Daily update · Sep 9–10, 2026
Linux kernel updates: ext4 crash fix, Landlock UAF, virtio hardening
Today's mainline patches address filesystem and virtualization bugs, including security fixes for Landlock and vhost.
In brief
This daily update covers ten patches merged into the mainline kernel, focusing on stability and security. Notable fixes include an ext4 fastcommit replay crash, a use-after-free in Landlock, and multiple virtio and vhost hardening changes.
Filesystems
Fix ext4 crash during fastcommit replay
Avoid entering filesystem writeback paths during fastcommit replay, which previously crashed because the writeback semaphore isn't initialized yet.
Why it matters: Prevents a kernel crash when mounting or replaying an ext4 filesystem with fastcommit enabled after an unclean shutdown.
Fix spurious -EINVAL on successful nested filesystem thaw
Thawing a superblock that still has other freezers now returns success instead of -EINVAL, correcting a regression from the per-holder freeze counters.
Why it matters: Avoids false errors for tooling that freezes a filesystem through both FIFREEZE and block-device freeze, such as some snapshot and device-mapper workflows.
Fix exec deadlock with FUSE and hung filesystems
do_close_on_exec() previously ran while holding exec_update_lock, so a filesystem that blocked during close could stall exec and other paths that take the lock, including a FUSE deadlock if the filesystem inspected the calling process. It now runs before the lock is taken, after the FD table is copied if needed.
Why it matters: Users with FUSE mounts or filesystems that can block on close are less likely to experience hangs or deadlocks when executing programs.
Virtio and vhost
Fix stale descriptor flags after failed packed virtqueue add
When a packed-ring descriptor mapping failed, the descriptor's avail/used flags were not restored correctly, leaving the ring in an inconsistent state.
Why it matters: Prevents memory corruption or device hangs with virtio devices using packed virtqueues after a transient mapping error.
Fix use-after-free when unregistering some virtio devices
unregister_virtio_device() accessed debugfs state after device_unregister() could free the embedded virtio_device for transports like virtio-mmio and vdpa.
Why it matters: Prevents a crash when unbinding or removing virtio-mmio, vdpa, or other affected virtio devices.
Reject oversized virtqueue in vhost-vdpa
vhost_vring_set_num() accepted any power-of-two size without comparing against the device's maximum, allowing a user with vhost-vdpa access to trigger an out-of-bounds read in the simulator/device.
Why it matters: Fixes a security issue where a process with access to /dev/vhost-vdpa could crash the host or leak kernel memory.
Limit outstanding vhost IOTLB misses
vhost now suppresses repeated IOTLB miss messages for the same virtqueue until userspace resolves the miss, preventing unbounded memory growth.
Why it matters: Prevents a malicious or buggy userspace from exhausting host memory through vhost device translation misses.
Fix virtio-input device removal race
The virtio_input driver could unregister the input device before resetting the virtio device, allowing callbacks to continue using freed resources. It now resets first and rechecks readiness while draining completed events.
Why it matters: Virtual machines using virtio-input devices are less likely to crash or hang when the device is hot-removed.
Security and hardening
Fix use-after-free in reboot sysctl handling
The global cad_pid pointer was not reference-counted, allowing a concurrent writer to free the pid while readers were still using it; the sysctl was also moved back to the global table to reduce namespace exposure.
Why it matters: Closes a potential use-after-free reachable via the Ctrl-Alt-Del sysctl, which could be triggered from user and PID namespaces.
Fix Landlock use-after-free of parent directory during link checks
The Landlock path-referral check read a dentry's parent without holding a reference, so a concurrent rename could free it while the security hook was still running.
Why it matters: Prevents a potential use-after-free and crash/security issue for users of Landlock sandboxing when linking files.
Source commits64 entries +
adfs: fix memory leak in sb->s_fs_info
Ahmet Eray Karadag · Dec 15, 2025 · 1 files
ufs: do not treat unreadable directory blocks as empty
Ali Ahmet Memis · Aug 1, 2026 · 1 files
ufs: create the root dentry after loading cylinder metadata
Ali Ahmet Memis · Aug 1, 2026 · 1 files
ufs: validate cylinder group metadata before caching it
Ali Ahmet Memis · Aug 1, 2026 · 1 files
vhost-scsi: use kvzalloc for vq array allocation
Dongli Zhang · Aug 2, 2026 · 1 files
vhost-scsi: clamp max_io_vqs module parameter
Dongli Zhang · Aug 2, 2026 · 1 files
vdpa: alibaba: Keep DRIVER_OK clear if IRQ setup fails
Xiong Weimin · Aug 4, 2026 · 1 files
vdpa: octeon_ep: Check dev_set_name() in dev add
Xiong Weimin · Aug 4, 2026 · 1 files
virtio-vdpa: Use queue id when setting vq affinity
Xiong Weimin · Aug 4, 2026 · 1 files
ext4: Avoid entering writeback paths during fastcommit replay
Jan Kara · Aug 4, 2026 · 1 files
printk: Don't WARN on kthread_run failure.
