Daily update · Sep 6–7, 2026
Linux mainline: massive BPF verifier hardening, xHCI fixes, scheduler and RT stability
A wave of BPF security fixes closes verifier bypasses, while USB, scheduler, tracing, and PREEMPT_RT subsystems receive critical correctness and performance fixes.
In brief
Today's mainline updates are dominated by an extensive set of BPF verifier hardening fixes that close multiple classes of type-safety and precision-tracking bypasses exploitable by unprivileged programs. On the hardware front, two xHCI fixes address a regression that broke USB entirely on some controllers and a data-corruption bug in multi-segment transfers. The RT scheduler, futex PI path, and several tracing/perf subsystems also receive important correctness fixes.
BPF verifier security and hardening
Verifier bypasses closed for null pointers, kptr, percpu, and precision tracking
Multiple independent verifier flaws allowed unsafe BPF programs to pass verification: comparing pointers could strip PTR_MAYBE_NULL, kptr fields could accept arbitrary scalars, precision backtracking missed NULL-nullable arguments, and JMP32 branch prediction or fastcall rewriting could accept out-of-bounds programs. Collectively these could allow null dereferences, kernel memory corruption, or state-pruning bypasses.
Why it matters: Unprivileged BPF programs could crash the kernel or escalate privileges on affected systems; these fixes close a broad class of verifier bypasses.
d3ef6c097ba0387b1baefbb7e3e4f66cc4b7374b2c5561db4814ed6406f30b1c83dc3c44369f4ce73457266aa4ad0b2e7b7b8b596010d05524794240620614bf76729d02927fdf4ee7d28823c66267b529f521a673a98f96811ee51179a4e0986aed0134d3cd048029ba1c79ecdc5043794ccd6f72d7f38e7441ee8276641a3a10b030c9f1e418129f2e506ada89629ee726fc6b9afec3fd8e5fd100
Signal tracepoint siginfo arguments marked scalar to prevent kernel panic
The signal_generate and signal_deliver tracepoints can pass sentinel values SEND_SIG_NOINFO (zero) or SEND_SIG_PRIV (one) as the info pointer. A tp_bpf program dereferencing these would panic the kernel, especially since signal_generate can fire from timer interrupt context.
Why it matters: Prevents a local user with CAP_BPF from crashing the kernel via a crafted BPF tracepoint program.
BPF correctness and performance
Per-CPU maps crash and freelist deadlock on sparse and single-CPU systems
On arm64 systems with non-contiguous CPU IDs, BPF per-CPU maps used the logical CPU ID instead of the possible-CPU index, causing page faults and scrambled values. Separately, on single-CPU systems, an NMI re-entering pcpu_freelist_push() while the interrupted context held the lock would spin forever.
Why it matters: arm64 systems with CPU topology holes no longer crash on per-CPU BPF maps; single-CPU systems no longer hard-lock under NMI on the freelist path.
Use-after-free fixes in resizable hash maps and nested map callbacks
Resizable hash map element recycling could clear timer fields without cancelling them, and nested map-of-maps callbacks could pair timers with the wrong inner map, both leading to use-after-free conditions.
Why it matters: Prevents kernel memory corruption from BPF programs using timers with resizable hash maps or nested map-of-maps constructs.
Trampoline allocation throughput improved on x86
BPF trampoline allocation on x86 triggered unnecessary ROX-to-WNX memory protection flips; switching to EXECMEM_MODULE_DATA allocations avoids the extra protection changes.
Why it matters: Workloads allocating large numbers of BPF trampolines will see significantly improved allocation throughput.
RISC-V BPF arena maps now report missing ZACAS support clearly
BPF arena map creation silently failed with -ENOMEM on RISC-V systems lacking the ZACAS extension because the allocator requires cmpxchg128 support. The fix returns -EOPNOTSUPP instead.
Why it matters: RISC-V users without ZACAS get a clear error instead of a misleading out-of-memory error.
USB and xHCI
xHCI ERST_MAX conversion regression broke USB on some controllers
A bit-field macro conversion in 7.3-rc1 incorrectly shifted the HCS_ERST_MAX field, causing dma_alloc_coherent() to be called with size=0 on controllers where that field is zero, rendering XHCI non-functional.
