Daily update · Sep 14–15, 2026
RDMA security fixes lead this kernel update batch
Software RoCE drivers get fixes for a remotely triggerable out-of-bounds access and a Dirty COW-like flaw, alongside memory management and filesystem corrections.
In brief
This mainline update is led by the RDMA subsystem: the software implementations rxe and siw receive fixes for memory-safety bugs, one remotely triggerable and one that could let an unprivileged user modify read-only file pages. The rest of the batch includes memory management accounting fixes and filesystem fixes for DAX and 9p.
RDMA
Fix remotely triggerable out-of-bounds access in RDMA/rxe
mr_check_range() used wraparound-prone arithmetic when validating RDMA read/write requests, so a crafted request could bypass the range check and lead to an out-of-bounds access in the software RoCE driver.
Why it matters: A remote peer on an rxe network could trigger a kernel oops; the check is now overflow-safe.
Restore write permission check in RDMA/rxe ODP path
A previous cleanup dropped the HMM_PFN_WRITE check, allowing ODP write operations to modify read-only page-cache pages without breaking copy-on-write.
Why it matters: Unprivileged users could overwrite files they only had read access to, a primitive similar to Dirty COW. The check is restored.
Bound fragmented header copies in RDMA/siw
When an extended RDMA header arrived over multiple TCP segments, siw_get_hdr() copied too many bytes and could overwrite receive state, leading to an out-of-bounds write.
Why it matters: A remote peer could corrupt the receive path; the copy length is now based on the number of bytes already received.
Fix mmap/disassociation deadlock in RDMA/uverbs
A lock ordering issue between mmap_lock and the disassociation lock could deadlock when a process forks while a device is being disassociated. The fix replaces the problematic lock with the existing hw_destroy_rwsem.
Why it matters: Avoids an ABBA deadlock in the uverbs core.
Memory management
Fix swap usage counter collision at 4 TiB
The off-list bit for swap devices shares a bit with the usage count; on 4 KiB-page systems the count could reach that bit and make /proc/swaps under-report usage or cause swapoff to tear down a device while pages are still swapped out.
Why it matters: Systems with more than 4 TiB swapped could see accounting errors and possible data loss on swapoff.
Fix mremap locked_vm double-counting
MREMAP_DONTUNMAP cleared the VMA_LOCKED_BIT before the locked_vm accounting was updated, leaving the count inflated.
Why it matters: mlock accounting could be wrong, potentially allowing more locked memory than intended or failing munlock accounting.
Filesystems
Fix DAX panic on empty xarray entry
dax_to_folio() could be called on an empty xarray entry, causing a kernel panic when booting with DAX storage. The fix adds empty-entry checks before conversion.
Why it matters: Prevents a boot-time panic on DAX-enabled systems.
Fix 9p write size tracking
v9fs_issue_write() did not update i_size and remote_i_size after a write that extended the file, so the local cache could disagree with the server.
Why it matters: Potential incorrect file sizes and cache coherency issues on 9p mounts.
