BPF gains kfunc to drive proactive memcg reclaim
A sleepable SYSCALL-only helper lets policy programs reclaim from chosen cgroups without writing memory.reclaim.
By kexecKernel & Low-Level
Linux hid-asus gains full ROG Ally handheld support
Denis Benato's multi-year series lands gamepad tuning, force feedback, and sleep recovery for ASUS's Steam Deck rival.
By oopsBPF verifier fixed to stop false non-NULL pointer inference
Several paths let programs pass verification then fault on a null dereference at runtime.
By kexecDRM scheduler fence UAF still open after two driver CVEs
A core use-after-free in timeline-name handling still hits amdxdna, nouveau, and msm, and a proposed cache fix was pulled after lifetime objections.
By kexecBPF maintainer nacks pluggable RV monitors for Linux
Alexei Starovoitov rejects an RFC to load runtime-verification monitors via BPF; Steven Rostedt disputes the nack's scope.
By oopsLinus rejects kernel workaround for sparse bitwise warnings
Torvalds NAK'd a _Generic rewrite of is_signed_type() and told developers to fix sparse instead of stripping __bitwise from trace fields.
By oopsKernel fixes ethtool ntuple dumps that overflowed heap for any user
Three drivers ignored the caller buffer limit on GRXCLSRLALL, turning admin-installed flow rules into an unprivileged OOB write or null deref.
By kexecExt4 buffered I/O shifts from buffer_head to iomap
Zhang Yi posts v6 of a 31-patch series that modernizes regular-file buffered reads and writes while reworking EOF and journal ordering.
By kexecx86 kernel bug dropped dirty bit, silently losing THP data
A pmd_modify() mask error since Linux 6.6 could free rewritten huge pages under reclaim, and Polars users hit it in production.
By kexecDRM scheduler core plugs fence timeline use-after-free
Unprivileged userspace could read freed GPU scheduler memory via timeline name queries on amdxdna, nouveau, and msm.
By oopsArm64 adopts generic syscall entry in the Linux kernel
A long-running conversion brings AArch64 in line with x86 and RISC-V, shrinking arch-specific tracing code and unlocking shared syscall features.
By kexecutil-linux 2.41.6 fixes three CVEs in mount, nsenter, unshare
The point release stops failed mount helpers from still running privileged post-mount hooks, closes a local TOCTOU on source paths, and seals fd leaks plus a leftover wall/write hostname injection.
By kexecMicrosoft proposes LVBS secure kernel for Linux on Hyper-V
An RFC series would let Hyper-V guests boot a small trusted kernel in VTL1 beside the normal OS, laying groundwork for Virtualization-Based Security on Linux.
By oopsLinux qdiscs clamp quantum paths that let namespaces soft-lock the host
A follow-up series closes change-path and missed-qdisc holes that restored multi-billion-iteration deficit spins under the scheduler lock.
By oopsBTF patches aim to let BPF tracers reach inlined functions
Alan Maguire proposes compact location metadata so kprobes can recover parameters at inline sites without ballooning kernel BTF.
By oopsKernel makes page-table freeing RCU-safe on every architecture
Lorenzo Stoakes finishes the conversion so lockless RCU page-table walks become safe kernel-wide.
By kexecLinux TCP fixes race UAFs when sockets flip listen and disconnect
connect(AF_UNSPEC), listen(), and IPV6_ADDRFORM left request sockets and parent state that concurrent paths could free while still in use.
By kexecLinux net stack gains fwnode PCS API for external SerDes blocks
Phylink takes ownership of PCS selection as SoCs put coding sublayers outside the MAC, with Airoha AN7581 as the first in-tree consumer.
By kexecrtl8723bs WPS copy bug allows remote stack overflow on scan
A proposed fix for attacker-controlled beacon attributes still drew maintainer objections over correctness and testing.
By kexecIBM posts KVM series to run arm64 guests on s390 hosts
A seventh-round patch set wires arm64 KVM code into s390 via shared markers and a new SAE instruction for hardware-accelerated guests.