Why it matters: Users with affected USB host controllers would find their USB ports completely non-functional after upgrading to 7.3-rc1.
xHCI lost data on transfers spanning multiple ring segments
When a transfer descriptor spans three or more ring segments, only the last bounce buffer was tracked, causing earlier bounce buffers to be silently lost and data corruption on IN transfers.
Why it matters: Users performing large USB transfers on affected xHCI controllers could experience silent data corruption without any error reported.
Scheduler and real-time
RT balancer stopped wasting tens of milliseconds retrying unpushable tasks
The RT balancer kept trying to push a migrate-disabled RT task to another CPU even though the push could never succeed, causing the CPU to spend significant time in a retry loop.
Why it matters: Real-time workloads on isolated CPUs could experience latency spikes of tens of milliseconds due to the balancer spinning on an unpushable task.
Cache-aware load balancing no longer creates capacity misfits on big.LITTLE
On asymmetric CPU capacity systems, cache-aware load balancing could pull a task to a destination LLC whose CPUs are too small to run it, trading cache locality for a harmful capacity loss. Both migration entry paths now guard against this.
Why it matters: Users of big.LITTLE and other asymmetric-capability ARM systems should see fewer performance regressions from ill-advised task migrations.
Intel ITMT scheduling no longer silently disabled without debugfs
ITMT support treated debugfs file creation failures as fatal, so when CONFIG_DEBUG_FS was disabled the scheduler feature was silently turned off, degrading scheduling on Intel hybrid systems.
Why it matters: Users with CONFIG_DEBUG_FS disabled on Intel asymmetric-core systems were getting suboptimal task placement without any warning.
Futex requeue PI and rt_mutex scheduling fixes for PREEMPT_RT
FUTEX_CMP_REQUEUE_PI could trigger a use-after-free in rcuwait on PREEMPT_RT due to a race between early wakeup and PI requeue. Separately, futex scheduling now uses rt_mutex pre/post schedule equivalents to ensure I/O is flushed and PI chain waiters are correctly ordered before blocking.
Why it matters: PREEMPT_RT users gain stability and correctness for futex-based PI operations, avoiding kernel memory corruption.
Tracing and perf
Perf and tracing use-after-free fixes for mmap and trace_array racing
perf_mmap_close() dropped rb->mmap_count without holding event->mmap_mutex, allowing a concurrent revival to cause a use-after-free. Separately, opening a trace options file did not take a reference on its trace_array, so concurrent instance removal could free the descriptor while in use.
Why it matters: Fixes potential kernel memory corruption or crashes from racing perf mmap/munmap and tracing instance removal operations.
Ftrace ops initialization race serialized with new mutex
ftrace_ops_init() could be called concurrently on the same ops from different tasks, corrupting initialization state. A new ops_mutex serializes initialization with a lockless fast-path check.
Why it matters: Prevents rare ftrace corruption under concurrent tracing setup on the same ops.
Ring buffer subbuffer resize races and splice reads fixed
Concurrent subbuffer resizes could crash trace_pipe_raw readers or leak uninitialized kernel memory due to stale size values. Separately, ring_buffer_read_page() rejected splice reads on static buffers; the fix allows a memcpy path for persistent and user-mapped buffers.
Why it matters: Dynamic trace buffer resizing while reading no longer risks crashes or memory exposure; splice-based reading of persistent buffers now works for the tracefs mapping interface.
ARM CoreSight TRBE no longer floods zero-sized AUX records
The TRBE driver set format flags on empty trace buffers, causing perf to emit zero-sized PERF_RECORD_AUX records even when no data was captured, noticeable when tracing with strace.
Why it matters: Users of ARM CoreSight tracing will see cleaner perf output without flooding empty AUX records.
Platform and driver fixes
rtl8723bs wireless driver out-of-bounds reads from attacker-controlled frames
WPS attribute, action frame, and WMM IE parsing in the staging rtl8723bs driver lacked proper bounds checks on data from wireless management frames, allowing a malicious peer to trigger heap OOB reads or stack overflows.
Why it matters: A nearby malicious Wi-Fi peer could craft management frames to trigger kernel memory corruption on systems using rtl8723bs wireless adapters.
Hisilicon Hi1616 hns NIC regression fixed by reverting mbigen IRQ address change
A prior fix to the mbigen node address layout caused a regression where the second hns NIC port could not pass any traffic, with the break occurring at an mbigen node boundary. The revert restores working behavior.
