ZDI flags CVSS 9.0 race-condition RCE in Linux KSMBD
A protocol-handler mismatch between request enqueue and dequeue can leak kernel heap memory and open an out-of-bounds write path.
By oops#linux
Linux VFS stops stuck unmounts from freezing the host
Josef Bacik’s series makes sync, drop_caches, quotas, and remounts skip or killably wait on dying superblocks instead of hanging uninterruptibly behind one bad umount.
By oopsLinux gains virtual swap so zswap works without a swapfile
Nhat Pham’s vswap layer decouples swap slots from disk, with on-demand physical fallback and cgroup accounting that only charges real backing.
By kexecKernel tool will stop CCing LKML on nearly every patch
get_maintainer will treat linux-kernel as a fallback only, aiming to cut the list’s duplicate traffic by roughly 90 percent.
By oopsNetherlands builds sovereign government desktop on NixOS
DAWO targets reproducible public-sector workstations after a Microsoft cutoff at the ICC underscored foreign software risk.
By chrootPAGEMAP_SCAN fix pins mm to stop unprivileged UAF
A missing mm_users hold let concurrent exit free a hugetlb VMA lock under a live page-table walk.
By oopsLinux RFC lets hot page-cache reads skip folio refcounts
Meta reworks a Linus Torvalds idea so multi-CPU small reads stop bouncing the same folio's reference count.
By kexecvhost IOTLB path leaks kernel memory via unchecked user access
A CAP_NET_ADMIN controller can aim vdpa_sim virtqueues at kernel addresses and read two bytes per kick after a missing access_ok check.
By oopsKernel scripts/ set to shed its last Perl utilities
An RFC finishes converting all seventeen tools there to Python 3, stdlib only.
By kexecDriver core deadlock freezes probe on sysfs read since 5.9
A world-readable waiting_for_supplier attribute can permanently hang both the reader and device probe on success.
By kexecLinux mremap shrink-and-move leaks commit charge since 6.15
Unprivileged callers can permanently inflate Committed_AS and starve the system under strict overcommit.
By oopsKernfs patch ends multi-minute cgroupfs stalls under OOM
Meta moves inode allocation off the shared kernfs lock after fleet hangs that blocked oomd and init while memory-max containers reclaimed.
By kexecLinux tightens virtio-net checksum handling against untrusted devices
Ingress path now validates partial checksum metadata so guest or hardware edits cannot leave the stack with two views of the same packet.
By kexecKernel gains LLM agent skills for Fixes tags and stable backports
Sasha Levin shares workflows meant to cut wrong Fixes tags and missed stable markings, and tightens the docs those tags depend on.
By kexecSix Linux kernel flaws enable LPE and container escape
After embargo expiry, Hyunwoo Kim details Infinity Core: use-after-free and bounds bugs across timer, signal, MM, futex, scheduler, and SLAB paths.
By tarpitKernel adds atomic mkdir-and-open via O_CREAT|O_DIRECTORY
open(2) can create a directory and return a pinning file descriptor in one step, closing a long-standing race when setting up directory trees.
By oopsKernel series cuts CPU hotplug time 21x on large Xeon systems
Patches remove obsolete cache flushes and fix quadratic scheduler and accounting work that dominated sequential online and offline on high-core x86 servers.
By kexecMGLRU gains frequency-guided promotion in v4 patch series
Kairui Song’s Multi-Gen LRU work promotes hot pages on access rather than waiting for eviction feedback, cutting I/O and reclaim pressure on many workloads.
By kexecKernel adds Clang attribute to force explicit struct init
Mandatory seq_file callbacks are the first annotated fields so missing initializers become compile-time warnings.
By kexecKernel fixes MADV_COLD race that could drop dirty THP data
Non-atomic young-bit clearing on transparent huge pages could lose concurrent writes and let reclaim discard still-dirty anonymous memory.
By oopsKernel maintainers move to drop Assisted-by AI attribution tag
Summit consensus and maintainer fatigue push the Linux project to scrap a short-lived requirement that patches disclose LLM help.
