$ the-wire · showcase
Xen backends patch sysfs UAF pair, AMD IOMMU auto-enables PerfOpt
By RepoJournal · Filed · About Linux · Composed from the cited sources · methodology
The xen backends closed two use-after-free windows that opened whenever sysfs statistics were read mid-teardown, while the AMD IOMMU fixes merge moved PerfOpt enablement out of amdgpu and into the domain attachment paths.
xen-blkback: Avoid UAF when reading I/O statistics torvalds/linux
Reading I/O statistics through sysfs while a frontend device was being torn down could hit use-after-free or a NULL dereference, because the read path was never synchronized with freeing the statistics data; a rwlock now serializes the two. The commit is tagged XSA-528 / CVE-2026-100082 and fixes db6fbc106786, which made the st_ statistics per ring, so this covers kernels built since then.
xen-netback: Fix UAF when reading statistics data torvalds/linux
The driver's network statistics are RCU-protected, but the queue teardown on a failed frontend connect (illegal Xenstore data supplied by the guest will do it) freed that data without ever synchronizing RCU, leaving a concurrent sysfs read touching freed or recycled memory. The fix adds a synchronize_net call at the teardown point.
xen-netback: defer xenvif_mcast_addr_list_free() torvalds/linux
xenvif_mcast_addr_list_free() only gets to skip locking and RCU if it runs after all TX/RX processing has stopped, since lookups come from xenvif_start_xmit() while adds and removes come from xenvif_tx_action(). Jan Beulich moves the call out of xenvif_disconnect_data() to past the synchronization point in backend_disconnect, and drops the now-unneeded cleanup on connect()'s error path.
Merge tag 'iommu-fixes-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux torvalds/linux
Joerg Roedel's iommu-fixes-v7.4-rc1 pull request carries the AMD changes: PerfOpt is now managed in the domain attachment paths and cleared before switching to translated or blocked domains, and a boot panic in the GPU identity-mapping quirk when a GPU has no upstream PCI bridge is fixed. Mario Limonciello's patch underneath makes the enablement automatic, so integrated GPUs in identity mode no...
Refresh the Snapdragon device tree list before every boot image build basecamp/omarchy
systemd-stub picks a Snapdragon machine's device tree only from the trees the UKI's DeviceTreeAuto names, and install/hardware/qualcomm/dtb-uki.sh wrote that list once at install time; a kernel update that adds or renames a tree then builds a boot image without it. When such an update also moves the machine's hardware IDs to the new tree, the screen stays black, so the list is now refreshed bef...
Show the disk unlock prompt on Snapdragon X2 machines basecamp/omarchy
On Snapdragon X2 (Glymur) hardware the unlock prompt is drawn to a black screen because msm resets the display when it probes and only redraws after all outputs bind, while the USB-C outputs wait on pmic_glink_altmode, which mkinitcpio's hooks do not add. Reported on the HP OmniBook Ultra 14-kg0xxx and the Anduril BlueChip, both of which reach the desktop if you type the password blind.
Install the OEM firmware package for each Snapdragon machine (#17389) basecamp/omarchy
Also in Omarchy's Snapdragon work: qualcomm/oem-firmware.sh installs the per-machine firmware package for the folders the device tree still lacks firmware in, deepest folder first so the Surface-shared folder goes to the package the machine's own folder brought in.
Action items
