architecture KVM reuse is the practical takeaway for virtualization developers.

iov_iter DMA alignment bypass closed

A patch tightens iov_iter validation so the first nonempty bvec segment is checked for DMA alignment, closing a bypass of CVE-2026-89584 that empty leading segments could trigger on O_DIRECT paths. The change restores the intended guard. Storage and direct-I/O users benefit from the corrected check.

VLAN tag insert uninit-slab leak backported

A stable backport for 5.10 through 6.6 requires the MAC header to be present inside __vlan_insert_inner_tag. The fix stops an uninitialized slab leak on devices whose hard_header_len is zero. Network driver and stable-kernel consumers should pick it up.

Virtualized swap cgroup semantics disputed

mm developers continue a lengthy debate on redefining memory.swap accounting for virtualized and zswap entries. Google engineers warn that changing the v1/v2 meaning risks breaking existing deployments. Container and cgroup users have a stake in whether the interface stays compatible or is revised.