Ext4 buffered I/O moves to iomap in large opt-in series
Zhang Yi’s 31-patch v7 lands the core conversion and a new disksize-pending scheme, still off by default until more features catch up.
By kexec#linux
Kernel fix blocks UAF in lazyfree huge-page reclaim race
An unprivileged race of MREMAP_DONTUNMAP against transparent huge page discard could free anon_vma structures still referenced by a restored mapping.
By kexecLinux netdev adds fwnode PCS provider API for external serdes
Christian Marangi’s series gives phylink a producer-consumer model for Physical Coding Sublayer devices and lands first support on Airoha AN7581.
By kexecLinux watch queue race lets unprivileged users panic the kernel
A fix makes sizing of key-notification pipes atomic so concurrent posters cannot hit a null buffer and crash the system.
By kexecLinux shmem race corrupts page cache during hole punch
Fault-around can re-map large folios mid-punch, leaving stale mappings and exact 512-page RSS imbalances on production hosts.
By oopsget_maintainer change would stop auto-CCing every patch to LKML
A proposed fix treats THE REST as a true fallback so subsystem lists no longer share the firehose with linux-kernel by default.
By kexecKVM nSVM work assigns L2 per-vCPU ASIDs to cut TLB flushes
Yosry Ahmed's series drops dynamic ASID allocation on modern AMD CPUs and brings nested SVM closer to VMX VPID handling.
By oopsKernel closes virtio GSO bypass that skipped flow dissection
Untrusted GSO frames without NEEDS_CSUM could evade checks, mis-place transport headers, and trigger out-of-bounds reads, especially above 64 KB.
By oopsLinux SCSI target fixes eight SG overruns hit via vhost-scsi
Guest commands through page-per-entry virtqueue layouts could push host target code past scatterlist bounds into adjacent memory.
By kexecbnxt_en DMA faults after link-layer headroom change
A latent short-packet padding bug in Broadcom’s NetXtreme-E driver, exposed by a kernel headroom bump, was taking interfaces down within minutes.
By kexecLinux mm drops VM_SPECIAL for explicit VMA behaviour predicates
Lorenzo Stoakes's 38-patch series replaces an overloaded flag mask with clear rules about which mappings core mm owns and manages.
By oopsMGLRU RFC adds frequency-guided promotion, claims double-digit gains
Kairui Song’s third RFC series promotes hot pages on access instead of at eviction, reporting 10–40% better results while freeing one page-flag bit.
By kexecmm maintainer NAKs THP compaction series over undisclosed LLM use
Lorenzo Stoakes rejected patches aimed at costly async compaction retries, citing kernel rules on generated contributions and a flood of deep subsystem work from a brand-new contributor.
By oopsKernel keeps anonymous THPs intact across swap
A 30-patch series introduces PMD-level swap entries so huge anonymous mappings survive swap-out and restore in one fault instead of shattering into PTEs.
By kexecKVM hardens teardown against host memory corruption
Nested VMX could write guest state into the wrong process address space while a VM dies, and the fix also closes a PowerPC shadow-page leak.
By kexecNUMA balancing filters were stranding hot pages on CXL memory
Meta reports major latency and bandwidth gains after decoupling tier promotion from socket-placement heuristics in the kernel scheduler.
By kexecLinux IPsec fixes AES-GCM nonce reuse in ESP offload paths
A seven-part series corrects sequence handling so GSO and hardware offload no longer recycle GCM nonces or break ESN authentication.
By oopsBranch Target Reuse brings Spectre-v2 back to JIT engines
VUSec shows stale branch predictors can turn code-cache reuse into speculative execute-after-free across kernel BPF, GraalVM, and Firefox.
By nonceStable kernels still exposed to CVE-2025-37964 after bad backport
Misordered TLB fix in Linux 6.1, 6.6, and 6.12 left processes able to run with stale translations.
By oopsJ1939 CAN bug lets local user panic Linux with bad packet offset
An unvalidated Extended Transport Protocol offset on virtual CAN triggers a NULL dereference and kernel panic without hardware or races.