Why it matters: Users of Hisilicon Hi1616 systems with hns NICs regain use of all network ports.
STM32MP hwspinlock timeout corrected from 1 second to 1 millisecond
The hwspinlock timeout was passed in microseconds where milliseconds were expected, causing a 1000x longer busy-wait that disabled preemption during interrupt type configuration.
Why it matters: STM32MP platforms, especially real-time configurations, avoid excessively long preemption-disabled windows during interrupt configuration.
virtio_console sleeping allocation fixed in atomic console write path
The port_buffer struct was allocated with GFP_KERNEL even when called from the hvc console write path with preemption disabled, causing sleeping-in-atomic-context warnings.
Why it matters: VM guests using virtio console no longer trigger debug splats or potential stalls when writing to /dev/kmsg under preemption-disabled contexts.
Softirq deferred indefinitely by interrupt disable ordering
A pending softirq could be missed if the triggering interrupt arrived between hardirq_disable_enter() and _local_interrupt_disable(), deferring softirq processing to the next interrupt which might never come.
Why it matters: Systems could experience indefinite softirq delays, potentially causing network or other softirq-dependent processing to stall.
Source commits147 entries +
usb: storage: realtek_cr: fix use-after-free on disconnect
Myeonghun Pak · Jul 27, 2026 · 1 files
staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
Muhammad Bilal · Jul 28, 2026 · 1 files
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
Muhammad Bilal · Jul 28, 2026 · 1 files
staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
Muhammad Bilal · Jul 28, 2026 · 1 files
usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
Aleksandr Nogikh · Jul 29, 2026 · 1 files
bpf: Fix infinite loop in pcpu_freelist push with one possible CPU
Hui Su · Aug 6, 2026 · 2 files
staging: fbtft: make dirty_lock IRQ-safe
Hui Su · Aug 7, 2026 · 1 files
sched/core: Skip rq->avg_idle update without a valid idle_stamp
Shubhang Kaushik (Ampere) · Aug 7, 2026 · 1 files
virtio_console: allocate the port_buffer with the caller's gfp
Breno Leitao · Aug 10, 2026 · 1 files
usb: dwc3: clear forceRM when issuing EndTransfer
Elson Serrao · Aug 13, 2026 · 2 files
bpf: Fix percpu map update indexing with sparse CPU IDs
Hui Su · Aug 13, 2026 · 3 files
bpf: Fix BPF_F_CPU validation for sparse CPU IDs
Hui Su · Aug 13, 2026 · 1 files
usb: typec: tipd: Fix Thunderbolt altmode VDOs for cd321x
Sven Peter · Aug 13, 2026 · 2 files
usb: gadget: f_midi: initialize work in f_midi_alloc()
Jeffin Philip · Aug 15, 2026 · 1 files
usb: gadget: f_midi2: fix use-after-free in string attribute show path
Ivy Lopez · Aug 16, 2026 · 1 files
usb: gadget: fix null pointer dereference in usb_put_function_instance()
Jeffin Philip · Aug 16, 2026 · 1 files
usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
Andy Shevchenko · Aug 17, 2026 · 1 files
usb: typec: mux: Fix typec_switch_match()
Marek Vasut · Aug 17, 2026 · 1 files
usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
Jeffin Philip · Aug 18, 2026 · 1 files
x86/bpf: Make arch_bpf_trampoline_size allocate from EXECMEM_MODULE_DATA
Mike Rapoport (Microsoft) · Aug 18, 2026 · 3 files
usb: image: mdc800: change kmalloc() to kzalloc()
Griffin Kroah-Hartman · Aug 19, 2026 · 1 files
bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic
Jiayuan Chen · Aug 19, 2026 · 1 files
selftests/bpf: Add reg-invariants test for speculative pointer arithmetic
Jiayuan Chen · Aug 19, 2026 · 1 files
usb: typec: hd3ss3220: track VBUS enable state per consumer
Chang Wu · Aug 19, 2026 · 1 files
usb: typec: qcom-pmic: cancel reset_work on stop
Fan Wu · Aug 19, 2026 · 1 files
usb: dwc3: google: Initialise probe properties with DWC3_DEFAULT_PROPERTIES
Radhey Shyam Pandey · Aug 19, 2026 · 1 files
bpf: Reject invalid LDSX instruction in disassembly
