| Published | Title | Version | Author | Status |
|---|---|---|---|---|
| 2026-11-12 22:08 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 10 | josef@toxicpanda.com | - |
| 2026-11-12 04:02 UTC | KEYS: Sanitize the garbage collector | 6 | jarkko@kernel.org | - |
| 2026-11-11 20:35 UTC | bpf, lsm: Mark backing_file_alloc/free LSM hooks as untrusted | 1 | snizovtsev@cloudlinux.com | - |
| 2026-11-11 15:56 UTC | KEYS: two fixes for the asymmetric keyctl operations | 1 | devnull@kernel.org | - |
| 2026-11-10 20:30 UTC | Fix Landlock mediation of capabilities guarding LSM policies | 1 | mic@digikod.net | - |
| 2026-11-10 20:28 UTC | Fix LSM mediation of PR_SET_SECUREBITS | 1 | mic@digikod.net | - |
| 2026-11-10 20:22 UTC | security: introduce Kernel Assurance Plane | 3 | harisudhan@armoriq.io | - |
| 2026-11-10 14:42 UTC | userns: Let LSMs deny the CAP_SETFCAP snapshot for mapping uid 0 | 1 | mic@digikod.net | - |
| 2026-11-10 13:06 UTC | lockdown: fix the securityfs interface and add tests | 1 | caixinchen1@huawei.com | - |
| 2026-11-10 09:14 UTC | fs: don't use pseudo filesystem files as storage | 1 | brauner@kernel.org | - |
| 2026-11-10 07:19 UTC | ima: fix races when deleting measurement list entries | 3 | liuwb@xiaopeng.com | - |
| 2026-11-10 05:33 UTC | KEYS: Replace assoc_array with rhashtable | 9 | jarkko@kernel.org | - |
| 2026-11-10 04:40 UTC | KEYS: Replace assoc_array with rhashtable | 8 | jarkko@kernel.org | - |
| 2026-11-10 03:37 UTC | KEYS: Replace assoc_array with rhashtable | 7 | jarkko@kernel.org | in progress |
| 2026-11-10 03:02 UTC | KEYS: Protect pkey method checks against type removal | 7 | 0xbeac@gmail.com | in progress |
| 2026-11-09 19:49 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 9 | josef@toxicpanda.com | finished in 5h6m0s |
| 2026-11-09 13:17 UTC | ipv4: do not write shared IP options when sending ICMP errors | 2 | edumazet@kernel.org | finished in 3h55m0s |
| 2026-11-09 12:33 UTC | ima: fix races when deleting measurement list entries | 2 | liuwb@xiaopeng.com | finished in 4h34m0s |
| 2026-11-09 05:52 UTC | KEYS: Protect pkey method checks against type removal | 6 | 0xbeac@gmail.com | finished in 4h58m0s |
| 2026-11-09 02:52 UTC | net: annotate data-races around sysctl knobs | 1 | jiayuan.chen@linux.dev | finished in 4h11m0s |
| 2026-11-08 22:27 UTC | KEYS: Sanitize the garbage collector | 5 | jarkko@kernel.org | finished in 4h14m0s |
| 2026-11-08 19:04 UTC | ima: fix kexec measurement buffer overflow after failed loads | 1 | jeremy.jean@oss.cyber.gouv.fr | finished in 2h31m0s |
| 2026-11-08 13:14 UTC | KEYS: Protect pkey method checks against type removal | 5 | 0xbeac@gmail.com | finished in 4h41m0s |
| 2026-11-07 23:05 UTC | evm: fix TOCTOU heap OOB in protected xattr reads | 2 | jeremy.jean@oss.cyber.gouv.fr | finished in 4h17m0s |
| 2026-11-07 19:56 UTC | KEYS: Replace assoc_array with rhashtable | 6 | jarkko@kernel.org | finished in 4h13m0s |
| 2026-11-07 19:49 UTC | evm: fix TOCTOU heap OOB in protected xattr reads | 1 | jeremy.jean@oss.cyber.gouv.fr | finished in 4h18m0s |
| 2026-11-07 18:35 UTC | apparmor: hold candidate profile reference during attachment lookup | 1 | bestswngs@gmail.com | finished in 4h14m0s |
| 2026-11-07 13:15 UTC | KEYS: Sanitize the garbage collector | 4 | jarkko@kernel.org | finished in 4h34m0s |
| 2026-11-07 10:25 UTC | apparmor: safely acquire the cached label in aa_file_perm() | 1 | bestswngs@gmail.com | finished in 4h32m0s |
| 2026-11-06 23:43 UTC | ipv4: unclone skbs before recompiling IP options | 1 | edumazet@kernel.org | finished in 3h49m0s |
| 2026-11-06 21:40 UTC | cipso: stop modifying live ip_options_rcu | 1 | jannh@google.com | finished in 4h2m0s |
| 2026-11-06 18:55 UTC | apparmor: fix out-of-bounds read in unix socket address audit | 1 | bsdhenrymartin@gmail.com | finished in 4h7m0s |
| 2026-11-06 11:10 UTC | lsm: don't call d_path() when current->fs is NULL | 2 | drifabdelmalekmohamedsaid@gmail.com | finished in 4h18m0s |
| 2026-11-06 07:12 UTC | pidfd: Add task path ioctls | 5 | devnull@kernel.org | skipped |
| 2026-11-05 22:00 UTC | KEYS: Return user session keyring on lookup | 3 | jarkko@kernel.org | finished in 4h12m0s |
| 2026-11-05 21:30 UTC | mm: continue vma_flags_t conversion | 1 | ljs@kernel.org | finished in 4h15m0s |
| 2026-11-05 19:37 UTC | initramfs: add support for xattrs in the initial ram disk | 6 | dannyhu@arista.com | skipped |
| 2026-11-05 19:36 UTC | KEYS: Protect pkey method checks against type removal | 4 | 0xbeac@gmail.com | finished in 4h11m0s |