By kexecKernel moves x86 and RISC-V AES acceleration into crypto library
Hardware-optimized AES modes become the default path for library callers, ending years of duplicated glue and disabled-by-default speedups.
By oopsDebugfs string I/O races fixed after KASAN double-free repro
Concurrent readers and writers on debugfs string files could hit use-after-free and double-free without proper RCU and locking.
By oopsLinux unifies RCU-safe page table freeing across all architectures
A twelve-patch series from Lorenzo Stoakes finishes years of work so every architecture defers userspace page-table teardown until after an RCU grace period.
By oopsLinux mm series reworks folio refcounts for read scalability
Optimistic increments replace CAS loops under contended IO; Linus has acked the core change while free-path races stay open.
By kexecLinus tightens rc rules after networking pull includes old ovpn fixes
Torvalds pulled Linux 7.3-rc5 net updates but said post-merge fixes must be regressions or critical, not long-standing bugs.
By kexecLinux mm drops VM_SPECIAL for explicit VMA flag semantics
Lorenzo Stoakes's large memory-management series replaces overloaded special flags with behaviour predicates and harder driver checks.
By oopsKernel quirk stops AMD PCIe misconfig from corrupting storage DMA
BIOS-enabled enhanced atomics on some AMD root ports were mangling 64-bit DMA, hitting SATA and NVMe drives on desktop systems.
By oopsKbuild overhaul claims up to 90% faster no-op kernel builds
Lorenzo Stoakes’ 22-patch series attacks single-threaded bottlenecks from toolchain probes and modpost through objtool and module finalisation.
By oopssched_ext and proxy execution set to share one Linux kernel
Andrea Righi’s v14 series drops the build-time ban so distributions can ship both features and let BPF schedulers opt in at runtime.
By oopsGlibc ld.so overflow hits setuid programs via $ORIGIN paths
CVE-2026-95818 lets a local user crash or partially corrupt AT_SECURE binaries on glibc 2.14 through 2.44.
By segfaultglibc ld.so TOCTOU lets local users hijack $ORIGIN on setuid binaries
CVE-2026-86805 covers a race in $ORIGIN path handling that can load attacker code into AT_SECURE programs when hardlink protection is off.
By segfaultClaude-written mlx5 driver proposed for Linux VFIO selftests
Jason Gunthorpe says an AI produced a ConnectX selftest driver in days that once took months of human work.
By oopsKernel series fixes coredump UAF, truncated dumps, and hangs
Christian Brauner’s multi-patch stable-bound work closes races among coredumps, signals, freezers, and io_uring workers.
By kexecLinux perf drops embedded Python for standalone scripts
Ian Rogers's 49-patch series finishes moving perf analysis scripts onto a C extension module, cutting overhead and build complexity.
By kexecLinus demands real users before hazard pointers land
McKenney and Desnoyers floated a full RFC series; Torvalds wants core conversions and real workload numbers, not torture tests.
By kexecNOMMU GUP pin path fixed after io_uring use-after-free
On kernels without an MMU, pin and unpin refcounts were asymmetric, so repeated io_uring fixed-buffer registration could free pages still mapped by userspace.
By kexecStable kernels need alternate fix for AF_UNIX UAF
CVE-2026-64109 still affects long-term trees after mainline removed a dangerous tail length read unsuitable before 6.5.
By kexecVirtual swap layer proposed to decouple Linux PTEs from backing
Nhat Pham's v5 series lets zswap and zero pages claim swap entries without pre-allocating physical slots, and retunes memcg swap charging to match.
By kexecLinux arm64 drops remaining big-endian kernel support
Will Deacon's cleanup series removes dead CONFIG_CPU_BIG_ENDIAN code after the option was marked BROKEN.
By oopsperf trace stops vetoing syscalls for every concurrent tracer
Ian Rogers moves filtering into BPF maps so a single session can no longer drop raw_syscalls events system-wide, and the exclusive test tags that hid the problem can go.
