Kernel work caps folio refs, hardens BPF, and speeds builds

Kernel discussion centered on memory-management correctness and BPF verifier contracts, alongside a build-system speedup series. Several patches close overflow, stack, and pointer-exposure paths that crafted inputs can hit.

Page cache folio refcounts get a cap

A nine-patch series limits page cache folio reference counts so large folios and transparent huge pages cannot overflow the counter. Linus Torvalds commented on the error handling. The change matters because folio refcount overflow is a memory-management failure mode, not only a wrapped integer.

kbuild series reports large speedups

A fifth revision of a kbuild series includes concrete benchmarks for faster kernel builds, covering objtool and modpost as well as the build proper. The claimed gains apply to ordinary kernel builds rather than a niche configuration. Anyone who rebuilds the kernel often would feel the difference if the series lands.

BPF dmabuf iterator stays drained after NULL

A patch keeps the dmabuf iterator drained after it returns NULL, matching the contract the verifier already assumes. Restarting the iterator after NULL can expose a kernel pointer. The fix is small, but it closes an information leak tied to that contract break.

Squashfs series fixes crafted-image bugs

The Squashfs maintainer posted 22 patches for arithmetic overflows, signedness errors, and missing bounds checks, including issues described as AI-related and AI-style. Those bugs can let a crafted filesystem trigger exploits or kernel panics. Untrusted Squashfs images are the practical exposure.

NSH GSO recursion is bounded

Two networking patches limit recursion in nsh_gso_segment() so stacked NSH headers on crafted GSO packets cannot overflow the stack. The fix and a selftest were merged. Paths that accept GSO traffic with NSH are the ones this closes.

BPF callback arguments are scoped to their frame

A four-patch series gives callback arguments frame-scoped lifetimes in the BPF verifier. The intent is to close kernel stack leaks and arbitrary read-write in the ringbuf drain and array map helpers. Those helpers are safe only if the verifier enforces that lifetime.

Verifier evaluates scalar evolution after jumps

A twelve-patch series adds scalar evolution evaluation in the state after a jump. Programs from Datadog, Falco, and Tracee that the verifier previously rejected become acceptable. Tracing stacks that already hit those limits are the users who would notice.

RFC reads the page cache without folio references

An RFC, originated by Linus Torvalds and posted from Meta, adds PG_rcu_free plus an RCU grace period so filemap and shmem reads can run without taking folio references. The aim is to avoid folio refcount contention on lockless cache reads. It remains a proposal, not a merged change.