Kumar Kartikeya Dwivedi · Aug 20, 2026 · 1 files
selftests/bpf: Test invalid DW LDSX diagnostics
Kumar Kartikeya Dwivedi · Aug 20, 2026 · 1 files
usb: cdnsp: fix wakeup from S3 after controller context loss
Pawel Laszczak · Aug 20, 2026 · 3 files
usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
Fan Wu · Aug 20, 2026 · 1 files
usb: typec: qcom-pmic-typec: drain cc_debounce_dwork if port_start() fails
Fan Wu · Aug 20, 2026 · 1 files
irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
Ju Nan · Aug 21, 2026 · 1 files
usb-storage: ene_ub6250: fix race between scan work and probe
Liu Qi · Aug 21, 2026 · 1 files
Revert "irqchip/mbigen: Fix mbigen node address layout"
caina · Aug 21, 2026 · 1 files
usb: typec: mux: avoid duplicated mux switches
Marek Vasut · Aug 22, 2026 · 1 files
sched/fair: Use update_curr_eevdf() for the remaining root cfs_rq callers
Zhan Xusheng · Aug 22, 2026 · 1 files
locking/lockdep: Invalidate stale class_cache entries for zapped classes
Eric Dumazet · Aug 24, 2026 · 1 files
perf/core: Skip empty AUX records with only format flags
Leo Yan · Aug 25, 2026 · 1 files
USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
Lovekesh Solanki · Aug 25, 2026 · 1 files
usb: typec: ucsi: displayport: Fix OOB altmode array index
Jameson Thies · Aug 25, 2026 · 1 files
bpf: check_cond_jmp_op(): properly infer if register is null
Eduard Zingerman · Aug 26, 2026 · 1 files
selftests/bpf: a demo for check_cond_jmp_op() non-null inference bug
Eduard Zingerman · Aug 26, 2026 · 1 files
preempt: Remove hardirq_disable_count()
Boqun Feng · Aug 27, 2026 · 2 files
usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
Amit Sunil Dhamne · Aug 27, 2026 · 1 files
bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO
Eduard Zingerman · Aug 27, 2026 · 1 files
selftests/bpf: half-dead scalar zero stack spill test
Eduard Zingerman · Aug 27, 2026 · 1 files
tracing: Have show_event_filters/triggers files take trace array ref
Steven Rostedt · Aug 28, 2026 · 1 files
selftests/bpf: Bound the offset accumulator in __tld_fetch_key()
Yonghong Song · Aug 28, 2026 · 1 files
ftrace: Take trace_array reference before accessing its ftrace_ops
Steven Rostedt · Aug 29, 2026 · 5 files
interrupt: Disable interrupt before modifying hardirq_disable counter
Boqun Feng · Aug 29, 2026 · 2 files
sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate
Seiji Nishikawa · Aug 30, 2026 · 2 files
x86/itmt: Don't make ITMT enablement depend on debugfs
Mario Limonciello · Aug 31, 2026 · 1 files
usb: xhci: Fix HCS_ERST_MAX conversion
Chen-Yu Tsai · Aug 31, 2026 · 1 files
usb: xhci: Fix isochronous scheduling regression
Michal Pecio · Aug 31, 2026 · 1 files
xhci: fix lost bounce buffers on TDs spanning several ring segments
Arthur Gautier · Aug 31, 2026 · 1 files
sched/fair: Use cfs_rq->h_curr in throttle_cfs_rq()
Wanwu Li · Aug 31, 2026 · 1 files
sched/fair: Use cfs_rq->h_curr in distribute_cfs_runtime()
Wanwu Li · Aug 31, 2026 · 1 files
perf: Fix use-after-free when perf mmap() revival races with the last munmap()
Yilin Zhang · Aug 31, 2026 · 1 files
sched/fair: Avoid creating misfits during cache-aware balancing
Tim Chen · Aug 31, 2026 · 1 files
bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
Eduard Zingerman · Sep 1, 2026 · 1 files
selftests/bpf: test case for unsafe pruning of bpf_loop checkpoints
Eduard Zingerman · Sep 1, 2026 · 1 files
irqdomain: Delete irq_domain_add_linear()
Jiri Slaby (SUSE) · Sep 1, 2026 · 2 files
bpf: Reject key-less BTF for hash maps
Jiayuan Chen · Sep 1, 2026 · 1 files
bpf: Fix NULL-ptr-deref when showing a void BTF type
Jiayuan Chen · Sep 1, 2026 · 1 files
bpf: Fix NULL-ptr-deref in btf_var_show()
Jiayuan Chen · Sep 1, 2026 · 1 files
selftests/bpf: Add test for key-less BTF hash map
Jiayuan Chen · Sep 1, 2026 · 1 files
selftests/bpf: Add test for showing a void BTF type
Jiayuan Chen · Sep 1, 2026 · 2 files
staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit()
