Daily update · Oct 5–6, 2026
SELinux and keyring races fixed, Braille serial support added
Linux patches address race conditions in SELinux and key management, fix NFS labeling on remounts, and enable Braille consoles on newer serial drivers.
In brief
This daily update covers several security and correctness fixes in SELinux and kernel key management, plus an accessibility improvement for Braille consoles. The fixes include two race conditions, an NFS labeling regression, and a persistent keyring timeout issue.
Bug fixes
SELinux: annotate AVC notification race
KCSAN detected concurrent reads and writes of `latest_notif` in the SELinux Access Vector Cache. The fix marks the lockless read and update with READ_ONCE/WRITE_ONCE while keeping the spinlock for writer serialization.
Why it matters: Removes a reported data race; no user-visible behavior change is expected.
SELinux: keep NFS labeling on reused superblocks
When an NFSv4 filesystem with `security_label` is mounted again, SELinux's option handling could skip setting SECURITY_LSM_NATIVE_LABELS because the superblock was already initialized. NFS then cleared its security-label capability on the shared server, disabling per-file labels for both mounts.
Why it matters: Fixes loss of per-file labeling on NFS remounts.
keys: apply persistent keyring timeout even if link fails
KEYCTL_GET_PERSISTENT creates a persistent keyring before trying to link it into the destination keyring. If the link failed (e.g. due to a restriction), the timeout was never set, leaving the keyring in a hidden register without an expiry.
Why it matters: Prevents persistent keyrings from lingering without their configured timeout after a failed link attempt.
KEYS: close add_key race with keyring restrictions
The kernel snapshot a keyring's restriction before taking the keyring semaphore, letting a concurrent restriction install be bypassed. The fix moves the restriction read to after locking, serializing it with restriction changes.
Why it matters: Closes a race that could allow adding keys to a keyring after a reject-all restriction is installed.
Accessibility
braille: support serial consoles using the NBCON API
The Braille console writes through the associated serial console driver's write callback. With serial drivers moving to the NBCON console API, the Braille path needed to handle those callbacks in the same way as the legacy console flush loop.
Why it matters: Keeps Braille consoles functional on systems using serial drivers converted to NBCON.
Source commits5 entries +
keys: finalize persistent keyring timeout after link attempt
Karl Mehltretter · Sep 12, 2026 · 1 files
selinux: fix data race on AVC latest_notif
Christian Göttsche · Sep 23, 2026 · 1 files
selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts
Stephen Smalley · Sep 28, 2026 · 1 files
KEYS: Fix add_key() race with keyring restriction
성병찬 · Sep 30, 2026 · 1 files
braille: nbcon: Allow to use a serial console with NBCON API as Braille console
Petr Mladek · Oct 1, 2026 · 7 files