The Linux kernel tagged 7.3-rc4 on 20 Sep 2026 after 201 commits on master. The merge window is closed. The signal for people who run storage nodes and ETL drop shares is a cluster of CIFS client bounds bugs, a POSIX CPU timer race that can free a queued timer, and an Intel microcode reject on Granite Rapids.
CIFS snapshot ioctl leaked slab memory ¶
fs/smb/client/smb2ops.c was touched by five commits this window, more than any other file. Most of that work is bounds checking against SMB replies. Pipelines that mount Windows or NAS drop directories through CIFS take this path on listing and snapshot ioctl.
Frank Sorenson rejected short snapshot replies in smb3_enum_snapshots(). SMB2_ioctl() sizes retbuf from the server OutputCount with no lower bound. When snapshot_array_size is smaller than GMT_TOKEN_SIZE, the client set ret_data_len to sizeof(struct smb_snapshot_array) and called copy_to_user(). The struct is 12 bytes. A shorter retbuf makes that copy read past the slab object and leak adjacent kernel memory to userspace. A later clamp of ret_data_len still performed the copy.
if (snapshot_in.snapshot_array_size < GMT_TOKEN_SIZE) {
if (ret_data_len < sizeof(struct smb_snapshot_array)) {
rc = -EIO;
kfree(retbuf);
return rc;
}
ret_data_len = sizeof(struct smb_snapshot_array);
}
Sorenson also fixed reparse buffer bounds in cifs_query_reparse_point(). The start >= end test accepted a DataOffset that left fewer than eight bytes, then read ReparseTag and ReparseDataLength past the buffer. Compound encrypted frames had a stale next_buffer pointer and a NextCommand offset computed from ciphertext length. cifs_chan_skip_or_disable() signaled reconnect after dropping the last channel reference, so the secondary channel and the primary server could both be freed before cifs_signal_cifsd_for_reconnect().
Related patches reject short Next offsets in parse_server_interfaces() and missing iov bounds in parse_posix_sids(). Those are marked for stable too.
POSIX CPU timers freed a queued timer ¶
Thomas Gleixner stopped a timer from being freed while it still sits on the expiry list. An earlier cleanup turned cpu_timer::firing from a tristate into a boolean. That dropped the state “still owned by the firing list, delivery canceled”.
The expiry handler collects the timer onto a private list and sets firing true. timer_settime() sees that bit, clears it, and returns TIMER_RETRY. timer_delete() then sees firing false, unhashes the timer, and frees it. The expiry handler resumes and reads elist.next of freed memory.
The new helper posix_cpu_timer_on_expiry_list() tests list_empty(&timer->it.cpu.elist). If the timer is still queued, it clears firing and returns TIMER_RETRY so the caller drops the timer lock and the expiry path can dequeue it. Timer create also calls INIT_LIST_HEAD on elist so the empty test is defined from the start.
Workloads that use CLOCK_PROCESS_CPUTIME_ID or CLOCK_THREAD_CPUTIME_ID can hit this, including cgroup CPU accounting and JVM CPU time sampling. The patch is in kernel/time/posix-cpu-timers.c and is marked for stable.
Granite Rapids microcode jumps take a machine check ¶
Chang S. Bae rejects microcode loads on Granite Rapids that would jump over revision 0x1000405. The erratum takes a #MC when an update skips that revision. Hosts that live update microcode from intel-microcode packages or vendor blobs should treat a refused load as expected. Apply 0x1000405 before any later revision.
Bae also disabled EGPR emission for CONFIG_X86_NATIVE_CPU=y. -march=native on an APX capable build host can emit %r16 through %r31. The kernel has no context switch support for those registers yet. C builds pass -mno-apx-features=egpr when the compiler accepts it. Rust native builds pass features=-apxf.
Matthew Schwartz fixed FRED #GP delivery for rejected INT n. FRED does the DPL check in software. fred_intx() used to report a zero error code and an IP after the instruction. Wine uses that error code to recognize INT 0x2d. The patch rewinds IP from the FRED instruction length and synthesizes the IDT selector error code (vector << 3) | 2.
Btrfs hole punch could commit a partial inode update ¶
Filipe Manana aborts the transaction when an inode update fails during hole punch or reflink. The code had already dropped file extent items for the range. If the transaction then committed, the tree could keep a hole or a new extent without a matching inode update. Sparse files and reflink copies punch holes on data volumes and were the workloads that could store that inconsistency.
A second patch checks remaining space for a chunk item before reading the stripe count out of the system chunk array in btrfs_validate_super(). The key size was already checked. The chunk item had no size check. A short array would dereference past the buffer during super block validation.
What to watch ¶
CIFS mounts used as ETL drop zones should pick up the 16 Sep 2026 smb: client: series. Short ioctl replies from a buggy or hostile SMB server were a slab leak to userspace. Track those subjects in the distro kernels you run.
Granite Rapids boxes that live update microcode can take a machine check if the blob jumps over 0x1000405. Expect 7.3-rc4 and the stable backports to refuse that load. Confirm the packaged revision before the next firmware roll.
POSIX CPU timer deletion racing expiry is marked for stable. If you sample process CPU clocks from a JVM or a cgroup controller, this is the rc that closes the use after free. The helper to look for is posix_cpu_timer_on_expiry_list().