Linux moved master to the rc7 tag on 11 Oct 2026. The sample is 75 commits, 106 files, 885 insertions, and 500 deletions. The operator visible changes are an io_uring memlock regression PostgreSQL already hit, holes in the connect filter and in disabled ring restrictions, and two XFS exchange range bugs that can rewrite a shared block.
SQ and CQ rings leave the memlock limit ¶
io_uring_setup() started returning ENOMEM to unprivileged callers after the SQ and CQ rings moved onto the region allocator. io_create_region() charges those pages to RLIMIT_MEMLOCK. The rings had been exempt and were accounted to memcg instead. The default limit is 8 MiB, so a user without CAP_IPC_LOCK hits it.
io_uring_queue_init(4096, ...) in a loop creates 64 rings on v6.13 and stops at 21 on v6.14. PostgreSQL already saw this ENOMEM. The accounting fix passes a NULL user for the SQ and CQ regions, at setup and on resize, so those pages are not charged.
Provided buffer rings had the same regression. The follow up in kbuf.c stops charging them. Registered parameter regions and zero copy receive rings still pass ctx->user.
Memlock no longer bounds those three ring types. The pages still come from the allocator, and memcg still sees them. Cap the ring count in the application, or with memcg, if the rlimit was doing that job. Callers that raised memlock only to get past io_uring_setup() can put the limit back.
Connect filters and inherited register restrictions ¶
io_connect_bpf_populate() filled connect.port and connect.v6_addr for AF_INET6 only when addr_len reached 28, the size of struct sockaddr_in6. IPv6 also accepts SIN6_LEN_RFC2133, 24 bytes, which already holds the port and the address. At 24 bytes the filter sees zeros and the kernel connects to the real peer. A deny rule on connect.port == P returns EACCES for [::1]:P at 28 bytes and connects at 24. The threshold change uses 24 bytes. sin6_scope_id stays zero on the short form. 7.2 has the same check, and the patch is marked for stable.
if (conn->addr_len < SIN6_LEN_RFC2133)
break;
IORING_SETUP_R_DISABLED skips the ring’s own register restrictions until enable, so the creator can install them. Restrictions copied from the task got that skip too. A restricted task can create a disabled ring, run any register opcode, and then enable it. The restriction fix in register.c sets IO_RING_F_RESTRICT_INHERITED and keeps checking while the ring is disabled. Enable now requires IORING_REGISTER_ENABLE_RINGS in the allowed set. Restrictions installed on the disabled ring still wait until enable.
io_uring_cancel_generic() will not sleep while local work is pending. Another task can enable a ring that was still disabled when this task took its tctx node, and only that submitter runs local work on IORING_SETUP_DEFER_TASKRUN. The exiting task warns once and spins in do_exit(). A child that enables the ring and must finish IORING_OP_MSG_RING is enough to stick an unprivileged thread on a CPU, and panic_on_warn panics the kernel. The cancel fix sleeps unless io_allowed_defer_tw_run() allows this task to run the work, and it drops the warning.
Exchange range stops rewriting shared blocks ¶
XFS_IOC_EXCHANGE_RANGE with XFS_EXCHANGE_RANGE_TO_EOF swapped full file sizes. The man page sets each new size to that file’s offset plus the length taken from the other file. The size fix in xfs_exchmaps.c and xfs_exchrange.c does that, and it writes the whole page cache back first. The on disk update reads i_disk_size, which stays zero until writeback. Exchanging 12288 dirty bytes returned stat size 0 and bulkstat_single bs_size 18446744073709539328.
Clone a 4096 byte peer on block 100 into the middle of a 12288 byte file. A TO_EOF exchange against a 4096 byte donor, donor offset 8192, sizes that file at 4096 and leaves block 100 shared past EOF. The next 4096 byte exchange looks like a full swap and clears reflink. A write at offset 4096 updates block 100 in place, so the peer changes. mkfs.xfs 7.x enables both reflink and exchange range by default.
The flag change stops clearing reflink on exchange. Shrinking i_disk_size does not unmap blocks past EOF, so coverage through i_disk_size is not every mapping. xfs_exchmaps_ensure_reflink() sets the flag on both inodes first, and both keep it. Old log items may still carry the clear bits. Recovery already masks them off.
XFS_IOC_SWAPEXT swapped the flag too. If either inode has it, both now get the flag and a CoW fork, and the flag stays until FALLOC_FL_UNSHARE_RANGE, xfs_scrub, or a truncate to zero. Both fixes target stable back to v6.10. Files that used to lose reflink after a full exchange keep CoW on the next write.
Shared skbs and short Xen receives ¶
macb_pad_and_fcs() appends the frame check sequence in place when the skb has tailroom. A shared skb grows by one FCS per transmit. pktgen with clone_skb does that, BQL completes more bytes than it queued, and dql_completed() hits BUG_ON. On a Raspberry Pi CM5 RP1 GEM, clone_skb 1000, burst 32, and 60 byte frames kill the box. The macb fix in macb_main.c copies a shared skb before the append. Clearing IFF_TX_SKB_SHARING would also stop it, and pktgen would then refuse clone_skb on macb.
xen-netfront.c used the backend slot length as the pull length and never required ETH_HLEN. A short head bugs in eth_type_trans() via __skb_pull(), or reads past a short packet. The short header fix pulls at least ETH_HLEN and drops the skb, counting rx_errors. Too many slots makes xennet_fill_frags() fail after the skb has left tmpq, so the skb and its pages leak. The leak fix queues it back first.
The AER change skips recovery when a firmware first report has no unmasked error bits. Empty fatal reports were resetting devices, including a root port whose GPU then failed probe. All ones in status and mask, an unreachable device, skips recovery too.
What to watch ¶
The memlock, connect, register restriction, and cancel fixes are marked for stable. The connect note names 7.2. The XFS fixes name v6.10. Confirm them on the tree you boot before you lower memlock or keep using XFS_IOC_EXCHANGE_RANGE on reflinked files.
SQ, CQ, and provided buffer rings sit outside RLIMIT_MEMLOCK again. A small limit will not fail io_uring_setup() for those rings. Cap them in the application or in memcg.
KVM indexed a 16 entry table in mmu.h with the shadow stack bit set. UBSAN reports index 34 for error code 0x44 when Windows 11 Hyper-V runs on KVM. The fix masks the bit for the lookup and still returns it to L1. Landlock drops __counted_by on handled_masks in domain.h. Clang 22 reads that counter from the flexible array inside a union, and the second landlock_restrict_self() panics under CONFIG_FORTIFY_SOURCE.