Linux gains initial USB4 support on Apple M1, M2, and M3
A mainline patch series brings first Thunderbolt host-router bring-up to Apple Silicon, limited for now to XDomain links and USB3 tunnels.
By oops#linux
Kernel clamps qdisc quantum paths that let admins soft-lock hosts
Eight traffic-control schedulers still allowed tiny quanta after setup, reopening a deficit-loop DoS under the qdisc lock.
By kexecKernel fix breaks vmalloc livelock under memory pressure
A circular lock dependency in the vmap purge path could stall the whole system when reclaim and purge work collided.
By kexecDRM scheduler fix closes unprivileged GPU fence UAF read
A core lifetime bug let userspace read freed scheduler memory via exported fences in amdxdna, nouveau, and msm.
By kexecKernel trusted-keys path hardens TPM1 seal and HMAC checks
Forged TPM 1.x replies could overflow a fixed-size blob buffer or skip response authentication entirely.
By kexecLinux kernel panics on GSO fragments after IP reassembly
CVE-2026-80590 lets an unprivileged user trigger a BUG_ON in skb_segment via tap or virtio paths that keep GSO metadata on defragmented packets.
By kexectmpfs casefold option leaked Unicode maps, enabling local DoS
Unprivileged users could exhaust kernel memory by repeatedly setting the casefold mount option on tmpfs.
By kexecKernel user_events fork path fixed for use-after-free
A failed memory allocation during process duplication could free tracing state still held by the parent.
By kexecLinus Torvalds NAKs SCTP sysctl rewrite over unreadable macros
Alexey Gladkov’s RFC to replace per-namespace table cloning with sysctl_field descriptors is rejected as visually illegible, type-unsafe noise.
By oopsKernel patches close UDP port side channel in routing caches
Always creating exceptions for ICMP errors stops off-path attackers from probing connected UDP sockets after earlier defenses were bypassed.
By kexecIPQ5018 NSS offload works on upstream stmmac at Linux 6.18
A public fork accelerates routed NAT on the GL.iNet GL-B3000 without Qualcomm’s proprietary datapath stack, leaving the CPU mostly idle.
By chrootOpenRGB root daemon allows trivial remote compromise
Flaws in the RGB control suite’s custom network protocol can fully take over systems when the server runs with default privileges.
By tarpitKernel fix stops tasks hanging forever on muxed I/O regions
A 16-year-old lost-wakeup race left processes unkillable after brief SMBus and similar contention, reachable from ordinary sensor reads.
By oopsKernel clamps qdisc quantum to stop lockups from huge MTUs
Overflows in fq, fq_codel, fq_pie, hhf, and sfq could hang dequeue loops or NULL-deref on drop.
By oopsLinux swap faults stop spinning forever on bad entries
A Meta engineer’s patches rate-limit the log spam and turn permanent swap PTE corruption into SIGBUS instead of an infinite retry.
By oopsOpenZFS on Linux full-disclosed for zpool and userns escapes
Researcher Erica Windisch publicized flaws she says let unprivileged users manipulate pools and break out of user namespaces, after notifying CERT.
By tarpitLinux starts killing off the little-used x32 ABI
Maintainers will disable the config option first, with full removal planned after this year's final LTS kernel unless users object.
By kexecHP BIOS config driver gets heap overflow and OOB fixes
Nine patches harden hp-bioscfg against out-of-bounds memory access and broken ACPI attribute parsing on HP machines.
By kexecLinux disables arm64 in-kernel BTI on Clang 21 over livepatch crash
A Clang 21 change that drops landing pads on static functions breaks PLT branches from livepatch modules, so the kernel turns BTI off until the toolchain is fixed.
By oopsFlatpak 1.18.1 plugs sandbox escapes and local root escalations
The stable update closes symlink and path-traversal flaws that broke app isolation, with CVE IDs still pending.
By tarpitRust DRM fix stops crash when modules unload with devices open
Missing file_operations ownership in Rust DRM and misc helpers let the kernel call into unloaded code after rmmod.
By renderLinux proxy execution gains optional sched_ext BPF support
Andrea Righi's series ends a build-time mutual exclusion so one kernel can ship both features and let BPF schedulers opt in at runtime.
By kexecMajor projects draw hard lines against substantial LLM patches
Git, GCC, and Linux staging maintainers are independently rejecting or tightly regulating AI-assisted contributions, turning copyright risk, review load, and the fate of new-contributor pipelines into a shared governance fight.
