Kernel security fixes and mm scalability work

Security bugs in vhost and memory management led the day's kernel traffic, with active threads on refcount scalability, compaction policy, and multi-generational LRU. Several performance and BPF proposals also advanced.

vringh __get_user leaks kernel memory via vDPA

A bug in vhost/vringh performs __get_user without access_ok, allowing two-byte kernel memory reads through vDPA passthrough with vdpa_sim. Linus Torvalds and Michael S. Tsirkin discussed the correct fix on the linux-kernel list. The disclosure path matters for any setup that exposes virtual device rings to untrusted guests.

Compaction series NAKed over LLM policy

A two-patch series aimed at stopping repeated failed async compaction on every THP fault drew a maintainer NAK. The objection centered on alleged LLM use and the requirement for an Assisted-by tag under current kernel policy. The exchange underscores how contribution provenance rules are being enforced on mm changes.

Memory corruption fixed in AMD KVM nested migration

A memory corruption bug hit during AMD KVM nested-virt VM migration and was addressed by commit 55780d8a1dcc. The issue was reproduced with Windows VBS guests, and a backport to 6.18 was requested in a long thread. Operators running nested virtualization on recent stable kernels need the fix for guest stability.

RCU page-refcount series for lockless reads

Linus Torvalds posted v3 of a series that improves page refcount scalability by enabling lockless reads under RCU. Discussion covered races, f2fs edge cases, and large-folio performance. The work targets contention on multi-core systems with heavy page reference traffic.

PAGEMAP_SCAN UAF from missing mm pin

A patch pins mm_users inside do_pagemap_scan() to close a use-after-free in the PAGEMAP_SCAN ioctl. The hole arose from missing mmget_not_zero on hugetlb VMAs during concurrent exit. Systems that exercise the ioctl under process teardown are directly affected.

BPF unwind_goto and unwind_exit for exceptions

Alexei Starovoitov proposed new unwind_goto and unwind_exit instructions together with verifier changes. The v3 series on bpf-next aims to support Rust and C++ exception cleanup paths inside BPF programs. The addition expands the languages that can safely run complex control flow in the verifier model.

kernfs allocations moved outside rwsem

Meta reported long cgroupfs stalls caused by kernfs_rwsem held across inode allocations that trigger memcg reclaim. The v3 patch allocates inodes and dentries outside the lock. The change reduces latency for cgroup operations under memory pressure.

MGLRU frequency-guided promotion series

Version 4 of the MGLRU series introduces frequency-guided promotion and cleans related flags. It also corrects LRU and PSI inconsistencies and reports 10-40 percent gains across platforms. The work continues to refine multi-generational LRU behavior for production workloads.