vDPA leak, futex RFC, and kernel CVE fixes

Kernel lists carried a vringh access-check bug under vDPA passthrough, several stable CVE fixes, and RFCs on stealable futexes, filesystem freeze races, BPF unwinding, and kernfs lock hold times. Security and reliability work dominated the day for low-level and driver maintainers.

vringh __get_user leak via vDPA passthrough

A bug report on linux-kernel showed vhost/vringh calling __get_user without access_ok, allowing two-byte kernel memory reads through vdpa_sim passthrough. Linus Torvalds and Michael S. Tsirkin discussed the correct fix path. The issue matters for hosts that expose virtio rings to guests or simulators.

FUTEX_PING stealable locks via proxy execution

An RFC series proposed FUTEX_PING, a stealable futex built on proxy execution for priority-inheritance style locks. Peter Zijlstra and others raised deadlock and locking-order concerns. Real-time and lock-stealing developers should track the follow-up discussion.

Filesystems must not set SB_RDONLY without s_umount

A 28-patch RFC argued that filesystems should stop setting SB_RDONLY after errors without holding s_umount, closing freeze and thaw races. The series addresses hangs in hfs, ntfs, gfs2, zonefs and related code. Operators of those filesystems under recovery or error paths gain more predictable behavior.

USB gadget f_uac1_legacy OOB via bRequest

CVE-2026-98769 covers out-of-bounds access in the f_uac1_legacy USB gadget when generic_set_cmd and generic_get_cmd mishandle a malformed bRequest index. The fix is in stable. Legacy UAC1 gadget users should take the update.

BPF unwind_goto and unwind_exit for exceptions

A v2 bpf-next series adds unwind_goto and unwind_exit instructions with verifier state and JIT support so BPF can run Rust and C++ exception paths and destructors. The change widens safe language support on the BPF VM. Verifier and runtime maintainers are the main audience.

libiscsi_tcp Data-In direction check

CVE-2026-98479 fixed a missing data-direction check on Data-In PDUs in libiscsi_tcp that let a target inject data into initiator write buffers. The kernel patch closes the hole. iSCSI initiator deployments need the fix present.

Cap skb queue_mapping for taprio forwarding

CVE-2026-98797 addressed skb->queue_mapping mishandling that could cause out-of-bounds access in the taprio qdisc during forwarding. Greg Kroah-Hartman posted the stable fix. Forwarding setups that use taprio should update.

kernfs allocates inodes outside kernfs_rwsem

A v3 patch moves kernfs inode and dentry allocation outside kernfs_rwsem after Meta reported long cgroupfs stalls when the lock was held across memcg-reclaim. The change cuts reclaim-induced latency on cgroup-heavy hosts. Container operators benefit from shorter stalls.