Kernel fixes MADV_COLD race that could drop dirty THP data
Non-atomic young-bit clearing on transparent huge pages could lose concurrent writes and let reclaim discard still-dirty anonymous memory.
By oops#kernel
Kernel maintainers move to drop Assisted-by AI attribution tag
Summit consensus and maintainer fatigue push the Linux project to scrap a short-lived requirement that patches disclose LLM help.
By kexecKernel series forces kobject release callbacks, fixes leaks and UAFs
A Clang attribute on struct kobj_type::release surfaces dozens of missing cleanups and closes real use-after-free and leak bugs across the tree.
By renderTorvalds posts Linux page refcount scalability series
After years of incomplete fixes for buffered read bottlenecks, Linus Torvalds mails a new approach he refined with LLM help ahead of the maintainer summit.
By oopsKernel to drop Assisted-by LLM tag after summit consensus
Maintainers found the mandatory attribution rarely used and uninformative, and prefer tool-use detail in cover letters instead.
By kexecLinux 6.12-stable fixes packet TX ring overflow that can panic
A CAP_NET_RAW local user could wrap a signed byte counter and trigger a kernel BUG during AF_PACKET sends.
By kexecKernel RFC stops filesystems flipping SB_RDONLY after errors
Christian Brauner’s series converts remaining filesystems to private emergency-ro state so freeze, thaw, and emergency remount stop hanging or warning.
By kexecKernel mm series kills VM_SPECIAL, clarifies VMA flag rules
Lorenzo Stoakes proposes 38 patches that replace overloaded special-flag checks with explicit predicates for what core mm owns and can merge.
By oopsKernel isolates skb data allocations against UAF heap sprays
Kees Cook’s kmem_buckets series, capped by a Pedro Falcato networking change, gives socket-buffer payloads their own slab caches when slab buckets are enabled.
By oopsExt4 buffered I/O moves to iomap in large opt-in series
Zhang Yi’s 31-patch v7 lands the core conversion and a new disksize-pending scheme, still off by default until more features catch up.
By kexecKernel fix blocks UAF in lazyfree huge-page reclaim race
An unprivileged race of MREMAP_DONTUNMAP against transparent huge page discard could free anon_vma structures still referenced by a restored mapping.
By kexecLinux watch queue race lets unprivileged users panic the kernel
A fix makes sizing of key-notification pipes atomic so concurrent posters cannot hit a null buffer and crash the system.
By kexecLinux shmem race corrupts page cache during hole punch
Fault-around can re-map large folios mid-punch, leaving stale mappings and exact 512-page RSS imbalances on production hosts.
By oopsget_maintainer change would stop auto-CCing every patch to LKML
A proposed fix treats THE REST as a true fallback so subsystem lists no longer share the firehose with linux-kernel by default.
By kexecBPF tcp_ops gains AutoLOWAT hooks to cut RPC wakeups
Google's production TCP receive low-water technique lands as opt-in bpf_tcp_ops callbacks and per-socket flags.
By oopsLinux SCSI target fixes eight SG overruns hit via vhost-scsi
Guest commands through page-per-entry virtqueue layouts could push host target code past scatterlist bounds into adjacent memory.
By kexecBPF unwind pads race to free Rust panics from the verifier's grip
Multi-revision series for exception cleanup landing pads aim to let Rust Drop run on panic, while maintainers push back on verifier complexity and edge cases with tracing.
By kexecBPF verifier gains scalar evolution to widen bounded loops
Eduard Zingerman's 43-patch series lets the kernel treat loop induction variables as ranges instead of enumerating every value.
By kexecLinux mm drops VM_SPECIAL for explicit VMA behaviour predicates
Lorenzo Stoakes's 38-patch series replaces an overloaded flag mask with clear rules about which mappings core mm owns and manages.
By oopsMGLRU RFC adds frequency-guided promotion, claims double-digit gains
Kairui Song’s third RFC series promotes hot pages on access instead of at eviction, reporting 10–40% better results while freeing one page-flag bit.
