Ftrace permanence, RISC-V IOMMU, IPsec fixes

Kernel traffic on 2026-07-31 focused on making BPF and ftrace hooks harder to disable, advancing RISC-V IOMMU support, and landing IPsec security fixes. Additional series covered Landlock BPF hooks, arm64 per-CPU preemptibility, MGLRU swappiness, and KVM guest memory preservation.

Permanent ftrace_ops for BPF trampolines and kprobes

An RFC series for bpf-next adds the FTRACE_OPS_FL_PERMANENT flag to BPF trampolines and ftrace kprobes so they cannot be silently disabled by setting ftrace_enabled to 0. Linus and maintainers discuss deprecating that sysctl entirely. The change matters for anyone relying on stable kprobe or trampoline-based instrumentation that must survive ftrace toggles.

RISC-V IOMMU MSI remapping and IOMMU_DMA

A 14-patch v2 series for the RISC-V IOMMU enables MSI remapping with the IMSIC. This unlocks IOMMU_DMA and VFIO by default. The work is a prerequisite for usable device passthrough and DMA isolation on RISC-V platforms.

IPsec XFRM security fixes

Steffen Klassert submitted an eight-patch net pull covering XFRM and IPsec. The fixes address out-of-bounds write, use-after-free, double-free, deadlock, and NULL dereference bugs. Operators running IPsec tunnels should treat the series as priority hardening for the transformation path.

BPF interface for Landlock rulesets

A 13-patch bpf-next series introduces BPF kfuncs and LSM hooks that let programs apply existing Landlock rulesets at exec time. The interface gives BPF authors a way to attach filesystem sandbox policies without reinventing Landlock. It expands the options for programmable confinement.

Conntrack kfuncs netns reference imbalance

A BPF fix closes a TOCTOU race on a shared map value inside conntrack kfuncs. The race produced netns reference-count imbalance that could oops or panic the kernel. Anyone using BPF helpers against connection-tracking state needs the correction for stability.

Preemptible this_cpu_* operations on arm64

An RFC series proposes making this_cpu_*() operations preemptible on arm64 through exception fixups on registered GPRs, following the s390 model. The change would remove a long-standing preemptibility restriction on per-CPU accessors. Architecture and scheduler developers tracking arm64 scalability will want to review it.

MGLRU swappiness behavior restoration

RFC v2 patches tighten type selection and aging decisions inside vmscan.c so Multi-Gen LRU again respects swappiness. The goal is to restore administrator control over anonymous versus file reclaim under MGLRU. Memory-management testers comparing reclaim behavior should examine the adjustments.

KVM guest_memfd preservation for live update

A v4 KVM series adds guest_memfd support and VM preservation across kexec via Live Update Orchestrator handlers and freeze logic. Guests can keep memory state intact through a host live update. The work is relevant to operators pursuing minimal-downtime KVM host maintenance.