Kernel mm refactors and pathwalk UAF fixes

Kernel developers pushed large memory-management series on VMA flags and page-cache refcounts, plus security work on RCU pathwalk UAFs and skb isolation. BPF exception landing pads, XFS scrub fixes, a packet ring overflow backport, and a heated virtualized-swap debate also moved.

Explicit VMA flag semantics

A 38-patch series refactors VMA flag semantics to make them explicit and eliminate VM_SPECIAL. The goal is to stop flag abuse in mlock, uprobes, and drivers. The scale of the change matters for anyone maintaining mm or driver code that touches VMAs.

RCU pathwalk UAF fixes

Christian Brauner posted an 8-patch series fixing use-after-free bugs during RCU pathwalks. The patches ensure RCU grace periods before freeing superblock data for ext4, afs, v9fs, tracefs, ntfs3, and the generic casefold path. Filesystem and VFS stability under concurrent lookups depends on these fixes reaching stable trees.

Page refcount scalability

Linus Torvalds posted a 10-patch series that uses RCU to avoid refcounts on hot folio reads in the page cache. Maintainers discussed races, flags, and throttling around the approach. The work targets better scalability for page-cache heavy workloads.

SKB allocation isolation

Kees Cook posted v6 of a series that isolates skb data-area allocations into a separate kmem_buckets bucket for UAF hardening. The patches include memcg and DMA fixes plus KUnit tests. Network-stack security benefits from tighter control over these allocations.

BPF exception cleanup landing pads

A v10 series adds verifier and JIT support for BPF exception cleanup landing pads when bpf_unwind() runs. The change enables Rust panic paths inside BPF programs. BPF developers using Rust need the landing-pad support for correct exception handling.

XFS scrub and repair fixes

An XFS maintainer submitted the 21st batch of scrub and repair fixes found with LLM assistance. The series carries stable backports and has drawn reviews. Ongoing reliability work in XFS continues to land through this route.

Packet TX_RING overflow backport

A stable 6.12 backport prevents a TX_RING byte-count overflow in the packet socket code. The bug let a CAP_NET_RAW user trigger a kernel BUG. Systems exposing packet sockets gain a concrete overflow fix from the backport.

Virtualized swap accounting debate

MM developers debated redefining memory.swap cgroup semantics for virtualized and zswap entries. Google warned of breakage risks for existing v1 and v2 deployments. The long, heated thread leaves the path forward for virtualized swap still unresolved.