Tetsuo Handa · Aug 4, 2026 · 2 files
vdpa: ifcvf: Put device on unsupported feature error
Xiong Weimin · Aug 5, 2026 · 1 files
vdpa: solidrun: Free IRQs after request failure
Xiong Weimin · Aug 5, 2026 · 1 files
virtio_input: reset device if input_register_device() fails
Xiong Weimin · Aug 5, 2026 · 1 files
virtio_mmio: disable IRQ wake before free_irq
Xiong Weimin · Aug 5, 2026 · 1 files
vdpa/pds: check virtqueue notify mapping
Xiong Weimin · Aug 6, 2026 · 1 files
vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx
Yu Zhang · Aug 7, 2026 · 1 files
vhost-vdpa: protect config_ctx from being freed under the config callback
Yu Zhang · Aug 7, 2026 · 1 files
vhost/vdpa: reject VRING_NUM larger than device max
Jia Jia · Aug 10, 2026 · 1 files
reboot: fix cad_pid use-after-free race
Cen Zhang (Microsoft) · Aug 14, 2026 · 5 files
nsfs: keep namespace tree fields stable until after RCU grace period
Jérémy Jean · Aug 14, 2026 · 1 files
virtio_ring: fix stale descriptor flags after a failed packed add
Alexander Graf · Aug 17, 2026 · 1 files
MAINTAINERS: Add a section for virtio-rng
Laurent Vivier · Aug 18, 2026 · 1 files
virtio_console: do not free control-out buffers on remove
Jia Jia · Aug 19, 2026 · 1 files
console: fix /dev/kmsg reference in flags kernel doc
Johan Hovold · Aug 19, 2026 · 1 files
fs: don't return -EINVAL for successful nested thaw
Moritz Tanner · Aug 21, 2026 · 1 files
virtio: fix use-after-free in unregister_virtio_device()
Karl Mehltretter · Aug 21, 2026 · 1 files
landlock: Fix use-after-free of the source's parent directory
Norbert Szetei · Aug 22, 2026 · 1 files
ovl: return EINVAL instead of EIO in case of mismatched user_ns
Miklos Szeredi · Aug 25, 2026 · 1 files
netfs: Fix uninitialized return value in netfs_unbuffered_write()
Karl Mehltretter · Aug 27, 2026 · 1 files
netfs: Fix unbuffered/DIO write partial transfer error return
David Howells · Aug 27, 2026 · 1 files
netfs: Fix error vs transferred passed to ->ki_complete()
David Howells · Aug 27, 2026 · 1 files
netfs: Fix i_size update for partial transfer
David Howells · Aug 27, 2026 · 1 files
netfs: Fix subreq ref leak
David Howells · Aug 27, 2026 · 1 files
netfs: break unbuffered write when netfs_alloc_subrequest() fails
Edward Adam Davis · Aug 27, 2026 · 2 files
netfs: Fix readahead synchronisation issues by loading all folios upfront
David Howells · Aug 27, 2026 · 9 files
netfs: Mark folios with COPY_TO_CACHE whilst issuing subreqs
David Howells · Aug 27, 2026 · 7 files
netfs: Fix read progress reporting
David Howells · Aug 27, 2026 · 7 files
cachefiles: Fix potential UAF/KASAN warning
David Howells · Aug 27, 2026 · 2 files
vhost: invalidate vring access on IOTLB transitions
Jia Jia · Aug 28, 2026 · 4 files
vduse: do not take dev->rwsem in the virtqueue kick path
Nikhil · Aug 29, 2026 · 1 files
vduse: validate virtqueue alignment
Jia Jia · Aug 30, 2026 · 1 files
exit: hold a reference to thread_pid across proc_flush_pid
Daehyeon Ko · Aug 31, 2026 · 1 files
printk/nbcon: Flush nbcon_irq_work in nbcon_free()
John Ogness · Sep 1, 2026 · 1 files
printk/nbcon: Change nbcon_irq_work to IRQ_WORK_LAZY
John Ogness · Sep 1, 2026 · 1 files
vdpa_sim_blk: reject out-of-range sector starts
Linfeng Sun · Sep 1, 2026 · 1 files
vdpa_sim_net: check TX pull result before RX copy
Linfeng Sun · Sep 1, 2026 · 1 files
exec: Drop bprm loader before closing bprm->file
Sun Jian · Sep 1, 2026 · 1 files
afs: Fix missing kunmap in afs_dir_search_bucket()
David Howells · Sep 2, 2026 · 1 files
afs: Fix double-unmap of directory block
David Howells · Sep 2, 2026 · 3 files
afs: Fix incorrect free in candidate cleanup in afs_lookup_server()
David Howells · Sep 2, 2026 · 1 files
afs: Clear stale peer app data after address list changes
Chengfeng Ye · Sep 2, 2026 · 2 files
vhost: limit outstanding IOTLB misses per virtqueue
Linfeng Sun · Sep 3, 2026 · 2 files
fs: autofs: fix memory leak in autofs_fill_super()
Jeffin Philip · Sep 3, 2026 · 1 files
virtio: add Eugenio Pérez as Maintainer
Eugenio Pérez · Sep 3, 2026 · 1 files
virtio-pci: return IRQ_HANDLED after non-zero ISR
Andrew Stellman · Sep 4, 2026 · 1 files
virtio_input: stop callbacks before unregistering input device
Karl Mehltretter · Sep 5, 2026 · 1 files
selftests/landlock: Test abstract socket trace name limits
Mickaël Salaün · Sep 7, 2026 · 1 files
landlock: Clean up ruleset validation checks
Mickaël Salaün · Sep 7, 2026 · 2 files
nstree: check listing permission before taking a namespace reference
Norbert Szetei · Sep 7, 2026 · 1 files
landlock: Bound escaped trace path output
Mickaël Salaün · Sep 7, 2026 · 1 files
landlock: Test trace path output boundaries
Mickaël Salaün · Sep 7, 2026 · 3 files
exec: do_close_on_exec() before taking exec_update_lock
Jann Horn · Sep 7, 2026 · 1 files
vduse: return compat ioctl results directly
Linfeng Sun · Sep 8, 2026 · 1 files