What were the notable Linux updates?

KVM: x86: Fix shadow paging use-after-free due to unexpected GFN, Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm, and KVM: x86: check for nEPT/nNPT in slow flush hypercalls.

Linux

The kernel, distros, and the rigs of the moment

Pick a date

Topics: Infrastructure Full archive →

The Wire · Showcase

KVM SHADOW PAGING USE-AFTER-FREE CLOSES 16-YEAR-OLD HOLE

By RepoJournal · Filed 06:01 UTC on May 4, 2026 · About Linux

The kernel patched a critical use-after-free in KVM's x86 shadow MMU that has been exploitable since the first KVM series shipped — a bug that only surfaces when guest page tables change between VM entries.

Paolo Bonzini merged three x86 KVM fixes overnight that address a cascade of interrupt and memory management bugs [2]. The most severe is the shadow paging use-after-free [1], which stems from a fundamental assumption break: the shadow MMU calculates guest frame numbers using the shadow page's base GFN plus the SPTE index, but this math fails when guest page tables are modified mid-execution. The same batch fixes nested EPT/NPT hypercall validation [3] that could allow L2 guests to invoke slow flush operations when nested paging isn't enabled, and corrects the IRR interrupt reporting logic [4] [5] that was silently dropping pending interrupts during nested VM stress tests. These are production-critical fixes — the shadow paging bug alone has had 16 years to spread, and the interrupt reporting flaw causes hard-to-debug warning cascades in nested virtualization setups.

Action items

→ Pull latest KVM fixes from torvalds/linux before next stable release torvalds/linux [immediate]
→ Monitor nested VM interrupt handling if running hypervisors at scale torvalds/linux [monitor]

References

[1] KVM: x86: Fix shadow paging use-after-free due to unexpected GFN torvalds/linux
[2] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm torvalds/linux
[3] KVM: x86: check for nEPT/nNPT in slow flush hypercalls torvalds/linux
[4] KVM: x86: Fix misleading variable names and add more comments for PIR=>IRR flow torvalds/linux
[5] KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty torvalds/linux

Quick answers

What shipped in Linux on May 4, 2026?: The kernel patched a critical use-after-free in KVM's x86 shadow MMU that has been exploitable since the first KVM series shipped — a bug that only surfaces when guest page tables change between VM entries. In total, 43 commits and 9 pull requests landed.
What were the notable Linux updates?: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN, Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm, and KVM: x86: check for nEPT/nNPT in slow flush hypercalls.

IO_URING FIXES AND SOCKMAP USE-AFTER-FREE PATCH LAND IN 7.2-RC

Linus merged critical io_uring corrections and a high-impact sockmap race condition fix that closes a threading vulnerability in TCP BPF message handling.

infra 83 shipped 1-min read

Linux 1 day ago

KERNEL PATCHES CLOSE NAMESPACE PRIVILEGE ESCALATION GAPS IN TUNNEL DRIVERS

Two critical fixes close a privilege escalation hole in VXLAN and GENEVE tunnel changelink operations that allowed unprivileged callers in one namespace to rewrite devices whose underlay lives elsewhere.

infra 100 shipped 1-min read

Linux 2 days ago

WATCHDOG UAF AND DIVISION-BY-ZERO FIXES LAND IN V7.2-RC5

Linus merged critical watchdog subsystem patches addressing a use-after-free vulnerability and a zero-division crash that could tank embedded systems in production.

infra 40 shipped 1-min read

Linux 3 days ago

KERNEL RC5 LANDS WITH HWMON FIXES AND KVM STABILITY PATCHES

Linux 7.2-rc5 rolls out critical hardware monitoring fixes and RISC-V virtualization patches that tighten KVM stability across multiple architectures.

infra 47 shipped 2-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.