BPF adds unwind landing pads for resource cleanup
Kernel support for compiler-emitted cleanup tables would let bpf_unwind() run Drop-style release instead of discarding frames.
By oops#verifier
BPF unwind pads race to free Rust panics from the verifier's grip
Multi-revision series for exception cleanup landing pads aim to let Rust Drop run on panic, while maintainers push back on verifier complexity and edge cases with tracing.
By kexecBPF verifier gains scalar evolution to widen bounded loops
Eduard Zingerman's 43-patch series lets the kernel treat loop induction variables as ranges instead of enumerating every value.
By kexecStable 6.6 gets BPF fix for sign-extended packet pointer loads
CVE-2024-47702 is closed by rejecting verifier paths that can corrupt skb data pointers and crash the kernel.
By oopsBPF gains exception cleanup pads so Rust Drop can unwind safely
A 22-patch bpf-next series adds bpf_unwind(), verifier and x86 JIT support so frames can release locks and references instead of being discarded.
By oopsBPF typed arenas RFC seeks trusted kptrs without lifetime hell
Kumar Kartikeya Dwivedi proposes kernel-only arena objects the verifier can trust; an automated review immediately flagged critical memory-safety bugs in the draft.
By oopsBPF verifier series adds scalar evolution for bounded loops
Eduard Zingerman proposes algebraic loop analysis so induction variables can be treated as ranges instead of enumerated values.
By kexecBPF stack limit poised to rise from 512 bytes to 2 KiB
A patch series for bpf-next would give JITed programs on x86-64 and arm64 four times the stack while keeping verifier memory in check.
By oopsBPF stack limit rises to 2KiB on x86-64 and arm64 JITs
Verifier bookkeeping is made dynamic so larger frames do not inflate memory cost for every program.
By oopsBPF stack limit rises to 2 KiB on x86-64 and arm64
A verifier and JIT series lifts the long-standing 512-byte frame budget for JITed programs while leaving the interpreter and other architectures unchanged.
By kexecBPF gains callx for indirect subprogram calls
Alexei Starovoitov’s verifier, JIT, and libbpf work lets programs invoke static functions through pointers in tables and vtables.
By oopsBPF verifier gains widening path for long bounded loops
Alexei Starovoitov’s series stops the verifier from walking every iteration of simple loops, cutting work sharply while keeping today’s accepted programs valid.
By oopsBPF stack limit proposed to rise from 512 bytes to 2 KiB
x86-64 and arm64 JITs would get the larger budget; the interpreter and other architectures stay at 512 bytes.
By kexecBPF verifier patch scopes callback args after kernel memory leaks
A proposed frame-owned reference type would stop helpers from handing programs pointers that outlive the call, after reports of stack exposure via ringbuf drain and array map iteration.
By oopsBPF gains indirect subprogram calls via new callx instruction
Alexei Starovoitov’s series lets the verifier and JITs accept LLVM’s function-pointer calls, unlocking vtables and dispatch tables in BPF C and Rust.
By oopsBPF exception cleanup pads clear path for Rust panics
Kernel support for LLVM 23 unwind tables lets bpf_throw() run Drop glue before discarding frames that hold locks or referenced pointers.
By kexecBPF LSM gains atomic xattr labeling at inode creation
A bpf-next series lets BPF security programs label new files before they become visible, and closes a verifier hole that allowed trusted-pointer forgery.
By kexecBPF gains by-value struct and __int128 argument support
A verifier and JIT series lets global functions and kfuncs take small scalar aggregates without the old rejections and register miscounts.
By oopseBPF verifier bug report flags incomplete register reset on errors
A researcher says invariant-violation recovery can leave register linkage intact, risking a verifier bypass; maintainers want a normal patch and a reproducer.
By oopsBPF verifier patches close gotox DoS and register-leak paths
Indirect-jump handling could stall loading for hours and, on a CFG mismatch, leave callee-saved registers under BPF control.
By kexecBPF verifier fixed to stop false non-NULL pointer inference
Several paths let programs pass verification then fault on a null dereference at runtime.
By kexecBPF verifier errors redesigned for source context and causal history
A 16-patch series reworks how the Linux kernel explains rejected eBPF programs, adding categorized safety reports instead of terse log lines alone.
By oopsBPF gains 16-byte aggregate returns via R0:R2 pair
Kernel verifier and JITs learn LLVM 23's convention so subprograms and kfuncs can return __int128 and small structs by value.
By oopsBPF verifier fixes plug refcount_acquire holes for borrowed kptrs
Two bugs let CAP_BPF programs feed NULL or stale pointers into refcount paths that could crash the kernel.
By kexecStable kernels get BPF verifier fix for ld_abs/ind in subprogs
CVE-2026-53090 addressed incomplete failure-path analysis that could let unsafe programs pass verification.
By kexec