oops
Kernel & Low-Level desk
ZDI flags CVSS 9.0 race-condition RCE in Linux KSMBD
A protocol-handler mismatch between request enqueue and dequeue can leak kernel heap memory and open an out-of-bounds write path.
Linux VFS stops stuck unmounts from freezing the host
Josef Bacik’s series makes sync, drop_caches, quotas, and remounts skip or killably wait on dying superblocks instead of hanging uninterruptibly behind one bad umount.
Kernel RFC proposes native UUID and GUID user IDs
A 41-patch series from Jan Koester would let Linux processes, files, and credentials carry 128-bit directory identities without mapping them to fragile 32-bit numbers.
BPF verifier gains 32-bit loop analysis, ships with pointer bug
Eduard Zingerman’s scalar-evolution work cuts verification cost sharply, but 32-bit pointer latches can undercount iterations and mis-bound memory access.
Kernel tool will stop CCing LKML on nearly every patch
get_maintainer will treat linux-kernel as a fallback only, aiming to cut the list’s duplicate traffic by roughly 90 percent.
Linux RDMA core gains Ultra Ethernet reliable unconnected verbs
Eric Davis of Broadcom proposes the generic uverbs ABI so UET devices can land without reinventing jobs, wide keys, and ready-to-send queue pairs in every driver.
PAGEMAP_SCAN fix pins mm to stop unprivileged UAF
A missing mm_users hold let concurrent exit free a hugetlb VMA lock under a live page-table walk.
vhost IOTLB path leaks kernel memory via unchecked user access
A CAP_NET_ADMIN controller can aim vdpa_sim virtqueues at kernel addresses and read two bytes per kick after a missing access_ok check.
BPF proposes r3-based unwinding for Rust and C++ cleanup
Alexei Starovoitov’s series lets panics and exceptions run destructors without unwind tables, new uapi, or libbpf changes.
Linux mremap shrink-and-move leaks commit charge since 6.15
Unprivileged callers can permanently inflate Committed_AS and starve the system under strict overcommit.
BPF gets bulk memory-safety and lifetime fixes
A 38-patch series closes use-after-free, RCU, and buffer-bound bugs across the verifier, maps, iterators, and networking helpers.
Kernel adds atomic mkdir-and-open via O_CREAT|O_DIRECTORY
open(2) can create a directory and return a pinning file descriptor in one step, closing a long-standing race when setting up directory trees.
BPF gains unwind cleanup pads for Rust-style resource release
Yonghong Song's bpf-next series runs landing-pad cleanups on bpf_unwind so frames that own locks or kptrs can tear down instead of being discarded.
Kernel fixes MADV_COLD race that could drop dirty THP data
Non-atomic young-bit clearing on transparent huge pages could lose concurrent writes and let reclaim discard still-dirty anonymous memory.
Torvalds posts Linux page refcount scalability series
After years of incomplete fixes for buffered read bottlenecks, Linus Torvalds mails a new approach he refined with LLM help ahead of the maintainer summit.
PCI core gains Live Update support for kexec device continuity
David Matlack’s v10 series lets selected PCI endpoints keep DMA running across a host kernel upgrade without topology or routing changes.
Kernel mm series kills VM_SPECIAL, clarifies VMA flag rules
Lorenzo Stoakes proposes 38 patches that replace overloaded special-flag checks with explicit predicates for what core mm owns and can merge.
XFS online scrub gets 21st batch of LLM-assisted repair fixes
Darrick J. Wong’s latest series hardens free-space, directory-tree, quota, and xattr repair paths that could mis-repair or overrun buffers.
Kernel isolates skb data allocations against UAF heap sprays
Kees Cook’s kmem_buckets series, capped by a Pedro Falcato networking change, gives socket-buffer payloads their own slab caches when slab buckets are enabled.
Kernel fixes RCU pathwalk use-after-frees across several filesystems
Christian Brauner patches ext4, ntfs3, tracefs, casefold, and related code so superblock data outlives concurrent RCU lookups after lazy unmount.
BPF adds unwind landing pads for resource cleanup
Kernel support for compiler-emitted cleanup tables would let bpf_unwind() run Drop-style release instead of discarding frames.
Linux shmem race corrupts page cache during hole punch
Fault-around can re-map large folios mid-punch, leaving stale mappings and exact 512-page RSS imbalances on production hosts.
KVM nSVM work assigns L2 per-vCPU ASIDs to cut TLB flushes
Yosry Ahmed's series drops dynamic ASID allocation on modern AMD CPUs and brings nested SVM closer to VMX VPID handling.
Kernel closes virtio GSO bypass that skipped flow dissection
Untrusted GSO frames without NEEDS_CSUM could evade checks, mis-place transport headers, and trigger out-of-bounds reads, especially above 64 KB.
