Kernel: build speedups and filesystem security fixes

Kernel discussion on 12 November centered on faster builds and security fixes in ksmbd and Squashfs. Longer series also advanced the BPF verifier, lockless page-cache reads, splice, and user-namespace capability limits.

kbuild series aims at large build speedups

A fifth revision of an 11-patch series proposes changes meant to significantly speed up kernel builds, including kbuild, objtool, and modpost. The posting includes concrete benchmarks. If merged, the work would affect every kernel build.

ksmbd closes signing-oracle paths

A fifth revision of an eight-patch series makes ksmbd verify session setup requests before signing them with their key. The fixes cover signing-oracle vulnerabilities in session setup, multichannel binding, and compound request handling. Those paths sit on the kernel SMB server used by clients that share files with Linux.

Squashfs maintainer posts overflow and bounds fixes

The Squashfs maintainer posted an 18-patch series and a 22-patch second revision fixing arithmetic and variable overflows, signedness errors, and missing sanity or bounds checks. The noted consequences include out-of-bounds access, excessive kmalloc, crafted-filesystem exploits, and kernel panics. The patches harden the in-kernel reader against malformed images.

BPF verifier replaces scalar IDs with scalar evolution

Alexei posted a second revision of a 29-patch series on bpf-next that finds linked registers by scalar evolution and removes scalar IDs. The change reworks how the BPF verifier tracks relationships between registers. It is a large internal rewrite of a component that decides which BPF programs may load.

RFC reads the page cache without folio references

An RFC second revision from Meta, originated by Linus, adds PG_rcu_free and an RCU grace period so filemap and shmem can be read without taking folio references. The aim is to avoid folio refcount contention on those lockless reads. The series is still a request for comment, not a merge candidate with reported consensus.

splice drops pipe buffer stealing

A four-patch series removes pipe_buf_try_steal and related flags, following a suggestion from Linus and David. It has multiple acknowledgements and a pull from the VFS maintainer. The change simplifies splice by deleting a buffer-stealing path rather than adding a new one.

User namespaces may bound high-risk capabilities

An eight-patch series proposes a per-namespace capability bounding set and a sysctl to restrict high-risk capabilities, including CAP_NET_ADMIN, granted to unprivileged user namespaces. It also adds an opt-in network-namespace loopback control. The proposal would let administrators narrow what an unprivileged namespace can do without removing user namespaces entirely.