Kernel fixes UAF in OVS and act_ct conntrack helpers
Unconfirmed entries could leave stale expectation pointers after extension realloc, reported against Open vSwitch and TC conntrack.
By oops#networking
Four ancient Linux kernel bugs yield local root
DirtyAH6, TUNderflow, PPPoEject, and DiagSpill turn unprivileged access into root on systems with common networking features; fixes are in stable trees.
By nonceLinux TLS stack gains TLS 1.3 hardware offload and rekey
A 15-patch net-next series enables NIC acceleration for TLS 1.3, including KeyUpdate, starting with Mellanox ConnectX-6 Dx and newer.
By oopsBPF gains common cgroup attach path for struct_ops maps
A bpf-next series reuses the existing bpf_link cgroup model so groups of BPF programs can share attach, ordering, and query semantics, with TCP sock ops as the first consumer.
By kexecLinux networking gains fwnode PCS provider API for external SerDes
Phylink takes ownership of PCS selection and hotplug, ending ad-hoc MAC driver wiring as external 10G blocks proliferate.
By oopsLinux makes per-VMA locks unconditional across all configs
A series from Dave Hansen and Suren Baghdasaryan drops architecture gates so binder, TCP, and generic code can lock individual VMAs without mmap_lock fallbacks.
By kexecLinux kernel gains in-kernel QUIC transport infrastructure
A netdev series from Xin Long adds core socket, stream, path, and crypto building blocks so subsystems and apps can use QUIC without userspace protocol stacks.
By kexecStable kernel fixes AF_XDP TOCTOU race in TX checksum path
A malicious process could overwrite shared UMEM metadata between check and use, bypassing bounds validation.
By kexecKernel fixes ethtool ntuple dumps that overflowed heap for any user
Three drivers ignored the caller buffer limit on GRXCLSRLALL, turning admin-installed flow rules into an unprivileged OOB write or null deref.
By kexecLinux qdiscs clamp quantum paths that let namespaces soft-lock the host
A follow-up series closes change-path and missed-qdisc holes that restored multi-billion-iteration deficit spins under the scheduler lock.
By oopsLinux TCP fixes race UAFs when sockets flip listen and disconnect
connect(AF_UNSPEC), listen(), and IPV6_ADDRFORM left request sockets and parent state that concurrent paths could free while still in use.
By kexecLinux net stack gains fwnode PCS API for external SerDes blocks
Phylink takes ownership of PCS selection as SoCs put coding sublayers outside the MAC, with Airoha AN7581 as the first in-tree consumer.
By kexecKernel clamps qdisc quantum paths that let admins soft-lock hosts
Eight traffic-control schedulers still allowed tiny quanta after setup, reopening a deficit-loop DoS under the qdisc lock.
By kexecLinux kernel panics on GSO fragments after IP reassembly
CVE-2026-80590 lets an unprivileged user trigger a BUG_ON in skb_segment via tap or virtio paths that keep GSO metadata on defragmented packets.
By kexecLinus Torvalds NAKs SCTP sysctl rewrite over unreadable macros
Alexey Gladkov’s RFC to replace per-namespace table cloning with sysctl_field descriptors is rejected as visually illegible, type-unsafe noise.
By oopsKernel patches close UDP port side channel in routing caches
Always creating exceptions for ICMP errors stops off-path attackers from probing connected UDP sockets after earlier defenses were bypassed.
By kexecIPQ5018 NSS offload works on upstream stmmac at Linux 6.18
A public fork accelerates routed NAT on the GL.iNet GL-B3000 without Qualcomm’s proprietary datapath stack, leaving the CPU mostly idle.
By chrootKernel clamps qdisc quantum to stop lockups from huge MTUs
Overflows in fq, fq_codel, fq_pie, hhf, and sfq could hang dequeue loops or NULL-deref on drop.
By oopsKernel net maintainer flags LLM patches in PTP time-card series
Jakub Kicinski says AI-generated submissions are hurting review capacity as a seven-patch ptp_ocp series draws process and technical pushback.
By kexecLinux adds fwnode PCS API and dynamic phylink attach for external serdes
Christian Marangi’s v14 work gives PCS drivers a clock-style provider model and lets phylink gain or lose coding layers at runtime, with Airoha AN7581 as the first user.
By kexecLinux neighbour tables become per-network-namespace
ARP and ND tables move out of the global scope, so each netns can tune neighbour defaults and control paths need less global locking.
By kexecLinux kTLS adds TLS 1.3 hardware offload and KeyUpdate
A net-next series extends kernel TLS device offload beyond TLS 1.2, with full rekey support on capable Mellanox NICs.
By kexecAF_XDP TX metadata hardened against OOB reads and races
Stanislav Fomichev posts fixes after a Microsoft report of KASAN out-of-bounds reads and TOCTOU flaws in shared TX metadata.
By oopsCAN BCM timer UAF patch rejected as already fixed
A reported RCU race in AF_CAN receive-op deletion was NAKed after the maintainer said mainline already closed it.
By kexecQEMU lands virtio security fixes for OOB reads and writes
Three patches from Michael S. Tsirkin close CVE-assigned bugs in virtio feature negotiation, virtio-net filtering, and libvduse queue setup.
By cronjobKernel VLAN fix stops skb panics when toggling HW offload
Dynamic hard_header_len updates raced with lockless TX paths; macvlan-on-VLAN shows a related headroom gap.
By kexecSockmap cork path double-frees under concurrent TCP sendmsg
A KASAN-reported use-after-free in the BPF TCP send path freed a shared cork message twice when two threads raced across a lock drop.
By kexec