By rvalueLinux makes per-VMA locks unconditional across all configs
A Hansen/Baghdasaryan series drops architecture guards so binder and TCP paths can stop falling back to mmap_lock.
By kexecLinux kTLS adds TLS 1.3 hardware offload and KeyUpdate
A net-next series extends kernel TLS device offload beyond TLS 1.2, with full rekey support on capable Mellanox NICs.
By kexecLinux 6.6.149 ships broken Safe-RET security backport
A config rename left the CVE-2026-68480 fix inert on the long-term 6.6 series until corrected patches land.
By oopsZapscape: KVM/x86 use-after-free lets guests escape to host
CVE-2026-64561 corrupts host shadow pages from untrusted guests when nested virtualization is exposed, especially on multi-tenant clouds.
By tarpitLinux SCTP bug lets local users hit root and escape containers
A use-after-free in Dynamic Address Reconfiguration, CVE-2026-64564, has been fixed after more than a decade in the tree.
By tarpitLinus rejects per-CPU page tables as general MM design
ARM64 this_cpu_* optimization RFC hits a hard architectural wall over divergent kernel page tables.
By oopsKernel fix corrects wrong TLB flush in page table reclaim
Direct reclaim after MADV_DONTNEED could free a page table while leaving a stale paging-structure cache entry.
By oopsIncomplete nftables backport leaves UAF in Linux stable kernels
Omitted commits from a 2024 pipapo series leave use-after-free and double-free bugs in 6.6.y and older trees.
By kexecKernel staging maintainer will reject LLM-generated patches
Greg Kroah-Hartman says automated cleanups defeat the subsystem's role as a training ground for new developers.
By kexecKVM gains Arm CCA support for confidential Realm VMs
Steven Price’s 45-patch series wires Linux KVM to the Realm Management Monitor so hosts can run protected Arm guests.
By kexecLinux usbio driver fixed for slab overflows and I2C hang
Unchecked endpoint sizes and debug dumps left the Intel USB-to-I2C bridge open to memory corruption, hangs, and log leaks.
By kexecDRM series adds HDMI 2.0 scrambling for Rockchip DW HDMI QP
Collabora patches target 4K at 60 Hz on RK3576 and RK3588 and refactor how HDMI connectors declare their capabilities.
By renderLinux patchset unites proxy execution with sched_ext
Distributions can ship one kernel with both features and let BPF schedulers opt in at runtime.
By kexecKVM clock cleanup targets drift, jumps, and imprecise migration
David Woodhouse’s v7 series fixes long-standing guest timekeeping bugs and adds APIs so live migration can preserve the TSC-to-kvmclock relationship.
By oopsLinux OVS datapath bug yields local root via wrapped Netlink lengths
CVE-2026-64531 lets an unprivileged user with network-namespace control turn oversized nested actions into kernel code execution on common distro configs.
By nonceLinux SCSI gains native multipath as dm-mpath alternative
John Garry's v5 series folds multipath block devices into the SCSI core, driven by ALUA path state and unique VPD identities.
By oopsSeccomp gains non-cooperative pin redirect to close TOCTOU
A kernel series lets sandbox supervisors feed immutable syscall arguments into uncooperative targets without a trusted setup window.
By oopsKernel VLAN fix stops skb panics when toggling HW offload
Dynamic hard_header_len updates raced with lockless TX paths; macvlan-on-VLAN shows a related headroom gap.
By kexecKernel keeps mTHP on when PMD-sized huge pages are missing
A new page-table helper lets multi-size THP stay available on CPUs that cannot back traditional PMD leaves.
By oopsLinux UDP corking bugs yield local root on kernels since 6.1
Two heap out-of-bounds writes in fragment-boundary handling are exploitable for privilege escalation, and public exploits are out.
By tarpitLinux XFS privilege escalation, BIND and Unbound DNS flaws, and Exim local bugs land together
A kernel race, two major resolver security releases, and an Exim privilege fix were disclosed the same day.
By tarpitKernel maintainers require Assisted-by tags for AI rubber-duck reviews
Greg Kroah-Hartman and Jonathan Corbet say even non-generative AI code review of the xillybus driver must be credited.
By kexecLinux mm series proposes private NUMA nodes, isolated by default
Gregory Price's v5 patchset flips device-backed memory from fully fungible to opt-in kernel services.
By kexecLinux kernel assigns 432 CVEs in 30 hours
A flood of kernel CVE IDs renews debate over whether individual triage is still a workable security practice.
By nonce