BPF tcp_ops gains AutoLOWAT hooks to cut RPC wakeups
Google's production TCP receive low-water technique lands as opt-in bpf_tcp_ops callbacks and per-socket flags.
Linux mm drops VM_SPECIAL for explicit VMA behaviour predicates
Lorenzo Stoakes's 38-patch series replaces an overloaded flag mask with clear rules about which mappings core mm owns and manages.
RFC turns AF_XDP UMEM into a page-pool memory provider
Björn Töpel proposes letting zero-copy sockets supply RX buffers through page_pool so modern drivers stop maintaining a second receive path.
mm maintainer NAKs THP compaction series over undisclosed LLM use
Lorenzo Stoakes rejected patches aimed at costly async compaction retries, citing kernel rules on generated contributions and a flood of deep subsystem work from a brand-new contributor.
Linux IPsec fixes AES-GCM nonce reuse in ESP offload paths
A seven-part series corrects sequence handling so GSO and hardware offload no longer recycle GCM nonces or break ESN authentication.
Kernel kallsyms lookups sped up 7x for BPF tracing loads
Jim Cromie's three-patch series cuts bulk symbol attach from hundreds of milliseconds to tens, after production stalls in fleet observability tools.
Stable 6.6 gets BPF fix for sign-extended packet pointer loads
CVE-2024-47702 is closed by rejecting verifier paths that can corrupt skb data pointers and crash the kernel.
BPF gains exception cleanup pads so Rust Drop can unwind safely
A 22-patch bpf-next series adds bpf_unwind(), verifier and x86 JIT support so frames can release locks and references instead of being discarded.
Kernel objpool race can double-hand or drop objects under NMI
A nested push from kretprobe NMI context could publish past an unfinished entry, letting another CPU pop a NULL or stale pointer.
Stable kernels still exposed to CVE-2025-37964 after bad backport
Misordered TLB fix in Linux 6.1, 6.6, and 6.12 left processes able to run with stale translations.
Kernel gains Rust SPDM requester for untrusted device auth
Alistair Francis posts a standalone Rust SPDM stack and PCIe CMA TSM path so the kernel can verify devices before trusting them.
Kernel moves x86 and RISC-V AES acceleration into crypto library
Hardware-optimized AES modes become the default path for library callers, ending years of duplicated glue and disabled-by-default speedups.
BPF typed arenas RFC seeks trusted kptrs without lifetime hell
Kumar Kartikeya Dwivedi proposes kernel-only arena objects the verifier can trust; an automated review immediately flagged critical memory-safety bugs in the draft.
Debugfs string I/O races fixed after KASAN double-free repro
Concurrent readers and writers on debugfs string files could hit use-after-free and double-free without proper RCU and locking.
BPF landing pads let unwinds run cleanup for Rust panics
Kernel and libbpf support for compiler-emitted cleanup tables lets bpf_unwind() release locks and Drop-owned state instead of discarding frames.
BPF series makes vmlinux BTF an on-demand module
Jay Wang’s patches let distributions keep CO-RE and related features without forcing roughly 5.4 MB of type data into every system’s RAM from boot.
Linux unifies RCU-safe page table freeing across all architectures
A twelve-patch series from Lorenzo Stoakes finishes years of work so every architecture defers userspace page-table teardown until after an RCU grace period.
RISC-V gains IOMMU MSI remapping, unlocking DMA and VFIO by default
Andrew Jones's v6 series maps IMSIC MSI targets like DMA, letting 64-bit RISC-V turn on IOMMU_DMA, iommufd, and device assignment.
Linux mm drops VM_SPECIAL for explicit VMA flag semantics
Lorenzo Stoakes's large memory-management series replaces overloaded special flags with behaviour predicates and harder driver checks.
BPF stack limit poised to rise from 512 bytes to 2 KiB
A patch series for bpf-next would give JITed programs on x86-64 and arm64 four times the stack while keeping verifier memory in check.
BPF stack limit rises to 2KiB on x86-64 and arm64 JITs
Verifier bookkeeping is made dynamic so larger frames do not inflate memory cost for every program.
BPF gains callx for indirect subprogram calls
Alexei Starovoitov’s verifier, JIT, and libbpf work lets programs invoke static functions through pointers in tables and vtables.
BPF verifier gains widening path for long bounded loops
Alexei Starovoitov’s series stops the verifier from walking every iteration of simple loops, cutting work sharply while keeping today’s accepted programs valid.
Kernel quirk stops AMD PCIe misconfig from corrupting storage DMA
BIOS-enabled enhanced atomics on some AMD root ports were mangling 64-bit DMA, hitting SATA and NVMe drives on desktop systems.
Kbuild overhaul claims up to 90% faster no-op kernel builds
Lorenzo Stoakes’ 22-patch series attacks single-threaded bottlenecks from toolchain probes and modpost through objtool and module finalisation.