By kexecLinux NUMA series unblocks promotion of hot slow-tier memory
Filters meant to calm socket placement were stranding hot pages on CXL, and Meta patches separate the two jobs.
By kexecFour ancient Linux kernel bugs yield local root
DirtyAH6, TUNderflow, PPPoEject, and DiagSpill turn unprivileged access into root on systems with common networking features; fixes are in stable trees.
By nonceKernel series keeps mTHP on when PMD huge pages are missing
Overloaded THP availability checks no longer wipe out multi-size transparent huge pages on CPUs without PMD leaves.
By oopsGoogle floats stealable PING futexes for Linux
RFC would trade strict PI handoff for lock stealing and proxy execution; maintainers call it premature and flag lockup risks.
By kexecLinux networking gains fwnode PCS provider API for external SerDes
Phylink takes ownership of PCS selection and hotplug, ending ad-hoc MAC driver wiring as external 10G blocks proliferate.
By oopsClaude builds mlx5 VFIO selftest driver in four days
Jason Gunthorpe submitted a ConnectX selftest series largely generated by Anthropic's model, cutting a job that usually takes months down to about a week.
By oopsKVM/arm64 nested virt flaw allows guest escape to host
CVE-2026-89775 leaves a freed host page writable to the guest when nested virtualization is enabled, enabling cloud breakout and local root on some setups.
By tarpitLinux mm series keeps anonymous THPs intact across swap
Usama Arif's 29-patch work adds PMD-level swap entries so huge pages need not split on reclaim, with roughly 4x throughput on a swap-heavy benchmark.
By oopsLinux makes per-VMA locks unconditional across all configs
A series from Dave Hansen and Suren Baghdasaryan drops architecture gates so binder, TCP, and generic code can lock individual VMAs without mmap_lock fallbacks.
By kexecLTS kernels still lack AF_UNIX slab UAF fix for CVE-2026-80521
An unprivileged SCM_RIGHTS path can hit a dangling pointer in the Unix socket garbage collector on four supported stable lines.
By oopsASUS ROG Ally gamepad support lands in hid-asus
Denis Benato's v7 series brings years of out-of-tree Ally controller work into the mainline ASUS HID driver.
By kexecKVM arm64 gets basic plumbing for Arm CCA Realms
Arm posts the eighteenth revision of structural KVM changes for confidential Realm VMs, still short of a runnable guest.
By kexecAMD posts Linux support for hardware-accelerated vIOMMU
Partial AMD IOMMU virtualization lands on IOMMUFD, offloading guest command, event, and PPR log work from the hypervisor.
By oopsLinux MM drops PG_private to free a flag bit for folios
Zi Yan's patchset replaces the page flag with pointer checks so a scarce bit can become PG_folio.
By kexecLinux kernel gains in-kernel QUIC transport infrastructure
A netdev series from Xin Long adds core socket, stream, path, and crypto building blocks so subsystems and apps can use QUIC without userspace protocol stacks.
By kexecRFC shards procfs inode lists to cut lock storms on big boxes
Huang Shijie reports a 50% Hadoop speedup on a 384-CPU Hygon system after the global procfs inode lock fell from a 90% hotspot to about 1%.
By kexecKbuild series cuts Linux kernel build times by up to 90%
Lorenzo Stoakes targets single-threaded bottlenecks in kallsyms, modpost, nm, and make dependency checks.
By kexecNVIDIA posts vGPU manager series for nova-core kernel driver
A 32-patch v2 submission adds host-side creation, VRAM layout, and GSP plugin control for NVIDIA virtual GPUs on Linux.
By kexecLinux drops legacy C Binder driver for Rust rewrite
Google maintainers say the 15-year-old IPC code is too fragile to keep, and the Rust port is already shipping on Android.
By kexecLinux fixes SRv6 decap flaw causing IPv6 out-of-bounds read
CVE-2026-80976 covers stale outer-packet metadata left on the inner packet after Segment Routing decapsulation, reachable by an unprivileged local user.
By kexec