Kernel UAFs, IPsec fixes, and refcount work

Security fixes for filesystem use-after-frees and IPsec nonce handling led the day's kernel traffic, joined by scalability patches and continued LLM-related process debate. Several series also advanced Rust adoption and nested virtualization performance.

Filesystem RCU pathwalk UAF fixes

Christian Brauner posted an eight-patch series that closes use-after-free bugs during RCU pathwalks. The changes ensure RCU grace periods before freeing superblock data in ext4, afs, v9fs, tracefs, ntfs3, and the generic casefold path. These races affect common path lookup paths and can produce kernel memory corruption under concurrent unmount or rename activity.

xfrm ESP IV generation and ESN fixes

A seven-patch series corrects AES-GCM nonce reuse and extended sequence number authentication errors in the xfrm ESP offload paths for both IPv4 and IPv6. The bugs sit in the kernel IPsec implementation used by high-speed encrypted tunnels. Correct IV and ESN handling is required to preserve confidentiality and integrity of offloaded ESP traffic.

Page cache refcount scalability

Linus Torvalds posted a ten-patch series that switches hot folio reads in the page cache to RCU, avoiding atomic refcount traffic. The patches report substantial speedups while work continues on remaining races and memory-pressure edge cases. Reduced refcount contention directly improves throughput on large multi-core page-cache workloads.

XFS scrub fixes via LLM assistance

The XFS maintainer submitted the twenty-first batch of scrub and repair corrections identified with LLM help. The series carries stable backports and is under active review. Continued automated discovery of filesystem consistency bugs matters for long-term data integrity on XFS volumes.

Rust SPDM requester

Version four of a twenty-two-patch series adds a Rust SPDM requester to the kernel library code. The implementation targets safer parsing of complex, untrusted authentication messages. Memory-safe handling of SPDM reduces the attack surface of device attestation paths.

AppArmor cred UAF stable fix

A single patch backported to 6.6.y repairs a credential use-after-free inside begin_current_label_crit_section(). The bug affects AppArmor LSM hooks that manipulate task credentials. Stable kernels running AppArmor require the change to avoid potential privilege or integrity failures.

KVM nSVM TLB flush optimization

A twenty-nine-patch v2 series reworks nested SVM TLB flushes by giving each vCPU its own L2 ASID and dropping dynamic allocation. Benchmarks show gains in the 8-15 percent range. Nested virtualization on AMD hardware benefits from the reduced flush overhead.

Assisted-by tag removal

A documentation patch removes Assisted-by references following Maintainers Summit guidance. The ensuing thread examined disclosure expectations and practical detection of LLM-generated contributions. The outcome will shape how kernel maintainers attribute and review AI-assisted patches going forward.