BPF exception unwinds gain cleanup pads for Rust Drop
Yonghong Song’s bpf-next series makes bpf_throw() run compiler-emitted landing pads so resource-owning frames can release locks and values on the way out.
sched_ext and proxy execution set to share one Linux kernel
Andrea Righi’s v14 series drops the build-time ban so distributions can ship both features and let BPF schedulers opt in at runtime.
Kernel finishes RCU-safe page table free for all arches
A patch series converts remaining architectures so userspace page tables are always freed after an RCU grace period, unlocking lockless walks.
Kernel fixes UAF in OVS and act_ct conntrack helpers
Unconfirmed entries could leave stale expectation pointers after extension realloc, reported against Open vSwitch and TC conntrack.
BPF verifier patch scopes callback args after kernel memory leaks
A proposed frame-owned reference type would stop helpers from handing programs pointers that outlive the call, after reports of stack exposure via ringbuf drain and array map iteration.
BPF gains indirect subprogram calls via new callx instruction
Alexei Starovoitov’s series lets the verifier and JITs accept LLVM’s function-pointer calls, unlocking vtables and dispatch tables in BPF C and Rust.
Claude-written mlx5 driver proposed for Linux VFIO selftests
Jason Gunthorpe says an AI produced a ConnectX selftest driver in days that once took months of human work.
BPF exception cleanups unlock Rust Drop on bpf_throw() unwind
The kernel and libbpf now run compiler-emitted landing pads when bpf_throw() walks the stack, so frames can release RCU locks and other owned resources.
IOMMU live-update patches aim to keep VM DMA mappings across kexec
Google's v5 series preserves Intel VT-d and iommufd domain state so assigned devices can survive a kernel live update without dropping translations.
RFC keeps KVM guests running across host kexec live updates
Pasha Tatashin’s early OrphanVM proof of concept preserves physical CPUs so vCPUs keep executing while the host kernel is replaced.
Kernel THP split path split into anon and file helpers
Kairui Song’s cleanup series separates mixed folio-split logic so swap-cache restrictions can be lifted later.
Linux arm64 drops remaining big-endian kernel support
Will Deacon's cleanup series removes dead CONFIG_CPU_BIG_ENDIAN code after the option was marked BROKEN.
Kernel series keeps mTHP on when PMD huge pages are missing
Overloaded THP availability checks no longer wipe out multi-size transparent huge pages on CPUs without PMD leaves.
Linux TLS stack gains TLS 1.3 hardware offload and rekey
A 15-patch net-next series enables NIC acceleration for TLS 1.3, including KeyUpdate, starting with Mellanox ConnectX-6 Dx and newer.
Kbuild series targets serial bottlenecks for far faster kernel builds
Lorenzo Stoakes’s v3 patches claim up to 36% faster full allmodconfig builds, roughly 70% faster incrementals, and about 90% faster no-op rebuilds.
Linux networking gains fwnode PCS provider API for external SerDes
Phylink takes ownership of PCS selection and hotplug, ending ad-hoc MAC driver wiring as external 10G blocks proliferate.
Claude builds mlx5 VFIO selftest driver in four days
Jason Gunthorpe submitted a ConnectX selftest series largely generated by Anthropic's model, cutting a job that usually takes months down to about a week.
Linux mm series keeps anonymous THPs intact across swap
Usama Arif's 29-patch work adds PMD-level swap entries so huge pages need not split on reclaim, with roughly 4x throughput on a swap-heavy benchmark.
LTS kernels still lack AF_UNIX slab UAF fix for CVE-2026-80521
An unprivileged SCM_RIGHTS path can hit a dangling pointer in the Unix socket garbage collector on four supported stable lines.
Rust PCI drivers gain SR-IOV with typed PF data sharing
A kernel series lets Rust physical-function drivers publish lifetime-checked payloads that both Rust and C virtual-function drivers can borrow safely.
AMD posts Linux support for hardware-accelerated vIOMMU
Partial AMD IOMMU virtualization lands on IOMMUFD, offloading guest command, event, and PPR log work from the hypervisor.
BPF and LSM maintainers clash over Landlock policy kfuncs
A third try at letting BPF apply userspace Landlock rulesets at exec hits the same wall: where kfuncs may live, and whether BPF should call into Landlock at all.
BPF gains by-value struct and __int128 argument support
A verifier and JIT series lets global functions and kfuncs take small scalar aggregates without the old rejections and register miscounts.
Axboe RFC: io_uring hands off thread identity on actual block
Instead of always punting blockable ops to io-wq, the series runs them inline and migrates only the user-visible identity if the submitter sleeps.
KVM guest_memfd in-place conversion aims at Linux 7.3
Google posts a revised series to flip private and shared guest pages without reallocating them, plus broader KVM selftests.
Page allocator tweak restores 161% PostgreSQL write throughput
Costly high-order folio attempts that already had smaller-order fallbacks were still paying for full direct compaction under fragmentation.
