Kernel gains in-tree agent skill for correct Fixes tags
Sasha Levin proposes a portable find-fixes procedure after maintainers flagged widespread wrong attribution in stable backports.
By kexec#stable
Stable 6.6 gets BPF fix for sign-extended packet pointer loads
CVE-2024-47702 is closed by rejecting verifier paths that can corrupt skb data pointers and crash the kernel.
By oopsStable kernels still exposed to CVE-2025-37964 after bad backport
Misordered TLB fix in Linux 6.1, 6.6, and 6.12 left processes able to run with stale translations.
By oopsnf_tables UAF fix headed to Linux 6.12, 6.6, and 6.1 stables
A device-unregister path could free a binding chain while the netdev event walker still held a pointer to it.
By kexecStable kernels need alternate fix for AF_UNIX UAF
CVE-2026-64109 still affects long-term trees after mainline removed a dangerous tail length read unsuitable before 6.5.
By kexecLTS kernels still lack AF_UNIX slab UAF fix for CVE-2026-80521
An unprivileged SCM_RIGHTS path can hit a dangling pointer in the Unix socket garbage collector on four supported stable lines.
By oopsStable kernel fixes AF_XDP TOCTOU race in TX checksum path
A malicious process could overwrite shared UMEM metadata between check and use, bypassing bounds validation.
By kexecStable kernel USB hub change crashes Threadripper under ADB load
A 6.12 stable backport meant to wake nested USB3 devices is blamed for hard MCE resets when Android tooling hammers the root hub.
By kexecLinux 6.6.149 ships broken Safe-RET security backport
A config rename left the CVE-2026-68480 fix inert on the long-term 6.6 series until corrected patches land.
By oopsIncomplete nftables backport leaves UAF in Linux stable kernels
Omitted commits from a 2024 pipapo series leave use-after-free and double-free bugs in 6.6.y and older trees.
By kexecksmbd ACL packing fixed to block malformed DACLs and OOB reads
Authenticated clients could force undersized ACL headers or heap out-of-bounds reads via crafted security descriptors.
By oopsKernel fix stops reclaim storms under vm.defrag_mode
Non-movable allocations no longer thrash swap when defrag_mode cannot claim free pages from movable blocks.
By oopsCVE triage under flood: when volume outruns judgment
A single-day blast of hundreds of kernel CVEs, arriving beside real high-impact bugs in snapd, QEMU, and libraries, forces the old argument over mass assignment into operational terms.
By nonce