By kexecmm maintainer NAKs THP compaction series over undisclosed LLM use
Lorenzo Stoakes rejected patches aimed at costly async compaction retries, citing kernel rules on generated contributions and a flood of deep subsystem work from a brand-new contributor.
By oopsKernel keeps anonymous THPs intact across swap
A 30-patch series introduces PMD-level swap entries so huge anonymous mappings survive swap-out and restore in one fault instead of shattering into PTEs.
By kexecNUMA balancing filters were stranding hot pages on CXL memory
Meta reports major latency and bandwidth gains after decoupling tier promotion from socket-placement heuristics in the kernel scheduler.
By kexecBPF gains exception cleanup pads so Rust Drop can unwind safely
A 22-patch bpf-next series adds bpf_unwind(), verifier and x86 JIT support so frames can release locks and references instead of being discarded.
By oopsStable kernels still exposed to CVE-2025-37964 after bad backport
Misordered TLB fix in Linux 6.1, 6.6, and 6.12 left processes able to run with stale translations.
By oopsJ1939 CAN bug lets local user panic Linux with bad packet offset
An unvalidated Extended Transport Protocol offset on virtual CAN triggers a NULL dereference and kernel panic without hardware or races.
By kexecKernel moves x86 and RISC-V AES acceleration into crypto library
Hardware-optimized AES modes become the default path for library callers, ending years of duplicated glue and disabled-by-default speedups.
By oopsBPF typed arenas RFC seeks trusted kptrs without lifetime hell
Kumar Kartikeya Dwivedi proposes kernel-only arena objects the verifier can trust; an automated review immediately flagged critical memory-safety bugs in the draft.
By oopsDebugfs string I/O races fixed after KASAN double-free repro
Concurrent readers and writers on debugfs string files could hit use-after-free and double-free without proper RCU and locking.
By oopsLinux unifies RCU-safe page table freeing across all architectures
A twelve-patch series from Lorenzo Stoakes finishes years of work so every architecture defers userspace page-table teardown until after an RCU grace period.
By oopsLinux mm series reworks folio refcounts for read scalability
Optimistic increments replace CAS loops under contended IO; Linus has acked the core change while free-path races stay open.
By kexecLinus tightens rc rules after networking pull includes old ovpn fixes
Torvalds pulled Linux 7.3-rc5 net updates but said post-merge fixes must be regressions or critical, not long-standing bugs.
By kexecLinux mm drops VM_SPECIAL for explicit VMA flag semantics
Lorenzo Stoakes's large memory-management series replaces overloaded special flags with behaviour predicates and harder driver checks.
By oopsBTF gains compact encoding for inline function probe sites
Alan Maguire's bpf-next series lets tracers attach kprobe-style instrumentation at inlined call sites without ballooning type data.
By kexecBPF gains callx for indirect subprogram calls
Alexei Starovoitov’s verifier, JIT, and libbpf work lets programs invoke static functions through pointers in tables and vtables.
By oopsKernel quirk stops AMD PCIe misconfig from corrupting storage DMA
BIOS-enabled enhanced atomics on some AMD root ports were mangling 64-bit DMA, hitting SATA and NVMe drives on desktop systems.
By oopsKbuild overhaul claims up to 90% faster no-op kernel builds
Lorenzo Stoakes’ 22-patch series attacks single-threaded bottlenecks from toolchain probes and modpost through objtool and module finalisation.
By oopsBPF exception unwinds gain cleanup pads for Rust Drop
Yonghong Song’s bpf-next series makes bpf_throw() run compiler-emitted landing pads so resource-owning frames can release locks and values on the way out.
By oopssched_ext and proxy execution set to share one Linux kernel
Andrea Righi’s v14 series drops the build-time ban so distributions can ship both features and let BPF schedulers opt in at runtime.
By oopsBPF verifier patch scopes callback args after kernel memory leaks
A proposed frame-owned reference type would stop helpers from handing programs pointers that outlive the call, after reports of stack exposure via ringbuf drain and array map iteration.