Source commits46 entries +
nfsd: fix handling of NFSEXP_PNFS in the netlink codepath
Jeff Layton · Apr 14, 2026 · 1 files
RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
Michael Bommarito · Jun 17, 2026 · 1 files
RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths
Weiming Shi · Jul 26, 2026 · 1 files
fs/dax: check zero or empty entry before converting xarray entry
Seunguk Shin · Aug 3, 2026 · 1 files
IB/hfi1: Resolve the credit-return buffer through the send context's node
Shuhei Takeshita · Aug 9, 2026 · 1 files
IB/hfi1: Fix the PIO_CRED credit-return mmap
Shuhei Takeshita · Aug 9, 2026 · 1 files
RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency
Or Har-Toov · Aug 11, 2026 · 3 files
RDMA/mlx5: Remove warn on missing representor in query_port_speed
Or Har-Toov · Aug 11, 2026 · 1 files
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
Krystian Kaniewski · Aug 12, 2026 · 1 files
RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
Gang Yan · Aug 14, 2026 · 1 files
IB/mlx4: Fix use-after-free on pkey sysfs registration failure
Shuangpeng Bai · Aug 16, 2026 · 1 files
fs: fix missed removal of super_fs_objects_eligible()
Qi Zheng · Aug 17, 2026 · 1 files
RDMA/srp: Fix srp_remove_target()
Bart Van Assche · Aug 18, 2026 · 1 files
IB/iser: reject a remote invalidation of an unregistered direction
Yehyeong Lee · Aug 19, 2026 · 1 files
IB/isert: wait for deferred control PDU completions before releasing the connection
Yehyeong Lee · Aug 21, 2026 · 2 files
RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup
Linkai Gong · Aug 21, 2026 · 1 files
RDMA/rtrs: guard against null kobj name
Ryan Mehri · Aug 23, 2026 · 2 files
RDMA/bnxt_re: Avoid exposing umdbr to userspace
Sriharsha Basavapatna · Aug 24, 2026 · 2 files
RDMA/uverbs: Fix potential leak of resources->collection in flow_resources_alloc()
Li RongQing · Aug 26, 2026 · 1 files
RDMA/mad: Fix receive buffer leak when PKey enforcement fails
Li RongQing · Aug 26, 2026 · 1 files
RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
Guoqing Jiang · Aug 27, 2026 · 1 files
RDMA/rxe: validate access flags before swapping the MR's PD
Norbert Szetei · Aug 27, 2026 · 1 files
mm/huge_memory: bypass THP tuneables for huge pfnmap mappings
Lorenzo Stoakes (ARM) · Aug 27, 2026 · 1 files
RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables
Cheng Xu · Aug 28, 2026 · 2 files
mailmap: map Coiby Xu's address
Coiby Xu · Aug 28, 2026 · 1 files
mm/mremap: account mm->locked_vm correctly for MREMAP_DONTUNMAP
Lorenzo Stoakes (ARM) · Aug 28, 2026 · 1 files
mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count
Nhat Pham · Aug 28, 2026 · 1 files
memcg: avoid charging the root memcg from obj_cgroup_charge_pages()
Shakeel Butt · Aug 29, 2026 · 1 files
mailmap: update entry for Christopher Obbard
Christopher Obbard · Aug 29, 2026 · 1 files
mm: filemap: retain mapped dropbehind folios
Wenjie Qi · Aug 29, 2026 · 1 files
RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
Quanye Yang · Aug 30, 2026 · 2 files
MAINTAINERS: update memblock tree URLs
Mike Rapoport (Microsoft) · Aug 31, 2026 · 1 files
RDMA/ucma: Serialize join and leave on copy_to_user failure
Quanye Yang · Aug 31, 2026 · 1 files
RDMA/irdma: Enforce local fence for IB_WR_REG_MR
Jacob Moroni · Sep 1, 2026 · 1 files
mm/mlock: use the IRQ-safe accessor for NR_MLOCK in __munlock_folio()
Shakeel Butt · Sep 1, 2026 · 1 files
remove old lib/alloc_tag.c
Andrew Morton · Sep 1, 2026 · 1 files
mm/folio: EXPORT_SYMBOL_FOR_KVM(lru_cache_drain_for_folio)
Ackerley Tng · Sep 2, 2026 · 1 files
mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem
Jiayuan Chen · Sep 2, 2026 · 1 files
mm: memblock: show all region flags in debugfs
Meijing Zhao · Sep 2, 2026 · 1 files
IB/IPoIB: Avoid restoring OPER_UP after multicast flush
Carolina Jubran · Sep 2, 2026 · 3 files
mm/vma: correctly unaccount on mmap_prepare() failure
Lorenzo Stoakes (ARM) · Sep 2, 2026 · 1 files
RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
Jeffin Philip · Sep 4, 2026 · 1 files
RDMA/siw: Bound fragmented header copies by the remaining length
Jérémy Jean · Sep 8, 2026 · 1 files
RDMA/efa: Keep admin queues alive while IRQ is registered
Leon Romanovsky · Sep 10, 2026 · 2 files
RDMA/efa: Keep EQ resources alive while IRQ is registered
Leon Romanovsky · Sep 10, 2026 · 3 files
9p: Fix v9fs_issue_write() to update i_size and remote_i_size
David Howells · Sep 11, 2026 · 1 files