Kernel mm and BPF series plus security fixes

Large patch series dominated kernel traffic, covering memory management races and BPF verifier work for Rust programs. Several security hardenings addressed network disclosure paths while a driver-core taint proposal drew heated objections.

Memory management fix series

David Hildenbrand submitted a 46-patch series of various mm fixes that drew extensive review focused on races and hugepage issues. The work targets urgent problems in the core memory subsystem. Maintainers and distributions tracking stability regressions will want to follow the review outcome.

BPF arena stack and verifier rewrite

The BPF maintainer posted an 81-patch series enabling stack allocation in arena memory together with a verifier algorithm that joins states. The changes are intended to support loading Rust programs into BPF. Developers building eBPF tooling or language runtimes should watch the series for ABI and verification impacts.

Virtio-net checksum hardening

A sixth revision of five patches adds csum_start and offset validation plus early completion checks to virtio-net. The goal is to stop untrusted hardware from altering packets after protocol processing. Virtualized networking stacks gain protection against malicious device behavior.

Forced bind taint dispute

Greg Kroah-Hartman proposed TAINT_FORCED_BIND to mark kernels when userspace manually binds or unbinds devices through sysfs. VFIO and SR-IOV users objected, calling the change a regression and requesting a revert. The exchange highlights tension between taint tracking and practical device management workflows.

NVMe-TCP host memory disclosure

A stable backport for the 5.15 series fixes host memory disclosure on R2T for a read command in nvme-tcp. The patch prevents a malicious controller from obtaining host memory contents. Operators running long-term kernels should ensure the fix is present.

Long-standing IPv6 skb over-panic

An skb_over_panic in __ip6_append_data has existed since 2.6.12 when mtu minus fragheaderlen falls in the range 1 to 7 on raw IPv6 sockets. A one-line fix was proposed after a code audit. Networking maintainers and anyone using raw IPv6 sendmsg paths have a concrete bug to close.

IPC message queue limit bypass

A second-revision patch corrects signed-to-unsigned narrowing in msgctl IPC_SET that allowed unprivileged owners to set qbytes to ULONG_MAX. The change restores the intended msg_qbytes limit. System V IPC isolation for unprivileged processes benefits directly.

SCTP stream revalidation CVE

CVE-2026-99165 covers a null-pointer dereference panic in the SCTP send path after the stream count shrinks during association wait. The fix revalidates the output stream once the wait completes. SCTP deployments should track the patch for crash avoidance.