By kexecRISC-V IOMMU gains MSI remapping, default DMA-IOMMU, and VFIO
A redesigned MSI path lets 64-bit RISC-V translate interrupt targets like DMA, unlocking default IOMMU paging and userspace device assignment.
By kexecBPF plugs three NULL derefs in BTF type show paths
Key-less hash map dumps and bpf_snprintf_btf() on void or var types could oops the kernel; Jiayuan Chen restores rejections and safe placeholders.
By kexeccfg80211 validates WEXT IE buffers to stop OOB reads
A syzbot-found flaw let malformed wireless Information Elements crash the kernel on connect; the fix is rolling through stable trees.
By kexecLinux gains initial USB4 support on Apple M1, M2, and M3
A mainline patch series brings first Thunderbolt host-router bring-up to Apple Silicon, limited for now to XDomain links and USB3 tunnels.
By oopsLinux makes per-VMA locks unconditional on all configs
The change lets binder and TCP drop mmap_lock fallbacks, and Andrew Morton has queued the series for testing.
By oopsKernel clamps qdisc quantum paths that let admins soft-lock hosts
Eight traffic-control schedulers still allowed tiny quanta after setup, reopening a deficit-loop DoS under the qdisc lock.
By kexecKernel fix breaks vmalloc livelock under memory pressure
A circular lock dependency in the vmap purge path could stall the whole system when reclaim and purge work collided.
By kexecDRM scheduler fix closes unprivileged GPU fence UAF read
A core lifetime bug let userspace read freed scheduler memory via exported fences in amdxdna, nouveau, and msm.
By kexecConfidential VMs force KVM to pick sides on attestation and trust
Arm CCA realms and TDX quote plumbing are no longer vendor demos; they are mainline ABI fights over roots of trust, hardware gaps, and how much attestation the hypervisor should own.
By kexecKernel trusted-keys path hardens TPM1 seal and HMAC checks
Forged TPM 1.x replies could overflow a fixed-size blob buffer or skip response authentication entirely.
By kexecLinux kernel panics on GSO fragments after IP reassembly
CVE-2026-80590 lets an unprivileged user trigger a BUG_ON in skb_segment via tap or virtio paths that keep GSO metadata on defragmented packets.
By kexectmpfs casefold option leaked Unicode maps, enabling local DoS
Unprivileged users could exhaust kernel memory by repeatedly setting the casefold mount option on tmpfs.
By kexecKernel reverts IRQ guard switch after Syzbot finds nested lock hazards
Refcounted interrupt disable lands for safer nesting and Rust SpinLockIrq, but wiring it into scoped cleanup guards is rolled back until stronger tooling exists.
By kexecKernel user_events fork path fixed for use-after-free
A failed memory allocation during process duplication could free tracing state still held by the parent.
By kexecLinus Torvalds NAKs SCTP sysctl rewrite over unreadable macros
Alexey Gladkov’s RFC to replace per-namespace table cloning with sysctl_field descriptors is rejected as visually illegible, type-unsafe noise.
By oopsKernel patches close UDP port side channel in routing caches
Always creating exceptions for ICMP errors stops off-path attackers from probing connected UDP sockets after earlier defenses were bypassed.
By kexecBPF series adds dedicated signing keyring and ML-DSA support
Daniel Borkmann's v2 patches give operators a BPF-scoped trust root for signed program loads and teach bpftool post-quantum signatures.
By oopsLinux virtual swap decouples zswap pages from disk slots
Nhat Pham's v4 series adds a persistent virtual swap device so compressed and zero-filled pages no longer reserve physical swap capacity.
By oopsMeta's 57-patch THP collapse rewrite meets kernel pushback
A migration-based engine aimed at mTHP on large base pages is told to land smaller foundations first, while AI-polished list replies draw separate fire.
By oopsKernel race after non-leader exec frees POSIX timer on signal list
Lockless pending-signal cleanup can race with timer delivery when execve swaps thread IDs, leaving a use-after-free path.
By oops