Kernel security fixes and low-level subsystem patches

Security-related patches dominated kernel traffic, addressing races, verifier bugs, out-of-bounds accesses, and a null dereference that could panic systems. Additional discussion covered powerpc preemption regressions and several feature proposals in memory management, tracing, and sched_ext.

VLAN offload race fix for skb_under_panic

A v2 net patch addresses a data race on hard_header_len that triggers skb_under_panic when hardware VLAN offload is toggled. The change also covers a related macvlan layering issue reported alongside it. Network stack developers should note the fix because the race allows panics under concurrent offload state changes.

BPF verifier fixes for borrowed kptr refcounts

A two-patch bpf series corrects verifier handling of bpf_refcount_acquire on borrowed RCU kptrs. The bugs permitted NULL returns and left stale PTR_UNTRUSTED pointers after acquisition. BPF users and verifier maintainers care because the flaws undermine type safety for kernel pointer references.

usbio driver OOB and hang fixes

A three-patch series for the usbio driver closes two slab out-of-bounds accesses and a potential I2C hang. The problems stem from unchecked small wMaxPacketSize values in the USB path. Driver and USB subsystem readers should track this because unprivileged or malformed devices can reach the bad paths.

hugetlb_cma null nodemask panic fix

A v4 mm patch prevents a null nodemask dereference inside hugetlb_cma_alloc_frozen_folio. Unprivileged users can trigger a kernel panic via gigantic hugepage allocation on NUMA systems with CMA enabled. The fix matters for anyone running large-page workloads on such configurations.

powerpc dynamic preemption performance debate

Discussion of a v4 powerpc patch enabling dynamic preemption revealed a performance regression on ppc64le. Participants including McKenney examined the cost of RISC preempt_count updates. Architecture and scheduler developers should follow the thread because the regression may affect the viability of the change.

Unconditional per-VMA locks cleanup

A five-patch mm series removes config guards around per-VMA locks and drops fallback paths in binder and networking code. The goal is to make the locking model unconditional. Memory-management and binder maintainers will want to review the resulting simplifications and any remaining edge cases.

wprobe hardware-breakpoint tracing events

Version 11 of a tracing patchset adds wprobe events for hardware-breakpoint watchpoints on x86. It introduces a modify_local_hw_breakpoint_addr API and support for dynamic triggers. Tracing users gain finer watchpoint control once the series lands.

sched_ext rescue execution for stranded tasks

Tejun Heo posted a v2 sched_ext patchset that adds bandwidth-limited kernel rescue execution. The mechanism recovers tasks left stranded by sub-scheduler capacity or affinity limits. sched_ext users should examine it because it improves reliability under constrained custom schedulers.