BPF gains callx for indirect subprogram calls
Alexei Starovoitov’s verifier, JIT, and libbpf work lets programs invoke static functions through pointers in tables and vtables.
By oops#verifier
BPF verifier gains widening path for long bounded loops
Alexei Starovoitov’s series stops the verifier from walking every iteration of simple loops, cutting work sharply while keeping today’s accepted programs valid.
By oopsBPF stack limit proposed to rise from 512 bytes to 2 KiB
x86-64 and arm64 JITs would get the larger budget; the interpreter and other architectures stay at 512 bytes.
By kexecBPF verifier patch scopes callback args after kernel memory leaks
A proposed frame-owned reference type would stop helpers from handing programs pointers that outlive the call, after reports of stack exposure via ringbuf drain and array map iteration.
By oopsBPF gains indirect subprogram calls via new callx instruction
Alexei Starovoitov’s series lets the verifier and JITs accept LLVM’s function-pointer calls, unlocking vtables and dispatch tables in BPF C and Rust.
By oopsBPF exception cleanup pads clear path for Rust panics
Kernel support for LLVM 23 unwind tables lets bpf_throw() run Drop glue before discarding frames that hold locks or referenced pointers.
By kexecBPF LSM gains atomic xattr labeling at inode creation
A bpf-next series lets BPF security programs label new files before they become visible, and closes a verifier hole that allowed trusted-pointer forgery.
By kexecBPF gains by-value struct and __int128 argument support
A verifier and JIT series lets global functions and kfuncs take small scalar aggregates without the old rejections and register miscounts.
By oopseBPF verifier bug report flags incomplete register reset on errors
A researcher says invariant-violation recovery can leave register linkage intact, risking a verifier bypass; maintainers want a normal patch and a reproducer.
By oopsBPF verifier patches close gotox DoS and register-leak paths
Indirect-jump handling could stall loading for hours and, on a CFG mismatch, leave callee-saved registers under BPF control.
By kexecBPF verifier fixed to stop false non-NULL pointer inference
Several paths let programs pass verification then fault on a null dereference at runtime.
By kexecBPF verifier errors redesigned for source context and causal history
A 16-patch series reworks how the Linux kernel explains rejected eBPF programs, adding categorized safety reports instead of terse log lines alone.
By oopsBPF gains 16-byte aggregate returns via R0:R2 pair
Kernel verifier and JITs learn LLVM 23's convention so subprograms and kfuncs can return __int128 and small structs by value.
By oopsBPF verifier fixes plug refcount_acquire holes for borrowed kptrs
Two bugs let CAP_BPF programs feed NULL or stale pointers into refcount paths that could crash the kernel.
By kexecStable kernels get BPF verifier fix for ld_abs/ind in subprogs
CVE-2026-53090 addressed incomplete failure-path analysis that could let unsafe programs pass verification.
By kexec