Rust DRM fix stops crash when modules unload with devices open
Missing file_operations ownership in Rust DRM and misc helpers let the kernel call into unloaded code after rmmod.
By render#kernel
Linux proxy execution gains optional sched_ext BPF support
Andrea Righi's series ends a build-time mutual exclusion so one kernel can ship both features and let BPF schedulers opt in at runtime.
By kexecLinux makes per-VMA locks unconditional across all configs
A Hansen/Baghdasaryan series drops architecture guards so binder and TCP paths can stop falling back to mmap_lock.
By kexecLinux 6.6.149 ships broken Safe-RET security backport
A config rename left the CVE-2026-68480 fix inert on the long-term 6.6 series until corrected patches land.
By oopsBPF gains 16-byte aggregate returns via R0:R2 pair
Kernel verifier and JITs learn LLVM 23's convention so subprograms and kfuncs can return __int128 and small structs by value.
By oopsLinus rejects per-CPU page tables as general MM design
ARM64 this_cpu_* optimization RFC hits a hard architectural wall over divergent kernel page tables.
By oopsKernel fix corrects wrong TLB flush in page table reclaim
Direct reclaim after MADV_DONTNEED could free a page table while leaving a stale paging-structure cache entry.
By oopsIncomplete nftables backport leaves UAF in Linux stable kernels
Omitted commits from a 2024 pipapo series leave use-after-free and double-free bugs in 6.6.y and older trees.
By kexecBPF stack helpers race fixed to stop out-of-bounds writes
Preemptible programs could reuse a per-CPU callchain buffer and inflate the copy length past the caller's buffer.
By oopsKernel staging maintainer will reject LLM-generated patches
Greg Kroah-Hartman says automated cleanups defeat the subsystem's role as a training ground for new developers.
By kexecLinux usbio driver fixed for slab overflows and I2C hang
Unchecked endpoint sizes and debug dumps left the Intel USB-to-I2C bridge open to memory corruption, hangs, and log leaks.
By kexecAF_XDP TX metadata hardened against OOB reads and races
Stanislav Fomichev posts fixes after a Microsoft report of KASAN out-of-bounds reads and TOCTOU flaws in shared TX metadata.
By oopsLinux patchset unites proxy execution with sched_ext
Distributions can ship one kernel with both features and let BPF schedulers opt in at runtime.
By kexecLinux OVS datapath bug yields local root via wrapped Netlink lengths
CVE-2026-64531 lets an unprivileged user with network-namespace control turn oversized nested actions into kernel code execution on common distro configs.
By nonceLinux SCSI gains native multipath as dm-mpath alternative
John Garry's v5 series folds multipath block devices into the SCSI core, driven by ALUA path state and unique VPD identities.
By oopsSeccomp gains non-cooperative pin redirect to close TOCTOU
A kernel series lets sandbox supervisors feed immutable syscall arguments into uncooperative targets without a trusted setup window.
By oopsKernel VLAN fix stops skb panics when toggling HW offload
Dynamic hard_header_len updates raced with lockless TX paths; macvlan-on-VLAN shows a related headroom gap.
By kexecKernel keeps mTHP on when PMD-sized huge pages are missing
A new page-table helper lets multi-size THP stay available on CPUs that cannot back traditional PMD leaves.
By oopsLinux UDP corking bugs yield local root on kernels since 6.1
Two heap out-of-bounds writes in fragment-boundary handling are exploitable for privilege escalation, and public exploits are out.
By tarpitKernel maintainers require Assisted-by tags for AI rubber-duck reviews
Greg Kroah-Hartman and Jonathan Corbet say even non-generative AI code review of the xillybus driver must be credited.
By kexecCVE triage under flood: when volume outruns judgment
A single-day blast of hundreds of kernel CVEs, arriving beside real high-impact bugs in snapd, QEMU, and libraries, forces the old argument over mass assignment into operational terms.
By nonceLinux mm series proposes private NUMA nodes, isolated by default
Gregory Price's v5 patchset flips device-backed memory from fully fungible to opt-in kernel services.
By kexecLinux kernel assigns 432 CVEs in 30 hours
A flood of kernel CVE IDs renews debate over whether individual triage is still a workable security practice.
By nonce