Kernel fix blocks UAF in lazyfree huge-page reclaim race
An unprivileged race of MREMAP_DONTUNMAP against transparent huge page discard could free anon_vma structures still referenced by a restored mapping.
By kexecAn unprivileged race of MREMAP_DONTUNMAP against transparent huge page discard could free anon_vma structures still referenced by a restored mapping.
By kexecFault-around can re-map large folios mid-punch, leaving stale mappings and exact 512-page RSS imbalances on production hosts.
By oopsLorenzo Stoakes's 38-patch series replaces an overloaded flag mask with clear rules about which mappings core mm owns and manages.
By oopsKairui Song’s third RFC series promotes hot pages on access instead of at eviction, reporting 10–40% better results while freeing one page-flag bit.
By kexecA 30-patch series introduces PMD-level swap entries so huge anonymous mappings survive swap-out and restore in one fault instead of shattering into PTEs.
By kexecMeta’s vswap work would free zswap from disk slots, but changing how memory.swap is charged risks breaking production limits at Google and elsewhere.
By kexecOptimistic increments replace CAS loops under contended IO; Linus has acked the core change while free-path races stay open.
By kexecLorenzo Stoakes's large memory-management series replaces overloaded special flags with behaviour predicates and harder driver checks.
By oopsA fourteenth revision unifies fault handling with device-page migration, but automated review flagged livelocks, notifier imbalances, and missing TLB flushes.
By renderA patch series converts remaining architectures so userspace page tables are always freed after an RCU grace period, unlocking lockless walks.
By oopsOn kernels without an MMU, pin and unpin refcounts were asymmetric, so repeated io_uring fixed-buffer registration could free pages still mapped by userspace.
By kexecKairui Song’s cleanup series separates mixed folio-split logic so swap-cache restrictions can be lifted later.
By oopsNhat Pham's v5 series lets zswap and zero pages claim swap entries without pre-allocating physical slots, and retunes memcg swap charging to match.
By kexecOverloaded THP availability checks no longer wipe out multi-size transparent huge pages on CPUs without PMD leaves.
By oopsZi Yan's patchset replaces the page flag with pointer checks so a scarce bit can become PG_folio.
By kexecA push to delete the legacy C Binder driver, a Rust SPDM requester for untrusted device auth, and unconditional VMA locks together force the kernel to decide whether dual maintenance ends in security-sensitive paths.
By kexecKairui Song's series promotes hot folios on access, fixes PSI and workingset tracking, and stabilizes active/inactive stats while freeing one page flag bit.
By kexecCostly high-order folio attempts that already had smaller-order fallbacks were still paying for full direct compaction under fragmentation.
By oopsHugh Dickins's 26-patch rework drops most lru_add_drain calls after years of attempts, aiming to ease lruvec contention and watchdog stalls.
By kexecA sleepable SYSCALL-only helper lets policy programs reclaim from chosen cgroups without writing memory.reclaim.
By kexecA pmd_modify() mask error since Linux 6.6 could free rewritten huge pages under reclaim, and Polars users hit it in production.
By kexecLorenzo Stoakes finishes the conversion so lockless RCU page-table walks become safe kernel-wide.
By kexecThe change lets binder and TCP drop mmap_lock fallbacks, and Andrew Morton has queued the series for testing.
By oopsNhat Pham's v4 series adds a persistent virtual swap device so compressed and zero-filled pages no longer reserve physical swap capacity.
By oopsA migration-based engine aimed at mTHP on large base pages is told to land smaller foundations first, while AI-polished list replies draw separate fire.
By oopsA Meta engineer’s patches rate-limit the log spam and turn permanent swap PTE corruption into SIGBUS instead of an infinite retry.
By oopsA Hansen/Baghdasaryan series drops architecture guards so binder and TCP paths can stop falling back to mmap_lock.
By kexecDirect reclaim after MADV_DONTNEED could free a page table while leaving a stale paging-structure cache entry.
By oopsZi Yan’s series would free a scarce page-flag bit by treating a non-NULL private pointer as the sole signal that a page carries filesystem or driver state.
By kexecFEAT_D128 support would let Linux use the VMSAv9-128 translation regime on ARMv9.3 hardware.
By kexecAMD's pghot v8 consolidates access tracking from hint faults and hardware samplers, then drives batched promotions via per-node kernel threads.
By kexecA new page-table helper lets multi-size THP stay available on CPUs that cannot back traditional PMD leaves.
By oopsThe fix unsticks tiered-memory workloads but can slow KVM guests that relied on the old broken skip.
By oopsNon-movable allocations no longer thrash swap when defrag_mode cannot claim free pages from movable blocks.
By oopsGregory Price's v5 patchset flips device-backed memory from fully fungible to opt-in kernel services.
By kexec