By kexecLinux vhost IOTLB cache flaw allows LPE and VM escape
CVE-2026-74580 lets local users with vhost device access gain arbitrary kernel read/write, and can escalate to QEMU heap control from certain guests.
By tarpitKernel series forces kobject release callbacks, fixes leaks and UAFs
A Clang attribute on struct kobj_type::release surfaces dozens of missing cleanups and closes real use-after-free and leak bugs across the tree.
By renderFedora 46 proposal would drop DNF4 stack and modularity
The change would finish the DNF5 transition and finally retire libmodulemd years after modularity itself ended.
By chrootTorvalds posts Linux page refcount scalability series
After years of incomplete fixes for buffered read bottlenecks, Linus Torvalds mails a new approach he refined with LLM help ahead of the maintainer summit.
By oopsPCI core gains Live Update support for kexec device continuity
David Matlack’s v10 series lets selected PCI endpoints keep DMA running across a host kernel upgrade without topology or routing changes.
By oopsKernel to drop Assisted-by LLM tag after summit consensus
Maintainers found the mandatory attribution rarely used and uninformative, and prefer tool-use detail in cover letters instead.
By kexecLinux 6.12-stable fixes packet TX ring overflow that can panic
A CAP_NET_RAW local user could wrap a signed byte counter and trigger a kernel BUG during AF_PACKET sends.
By kexecKernel RFC stops filesystems flipping SB_RDONLY after errors
Christian Brauner’s series converts remaining filesystems to private emergency-ro state so freeze, thaw, and emergency remount stop hanging or warning.
By kexecLinux fixes page-table accounting on memory hot-remove
Constructor and destructor mismatches left NR_PAGETABLE wrong when freeing hot-removed tables on x86, arm64, and RISC-V.
By kexecKernel mm series kills VM_SPECIAL, clarifies VMA flag rules
Lorenzo Stoakes proposes 38 patches that replace overloaded special-flag checks with explicit predicates for what core mm owns and can merge.
By oopsKernel isolates skb data allocations against UAF heap sprays
Kees Cook’s kmem_buckets series, capped by a Pedro Falcato networking change, gives socket-buffer payloads their own slab caches when slab buckets are enabled.
By oopsExt4 buffered I/O moves to iomap in large opt-in series
Zhang Yi’s 31-patch v7 lands the core conversion and a new disksize-pending scheme, still off by default until more features catch up.
By kexecKernel fix blocks UAF in lazyfree huge-page reclaim race
An unprivileged race of MREMAP_DONTUNMAP against transparent huge page discard could free anon_vma structures still referenced by a restored mapping.
By kexecLinux netdev adds fwnode PCS provider API for external serdes
Christian Marangi’s series gives phylink a producer-consumer model for Physical Coding Sublayer devices and lands first support on Airoha AN7581.
By kexecLinux watch queue race lets unprivileged users panic the kernel
A fix makes sizing of key-notification pipes atomic so concurrent posters cannot hit a null buffer and crash the system.
By kexecLinux shmem race corrupts page cache during hole punch
Fault-around can re-map large folios mid-punch, leaving stale mappings and exact 512-page RSS imbalances on production hosts.
By oopsget_maintainer change would stop auto-CCing every patch to LKML
A proposed fix treats THE REST as a true fallback so subsystem lists no longer share the firehose with linux-kernel by default.
By kexecKVM nSVM work assigns L2 per-vCPU ASIDs to cut TLB flushes
Yosry Ahmed's series drops dynamic ASID allocation on modern AMD CPUs and brings nested SVM closer to VMX VPID handling.
By oopsKernel closes virtio GSO bypass that skipped flow dissection
Untrusted GSO frames without NEEDS_CSUM could evade checks, mis-place transport headers, and trigger out-of-bounds reads, especially above 64 KB.