Muhammad Bilal · Sep 1, 2026 · 4 files
futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
Sebastian Andrzej Siewior · Sep 1, 2026 · 4 files
futex: Prevent rcuwait use-after-free during requeue PI
Yao Kai · Sep 1, 2026 · 1 files
ring-buffer: Allow splice reads on static buffers
Vincent Donnefort · Sep 1, 2026 · 1 files
bpf, riscv: Make arena support depend on ZACAS
Chen Pei · Sep 2, 2026 · 1 files
bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
Eduard Zingerman · Sep 2, 2026 · 1 files
selftests/bpf: Precision tracking across BPF_ABS subprog exit
Eduard Zingerman · Sep 2, 2026 · 1 files
ftrace: Synchronize the initialization of ftrace_ops
Steven Rostedt · Sep 2, 2026 · 1 files
tracing: Take trace_array reference when opening options file
Steven Rostedt · Sep 2, 2026 · 1 files
bpf: reject BPF_PSEUDO_FUNC reference to the main program
Eduard Zingerman · Sep 2, 2026 · 1 files
selftests/bpf: BPF_PSEUDO_FUNC reference to the main program
Eduard Zingerman · Sep 2, 2026 · 1 files
selftests/bpf: Add tests to assert that netfilter progs cannot write to skb
Florian Westphal · Sep 3, 2026 · 1 files
bpf: Mark signal tracepoint siginfo arguments as scalar
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Cover signal tracepoint siginfo sentinels
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
bpf: Reject tail calls directly from callback frames
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Test direct tail calls from callbacks
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
bpf: Reject resilient lock operations in rbtree callbacks
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Reject resilient unlock in rbtree callback
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
bpf: Mark sched_process_wait argument as nullable
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Test sched_process_wait nullable argument
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
bpf: Mark syscall helpers as sleepable
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Check syscall helpers in timer callbacks
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
bpf: zero extend the result of an arena 32-bit cmpxchg
Eduard Zingerman · Sep 3, 2026 · 1 files
bpf: update disasm.c to print BPF_PROBE_ATOMIC as atomics
Eduard Zingerman · Sep 3, 2026 · 1 files
selftests/bpf: check zero extension of an arena 32-bit cmpxchg
Eduard Zingerman · Sep 3, 2026 · 1 files
ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
Steven Rostedt · Sep 3, 2026 · 1 files
bpf: don't rewrite bpf_fastcall patterns entered by a jump
Eduard Zingerman · Sep 3, 2026 · 3 files
selftests/bpf: bpf_fastcall patterns entered by a jump
Eduard Zingerman · Sep 3, 2026 · 1 files
bpf: Check ancestor frames for rbtree callbacks
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Check rbtree callback restrictions in subprogs
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
bpf: Mark bpf_btf_find_by_name_kind() as sleepable
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Test btf lookup helper sleepability
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
bpf: Mark faultable stack helpers as sleepable
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Check faultable stack helper contexts
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
bpf: Reject legacy packet loads from callbacks
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
selftests/bpf: Reject legacy packet loads from callbacks
Kumar Kartikeya Dwivedi · Sep 3, 2026 · 1 files
tracing: Fix to avoid creating trace instances with duplicate names
Masami Hiramatsu (Google) · Sep 3, 2026 · 1 files
selftests/bpf: Fix flaky bpf_nf test when random NAT port is 0
Jiayuan Chen · Sep 4, 2026 · 1 files
bpf: Don't infer non-NULL from a pointer with an unbounded offset
Eduard Zingerman · Sep 4, 2026 · 1 files
selftests/bpf: No non-NULL inference from unbounded offset pointers
Eduard Zingerman · Sep 4, 2026 · 1 files
