RepoJournal
Linux Linux
152 wires and counting

$ follow Linux

Keep up with Linux in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-04
stories 52
RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

KVM SHADOW PAGING USE-AFTER-FREE CLOSES 16-YEAR-OLD HOLE

By RepoJournal · Filed · About Linux · Composed from the cited sources · methodology

The kernel patched a critical use-after-free in KVM's x86 shadow MMU that has been exploitable since the first KVM series shipped — a bug that only surfaces when guest page tables change between VM entries.

Paolo Bonzini merged three x86 KVM fixes overnight that address a cascade of interrupt and memory management bugs [2]. The most severe is the shadow paging use-after-free [1], which stems from a fundamental assumption break: the shadow MMU calculates guest frame numbers using the shadow page's base GFN plus the SPTE index, but this math fails when guest page tables are modified mid-execution. The same batch fixes nested EPT/NPT hypercall validation [3] that could allow L2 guests to invoke slow flush operations when nested paging isn't enabled, and corrects the IRR interrupt reporting logic [4] [5] that was silently dropping pending interrupts during nested VM stress tests. These are production-critical fixes — the shadow paging bug alone has had 16 years to spread, and the interrupt reporting flaw causes hard-to-debug warning cascades in nested virtualization setups.

Action items

References

  1. [1] KVM: x86: Fix shadow paging use-after-free due to unexpected GFN torvalds/linux ↗
  2. [2] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm torvalds/linux ↗
  3. [3] KVM: x86: check for nEPT/nNPT in slow flush hypercalls torvalds/linux ↗
  4. [4] KVM: x86: Fix misleading variable names and add more comments for PIR=>IRR flow torvalds/linux ↗
  5. [5] KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty torvalds/linux ↗

$ ls linux/reviews/ # the step-back reads

the week in review Omarchy polkit PAM stack skipped system-auth the month in review Linux 7.3 rc cycle fixes cgroup kill, SMB corruption
Full archive → Weekly reviews →

Quick answers

What shipped in Linux on May 4, 2026?
The kernel patched a critical use-after-free in KVM's x86 shadow MMU that has been exploitable since the first KVM series shipped — a bug that only surfaces when guest page tables change between VM entries. In total, 43 commits and 9 pull requests landed.
What were the notable Linux updates?
KVM: x86: Fix shadow paging use-after-free due to unexpected GFN, Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm, and KVM: x86: check for nEPT/nNPT in slow flush hypercalls.
♥

$ log Linux --recent

drm-fixes backs out dma-buf debug, vfs closes pathwalk use-after-frees 29 shipped Netlink stops hashing the net pointer, stmmac clears a stuck RGMII interrupt 27 shipped Poly1305 carry fix lands, Omarchy locks down N1x laptops and idle fingerprint readers 23 shipped Omarchy copies agent logins over SSH, kernel queues 7.4 merges 106 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl rejects conflicting vLLM engine_kwargs, open-instruct adds MILES OPD behind a Megatron learner Interpretability nnsight 0.8.0 cuts import time from 7.6s to 1.6s

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.