RFC lets Tasks RCU treat ordinary preemption as quiescent
Josef Bacik proposes trampoline nesting so PREEMPT_LAZY kernels stop stalling BPF and kprobe teardown behind long-running kthreads.
Kernel module loader left arch code open to bad relocation indexes
Malformed modules could crash ARM, ARM64, LoongArch, PA-RISC, and RISC-V before common validation ran.
eBPF verifier bug report flags incomplete register reset on errors
A researcher says invariant-violation recovery can leave register linkage intact, risking a verifier bypass; maintainers want a normal patch and a reproducer.
AI-written mlx5 driver lands in VFIO selftests in a week
Jason Gunthorpe used Claude to remix ConnectX DMA loopback support into kernel VFIO tests, cutting a month-plus job to days.
Rust SPDM requester proposed for Linux device authentication
Alistair Francis aims the smallest upstream SPDM stack at untrusted PCIe and related devices, with CMA wired through the TSM path.
Kbuild series slashes kernel build times by up to 36%
Lorenzo Stoakes targets single-threaded make, modpost, objtool, and Rust bottlenecks that dominate large and incremental builds.
Linux hid-asus gains full ROG Ally handheld support
Denis Benato's multi-year series lands gamepad tuning, force feedback, and sleep recovery for ASUS's Steam Deck rival.
BPF maintainer nacks pluggable RV monitors for Linux
Alexei Starovoitov rejects an RFC to load runtime-verification monitors via BPF; Steven Rostedt disputes the nack's scope.
Linus rejects kernel workaround for sparse bitwise warnings
Torvalds NAK'd a _Generic rewrite of is_signed_type() and told developers to fix sparse instead of stripping __bitwise from trace fields.
DRM scheduler core plugs fence timeline use-after-free
Unprivileged userspace could read freed GPU scheduler memory via timeline name queries on amdxdna, nouveau, and msm.
Microsoft proposes LVBS secure kernel for Linux on Hyper-V
An RFC series would let Hyper-V guests boot a small trusted kernel in VTL1 beside the normal OS, laying groundwork for Virtualization-Based Security on Linux.
Linux qdiscs clamp quantum paths that let namespaces soft-lock the host
A follow-up series closes change-path and missed-qdisc holes that restored multi-billion-iteration deficit spins under the scheduler lock.
BTF patches aim to let BPF tracers reach inlined functions
Alan Maguire proposes compact location metadata so kprobes can recover parameters at inline sites without ballooning kernel BTF.
Linux gains initial USB4 support on Apple M1, M2, and M3
A mainline patch series brings first Thunderbolt host-router bring-up to Apple Silicon, limited for now to XDomain links and USB3 tunnels.
Linux makes per-VMA locks unconditional on all configs
The change lets binder and TCP drop mmap_lock fallbacks, and Andrew Morton has queued the series for testing.
Linus Torvalds NAKs SCTP sysctl rewrite over unreadable macros
Alexey Gladkov’s RFC to replace per-namespace table cloning with sysctl_field descriptors is rejected as visually illegible, type-unsafe noise.
BPF series adds dedicated signing keyring and ML-DSA support
Daniel Borkmann's v2 patches give operators a BPF-scoped trust root for signed program loads and teach bpftool post-quantum signatures.
Linux virtual swap decouples zswap pages from disk slots
Nhat Pham's v4 series adds a persistent virtual swap device so compressed and zero-filled pages no longer reserve physical swap capacity.
Meta's 57-patch THP collapse rewrite meets kernel pushback
A migration-based engine aimed at mTHP on large base pages is told to land smaller foundations first, while AI-polished list replies draw separate fire.
Kernel race after non-leader exec frees POSIX timer on signal list
Lockless pending-signal cleanup can race with timer delivery when execve swaps thread IDs, leaving a use-after-free path.
BPF gains dedicated signing keyring and ML-DSA support
Borkmann's bpf-next series adds a BPF-scoped trust anchor for signed program loads and proves the path works with post-quantum keys.
Kernel fix stops tasks hanging forever on muxed I/O regions
A 16-year-old lost-wakeup race left processes unkillable after brief SMBus and similar contention, reachable from ordinary sensor reads.
Linux gains async device shutdown to slash reboot times
Opt-in parallel teardown can cut multi-minute waits to under a minute on systems with slow NVMe drives.
RISC-V IOMMU series unlocks MSI remap, DMA, and VFIO assign
Andrew Jones posts v4 work to translate device MSIs through the IOMMU, opening default IOMMU_DMA and userspace PCIe assignment on 64-bit RISC-V.
Kernel clamps qdisc quantum to stop lockups from huge MTUs
Overflows in fq, fq_codel, fq_pie, hhf, and sfq could hang dequeue loops or NULL-deref on drop.