bpf: Don't resurrect a scalar id dropped by collect_linked_regs()
Eduard Zingerman · Sep 4, 2026 · 1 files
selftests/bpf: Check the linked regs cap for the compared register
Eduard Zingerman · Sep 4, 2026 · 1 files
bpf: Don't predict JMP32 pointer vs zero comparisons
Eduard Zingerman · Sep 4, 2026 · 1 files
selftests/bpf: Check that JMP32 pointer vs zero jumps are not predicted
Eduard Zingerman · Sep 4, 2026 · 1 files
bpf: Mark the zero register precise for a register-form NULL check
Eduard Zingerman · Sep 4, 2026 · 1 files
selftests/bpf: No non-NULL inference from an imprecise zero register
Eduard Zingerman · Sep 4, 2026 · 1 files
bpf: Require MEM_PERCPU for percpu kptr stores
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 1 files
selftests/bpf: Reject non-percpu values in percpu kptr fields
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 1 files
bpf: Keep refcount_acquire nullable for borrowed RCU kptrs
Ning Ding · Sep 4, 2026 · 1 files
selftests/bpf: Test borrowed refcount acquisition nullability
Ning Ding · Sep 4, 2026 · 2 files
bpf: Clear NON_OWN_REF after RCU protection ends
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 1 files
selftests/bpf: Reject graph kptr use after RCU unlock
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 2 files
bpf: Reject untrusted allocated-object pointers
Ning Ding · Sep 4, 2026 · 1 files
selftests/bpf: Reject refcount acquisition after RCU unlock
Ning Ding · Sep 4, 2026 · 1 files
bpf: Preserve special fields in recycled rhtab elements
Yuan Chen · Sep 4, 2026 · 1 files
selftests/bpf: Test timer field on recycled rhtab element
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 2 files
bpf: Cancel special fields when recycling rhtab elements
Nuoqi Gui · Sep 4, 2026 · 1 files
selftests/bpf: Test rhtab kptr cancellation semantics
Nuoqi Gui · Sep 4, 2026 · 2 files
bpf: Mark NULL kptr stores precise
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 1 files
selftests/bpf: Test imprecise scalar kptr stores
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 1 files
bpf: Preserve inner map identity in callback frames
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 1 files
selftests/bpf: Test inner map identities in callbacks
Kumar Kartikeya Dwivedi · Sep 4, 2026 · 2 files
tracing: Fix subbuf resize races with trace_pipe_raw readers
Vincent Donnefort · Sep 4, 2026 · 5 files
ring-buffer: Cap static ring buffer nr_pages
Vincent Donnefort · Sep 4, 2026 · 1 files
ring-buffer: Prevent truncation of nr_pages / nr_subbufs
Vincent Donnefort · Sep 4, 2026 · 1 files
tracing: Fix comment in tracing_buffers_splice_read()
Steven Rostedt · Sep 4, 2026 · 1 files
ring-buffer: Use a macro for static buffer bits
Steven Rostedt · Sep 4, 2026 · 1 files
bpf: mark a NULL call argument precise
Eduard Zingerman · Sep 5, 2026 · 2 files
selftests/bpf: precision of a NULL helper argument
Eduard Zingerman · Sep 5, 2026 · 2 files
bpf: mark a NULL memory argument of a call precise
Eduard Zingerman · Sep 5, 2026 · 1 files
selftests/bpf: precision of a NULL global subprogram memory argument
Eduard Zingerman · Sep 5, 2026 · 1 files
bpf: mark a NULL kfunc argument precise
Eduard Zingerman · Sep 5, 2026 · 1 files
selftests/bpf: precision of a NULL kfunc argument
Eduard Zingerman · Sep 5, 2026 · 1 files
bpf: mark a NULL BTF_ID argument of a global subprogram precise
Eduard Zingerman · Sep 5, 2026 · 1 files
selftests/bpf: precision of a NULL global subprogram BTF_ID argument
Eduard Zingerman · Sep 5, 2026 · 1 files
bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()
Eduard Zingerman · Sep 5, 2026 · 1 files
bpf: use mark_arg_precision() in check_mem_size_reg()
Eduard Zingerman · Sep 5, 2026 · 1 files
bpf: Reject non-scalar bpf_loop iteration counts
Kumar Kartikeya Dwivedi · Sep 5, 2026 · 3 files
selftests/bpf: Test pointer bpf_loop iteration count rejection
Kumar Kartikeya Dwivedi · Sep 5, 2026 · 1 files
Linux 7.3-rc2
Linus Torvalds · Sep 6, 2026 · 1 files