Virtio-net hardening, AI tags, lock fixes, ksmbd CVEs

Security patches for virtio-net and ksmbd led the day's kernel traffic, joined by lock-contention work and a long debate over documenting LLM help. Several CVE announcements closed use-after-free and memory-access bugs in binder, CIPSO, and the in-kernel SMB server.

Virtio-net checksum hardening

A sixth-round patch series for net adds csum_start and offset validation plus early completion to virtio-net. The changes block untrusted hardware from altering packets after protocol processing. Virtualization and networking developers gain stronger defenses against malformed offload data.

Deprecating Assisted-by references

A documentation patch removes Assisted-by tags, following guidance from the Maintainers Summit. Across 74 messages and 20 participants, maintainers debated disclosure rules and practical detection of LLM-generated contributions. The discussion will shape how future kernel submissions acknowledge automated assistance.

Kernfs allocations outside the rwsem

Meta reported multi-second cgroupfs stalls when kernfs_rwsem was held across memcg-reclaim inode and dentry allocations. Version 3 of the patch moves those allocations outside the lock. Heavy cgroup workloads should see reduced contention and shorter stalls.

Uprobes no longer stall fork

Alexei posted a nine-patch bpf-next series that stops uprobe registration from blocking fork when mmap_lock is contended, while fixing related uprobes, fork, and x86 bugs. The work removes a source of latency for processes that both fork and use uprobes. Performance and tracing users benefit directly.

KSMBD smbdirect integer underflow

ZDI reported ZDI-CAN-33549, a CVSS 9.0 integer-underflow remote-code-execution flaw in the KSMBD smbdirect RDMA path. Samba developers discussed landing a fix in the for-7.5 branch. Operators running the in-kernel SMB server face a high-severity exposure until the patch lands.

KSMBD channel teardown use-after-free

Greg KH announced CVE-2026-98870, which removes stale channels from all sessions on teardown. The change closes a use-after-free that could occur during session deregistration. KSMBD deployments need the fix to avoid dangling channel references.

Rust binder refcount reschedule

CVE-2026-99075 fixes rust_binder by rescheduling node refcount updates when a thread exits. The adjustment prevents refcount desynchronization. Users of the Rust binder implementation receive a correctness and stability correction.

CIPSO cached option offsets

CVE-2026-99064 adjusts cached option offsets when CIPSO is removed. The prior bug could produce incorrect memory accesses for IP option consumers. Networking code that relies on CIPSO labels is protected by the offset correction.