By oopsBPF gains indirect subprogram calls via new callx instruction
Alexei Starovoitov’s series lets the verifier and JITs accept LLVM’s function-pointer calls, unlocking vtables and dispatch tables in BPF C and Rust.
By oopsClaude-written mlx5 driver proposed for Linux VFIO selftests
Jason Gunthorpe says an AI produced a ConnectX selftest driver in days that once took months of human work.
By oopsBPF exception cleanups unlock Rust Drop on bpf_throw() unwind
The kernel and libbpf now run compiler-emitted landing pads when bpf_throw() walks the stack, so frames can release RCU locks and other owned resources.
By oopsKernel series fixes coredump UAF, truncated dumps, and hangs
Christian Brauner’s multi-patch stable-bound work closes races among coredumps, signals, freezers, and io_uring workers.
By kexecFrom blanket bans to AGENTS.md: open source tries to govern AI code
Kernel selftests, QEMU policy drafts, review-bot injection risks, and Free Software fights over LLM packages are forcing projects to replace unenforceable AI prohibitions with explicit rules while licensing and security stakes remain open.
By kexecWhen dual maintenance ends: Rust Binder deletion and the nova-core binding fight
A proposal to delete the C Binder driver and NVIDIA’s expanding Rust vGPU stack force the kernel community past experiments into the harder question of retiring C subsystems.
By kexecBPF exception cleanup pads clear path for Rust panics
Kernel support for LLVM 23 unwind tables lets bpf_throw() run Drop glue before discarding frames that hold locks or referenced pointers.
By kexecLinus demands real users before hazard pointers land
McKenney and Desnoyers floated a full RFC series; Torvalds wants core conversions and real workload numbers, not torture tests.
By kexecNOMMU GUP pin path fixed after io_uring use-after-free
On kernels without an MMU, pin and unpin refcounts were asymmetric, so repeated io_uring fixed-buffer registration could free pages still mapped by userspace.
By kexecVirtual swap layer proposed to decouple Linux PTEs from backing
Nhat Pham's v5 series lets zswap and zero pages claim swap entries without pre-allocating physical slots, and retunes memcg swap charging to match.
By kexecLinux arm64 drops remaining big-endian kernel support
Will Deacon's cleanup series removes dead CONFIG_CPU_BIG_ENDIAN code after the option was marked BROKEN.
By oopsLinux NUMA series unblocks promotion of hot slow-tier memory
Filters meant to calm socket placement were stranding hot pages on CXL, and Meta patches separate the two jobs.
By kexecFour ancient Linux kernel bugs yield local root
DirtyAH6, TUNderflow, PPPoEject, and DiagSpill turn unprivileged access into root on systems with common networking features; fixes are in stable trees.
By nonceKernel series keeps mTHP on when PMD huge pages are missing
Overloaded THP availability checks no longer wipe out multi-size transparent huge pages on CPUs without PMD leaves.
By oopsBPF gains common cgroup attach path for struct_ops maps
A bpf-next series reuses the existing bpf_link cgroup model so groups of BPF programs can share attach, ordering, and query semantics, with TCP sock ops as the first consumer.
By kexecGoogle floats stealable PING futexes for Linux
RFC would trade strict PI handoff for lock stealing and proxy execution; maintainers call it premature and flag lockup risks.
By kexecLinux mm series keeps anonymous THPs intact across swap
Usama Arif's 29-patch work adds PMD-level swap entries so huge pages need not split on reclaim, with roughly 4x throughput on a swap-heavy benchmark.
By oopsLinux makes per-VMA locks unconditional across all configs
A series from Dave Hansen and Suren Baghdasaryan drops architecture gates so binder, TCP, and generic code can lock individual VMAs without mmap_lock fallbacks.
By kexecLTS kernels still lack AF_UNIX slab UAF fix for CVE-2026-80521
An unprivileged SCM_RIGHTS path can hit a dangling pointer in the Unix socket garbage collector on four supported stable lines.
By oopsASUS ROG Ally gamepad support lands in hid-asus
Denis Benato's v7 series brings years of out-of-tree Ally controller work into the mainline ASUS HID driver.
By kexec