Device trust, IPsec and virtio fixes, MGLRU and guest_memfd work

Kernel traffic centered on security fixes in networking and storage paths, plus larger proposals for device trust, multi-gen LRU, guest memory, the BPF verifier, and F2FS block sizes. Several series target confidential computing, offload correctness, and stable backports.

Driver core authorizes device trust before binding

A 17-patch series generalizes the PCI untrusted flag into cross-bus device trust levels (disabled, adversary, full) applied before driver binding. It adds userspace policy hooks intended for confidential computing. The linux-kernel thread ran to 44 messages from 7 participants.

XFRM fixes ESP IV generation and ESN authentication

A 7-patch series corrects AES-GCM nonce reuse and ESN sequence bugs in the kernel xfrm/ESP IPv4 and IPv6 offload paths. The changes address correctness failures that can weaken IPsec protection. Six participants discussed the work across 25 netdev messages.

Virtio validates outer protocol on UDP tunnel GSO packets

An 8-patch v3 series stops a host skb_under_panic crash in virtio_net and tun when UDP tunnel GSO packets carry invalid outer headers. Validation of the outer protocol closes the malformed-input path. Four participants exchanged 16 messages on netdev.

MGLRU adds frequency-guided promotion

Version 4 of a 17-patch mm series introduces frequency-guided promotion (MGLRU-FG), cleans flags, and fixes LRU/PSI inconsistencies. The authors report 10-40% gains across platforms. Five participants covered the proposal in 31 linux-kernel messages.

Ksmbd deferred lock UAF fixes missing from 5.15.y

A stable backport request covers three ksmbd deferred file_lock use-after-free fixes already present on newer stable branches. The issues are tracked as CVE-2026-64396 and CVE-2026-64437. Two participants posted on the stable list.

Guest_memfd alternative providers RFC

An 88-patch RFC v3 extends guest_memfd with alternative providers (tmpfs, pfn-mode), VFIO integration, and selftests. The series broadens backing options for confidential and virtualized guests. Two participants generated 78 messages on linux-kernel.

BPF verifier tracks linked registers via scalar evolution

A 26-patch bpf-next series from Alexei replaces scalar IDs with scalar-evolution tracking of linked registers in the verifier. The refactor aims to simplify and strengthen register relationship analysis. Three participants discussed it in 30 messages.

F2FS supports block size below PAGE_SIZE

Google posted a 20-patch series allowing F2FS block sizes smaller than PAGE_SIZE on 16KB-page kernels. The primary goal is Android userdata migration. Two participants exchanged 35 messages on linux-kernel.