By oopsLinux SCSI target fixes eight SG overruns hit via vhost-scsi
Guest commands through page-per-entry virtqueue layouts could push host target code past scatterlist bounds into adjacent memory.
By kexecbnxt_en DMA faults after link-layer headroom change
A latent short-packet padding bug in Broadcom’s NetXtreme-E driver, exposed by a kernel headroom bump, was taking interfaces down within minutes.
By kexecLinux mm drops VM_SPECIAL for explicit VMA behaviour predicates
Lorenzo Stoakes's 38-patch series replaces an overloaded flag mask with clear rules about which mappings core mm owns and manages.
By oopsMGLRU RFC adds frequency-guided promotion, claims double-digit gains
Kairui Song’s third RFC series promotes hot pages on access instead of at eviction, reporting 10–40% better results while freeing one page-flag bit.
By kexecmm maintainer NAKs THP compaction series over undisclosed LLM use
Lorenzo Stoakes rejected patches aimed at costly async compaction retries, citing kernel rules on generated contributions and a flood of deep subsystem work from a brand-new contributor.
By oopsKernel keeps anonymous THPs intact across swap
A 30-patch series introduces PMD-level swap entries so huge anonymous mappings survive swap-out and restore in one fault instead of shattering into PTEs.
By kexecKVM hardens teardown against host memory corruption
Nested VMX could write guest state into the wrong process address space while a VM dies, and the fix also closes a PowerPC shadow-page leak.
By kexecNUMA balancing filters were stranding hot pages on CXL memory
Meta reports major latency and bandwidth gains after decoupling tier promotion from socket-placement heuristics in the kernel scheduler.
By kexecLinux IPsec fixes AES-GCM nonce reuse in ESP offload paths
A seven-part series corrects sequence handling so GSO and hardware offload no longer recycle GCM nonces or break ESN authentication.
By oopsBranch Target Reuse brings Spectre-v2 back to JIT engines
VUSec shows stale branch predictors can turn code-cache reuse into speculative execute-after-free across kernel BPF, GraalVM, and Firefox.
By nonceStable kernels still exposed to CVE-2025-37964 after bad backport
Misordered TLB fix in Linux 6.1, 6.6, and 6.12 left processes able to run with stale translations.
By oopsJ1939 CAN bug lets local user panic Linux with bad packet offset
An unvalidated Extended Transport Protocol offset on virtual CAN triggers a NULL dereference and kernel panic without hardware or races.
By kexecKernel moves x86 and RISC-V AES acceleration into crypto library
Hardware-optimized AES modes become the default path for library callers, ending years of duplicated glue and disabled-by-default speedups.
By oopsDebugfs string I/O races fixed after KASAN double-free repro
Concurrent readers and writers on debugfs string files could hit use-after-free and double-free without proper RCU and locking.
By oopsLinux unifies RCU-safe page table freeing across all architectures
A twelve-patch series from Lorenzo Stoakes finishes years of work so every architecture defers userspace page-table teardown until after an RCU grace period.
By oopsLinux mm series reworks folio refcounts for read scalability
Optimistic increments replace CAS loops under contended IO; Linus has acked the core change while free-path races stay open.
By kexecLinus tightens rc rules after networking pull includes old ovpn fixes
Torvalds pulled Linux 7.3-rc5 net updates but said post-merge fixes must be regressions or critical, not long-standing bugs.
By kexecLinux mm drops VM_SPECIAL for explicit VMA flag semantics
Lorenzo Stoakes's large memory-management series replaces overloaded special flags with behaviour predicates and harder driver checks.
By oopsKernel quirk stops AMD PCIe misconfig from corrupting storage DMA
BIOS-enabled enhanced atomics on some AMD root ports were mangling 64-bit DMA, hitting SATA and NVMe drives on desktop systems.
By oopsKbuild overhaul claims up to 90% faster no-op kernel builds
Lorenzo Stoakes’ 22-patch series attacks single-threaded bottlenecks from toolchain probes and modpost through objtool and module finalisation.
By oops