Kernel security fixes and subsystem cleanups

Security work led the day across networking, memory management, KVM, and crypto offload, with patches aimed at use-after-free, cross-user data exposure, and cleartext leaks. Filesystem error handling, scheduler policy for virtualized CPUs, coverage infrastructure, and MM maintainer routing also moved forward.

IP fragment reassembly truesize limit

A v2 networking patch limits the truesize sum held by an IP fragment reassembly queue. The change blocks integer wraparound and a resulting use-after-free that an unprivileged network namespace can trigger. Multi-tenant and container hosts that expose netns isolation should treat the hardening as high priority.

Filesystem SB_RDONLY error handling series

Christian Brauner posted a 34-patch v2 series so filesystems stop setting SB_RDONLY on errors without holding s_umount. The work clears freeze races and remount failures that affected ext4, xfs, gfs2, ntfs, exfat and others. Stable-tree discussion shows maintainers aligning the broad behavioral fix.

zswap stale data and swap-in fixes

A three-patch series corrects stale zswap data corruption and a swap-in extent bug. On zram or synchronous swap devices the defects can expose other users' data. Operators running compressed or synchronous swap need the corrections before they land in stable trees.

Steal governor merged to tip sched core

Version 14 of the steal_governor series, introducing preferred CPUs and steal-driven vCPU backoff, was merged into tip/sched/core. The scheduler work targets guests that must react to host steal time. Virtualization stacks that place or throttle vCPUs gain a new policy path.

KVM uaccess hardening on dying VMs

The KVM maintainer posted a 23-patch v4 series that stops bad uaccess during VM teardown from corrupting unrelated processes, especially under nested VMX, and adds related hardening. Nested virtualization setups reduce cross-process risk when a VM is torn down. The series is aimed at both correctness and defense in depth.

PSP and kTLS offload cleartext prevention

A seven-patch net series stops PSP and kTLS offload paths from transmitting contents in cleartext for IPv6 headers, fragments, and ICMP errors. Hardware crypto offload had leaked plaintext under those conditions. Deployments that rely on PSP or kernel TLS offload should track the fix.

Unified coverage and Clang MC/DC support

A 20-patch v2 series unifies gcov, KCOV, and LLVM coverage under kernel/coverage/ and adds Clang source-based coverage with MC/DC while fixing noinstr violations. The reorganization simplifies how the kernel collects coverage data. Testing and CI infrastructure maintainers gain a single coverage model.

Memory management maintainer updates

David Hildenbrand proposed routing several MM components through mm/core.git and adding Zi Yan as THP co-maintainer. Andrew Morton agreed to merge the series. The change clarifies ownership for future MM contributions and reviews.