| 2026-11-05 17:22 UTC | security: Expand task_setscheduler LSM hook | 5 | atomlin@atomlin.com | finished in 4h32m0s |
| 2026-11-05 04:38 UTC | KEYS: Protect pkey method checks against type removal | 3 | 0xbeac@gmail.com | finished in 4h50m0s |
| 2026-11-05 03:13 UTC | KEYS: Replace assoc_array with rhashtable | 5 | jarkko@kernel.org | finished in 4h24m0s |
| 2026-11-05 00:53 UTC | KEYS: Sanitize the garbage collector | 3 | jarkko@kernel.org | finished in 4h12m0s |
| 2026-11-04 15:03 UTC | calipso: do not charge request socket options to the listener | 1 | edumazet@kernel.org | finished in 4h25m0s |
| 2026-11-04 14:24 UTC | cred: gather the "same uid" checks between tasks in one place | 2 | josef@toxicpanda.com | finished in 3h56m0s |
| 2026-11-04 11:09 UTC | memcg: dma-buf cgroup accounting and charge transfer | 4 | aesteve@redhat.com | finished in 51m0s |
| 2026-11-04 05:37 UTC | ima: hold ima_extend_list_mutex while locating the trim position | 1 | liuwb@xiaopeng.com | finished in 4h32m0s |
| 2026-11-03 15:17 UTC | mseal sysmap: Choose system mapping sealing at boot | 2 | chris@chrisdown.name | finished in 5h19m0s |
| 2026-11-03 07:53 UTC | lockdown: fix the securityfs interface and add tests | 1 | caixinchen1@huawei.com | finished in 5h35m0s |
| 2026-11-03 03:21 UTC | ima: initialize the real inode attributes of the iint cache | 2 | caixinchen1@huawei.com | finished in 4h45m0s |
| 2026-11-02 14:45 UTC | Landlock: Restrict POSIX message queue creation and access | 2 | webprosto@gmail.com |
finished
in 1h19m0s
[1 findings] |
| 2026-11-02 13:05 UTC | af_unix: introduce MSG_CMSG_SEALED | 1 | omosnacek@gmail.com | finished in 4h32m0s |
| 2026-11-02 02:22 UTC | ima: initialize the real inode attributes of the iint cache | 1 | caixinchen1@huawei.com | finished in 4h11m0s |
| 2026-10-31 09:28 UTC | KEYS: Reject restricted dest_keyring in construct_alloc_key() | 1 | jarkko@kernel.org | finished in 4h7m0s |
| 2026-10-30 21:09 UTC | initramfs: add support for xattrs in the initial ram disk | 5 | dannyhu@arista.com | skipped |
| 2026-10-30 17:39 UTC | KEYS: request_key: enforce keyring restrictions on constructed keys | 1 | permissiontogallop@gmail.com | finished in 4h16m0s |
| 2026-10-29 16:40 UTC | ns: fixes for the namespace LSM hooks | 2 | brauner@kernel.org | finished in 3h53m0s |
| 2026-10-29 15:54 UTC | smack: do not override the subject label in overlayfs hooks | 1 | m.moscicki2@samsung.com | finished in 1h28m0s |
| 2026-10-29 14:06 UTC | apparmor: fix race on NULL ctx->peer in update_sk_ctx() | 1 | emanuele.rocca@arm.com | finished in 3h53m0s |
| 2026-10-29 03:39 UTC | cipso: fix optlen corruption in cipso_v4_delopt() | 4 | q.h.hack.winter@gmail.com | finished in 4h10m0s |
| 2026-10-28 22:16 UTC | userns: per-namespace capability bounding set and opt-in netns loopback | 1 | halg@google.com | finished in 4h11m0s |
| 2026-10-27 15:02 UTC | memcg: dma-buf cgroup accounting and charge transfer | 3 | aesteve@redhat.com | finished in 3h50m0s |
| 2026-10-27 14:22 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 8 | josef@toxicpanda.com | finished in 4h34m0s |
| 2026-10-27 11:43 UTC | mseal sysmap: Choose system mapping sealing at boot | 1 | chris@chrisdown.name | skipped |
| 2026-10-27 08:46 UTC | pidfd: add task path ioctls | 4 | devnull@kernel.org | skipped |
| 2026-10-26 21:00 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 7 | josef@toxicpanda.com | finished in 3h52m0s |
| 2026-10-26 15:41 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 6 | josef@toxicpanda.com | finished in 3h54m0s |
| 2026-10-26 13:36 UTC | apparmor: handle diff-encoded states in leftmatch_fb() | 1 | invarianztheorem@posteo.com | finished in 4h15m0s |
| 2026-10-26 09:57 UTC | ns: fixes for the namespace LSM hooks | 1 | brauner@kernel.org | finished in 3h57m0s |
| 2026-10-25 20:45 UTC | fsverity: Tell LSMs about signature only after verity is enabled | 1 | ebiggers@kernel.org | finished in 4h2m0s |
| 2026-10-23 16:30 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 5 | josef@toxicpanda.com | finished in 3h47m0s |
| 2026-10-22 21:15 UTC | fsverity: Explicitly require FMODE_READ to retrieve hashes | 1 | ebiggers@kernel.org | finished in 3h50m0s |
| 2026-10-22 18:36 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 4 | josef@toxicpanda.com | finished in 3h59m0s |
| 2026-10-21 20:37 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 3 | josef@toxicpanda.com | finished in 3h54m0s |
| 2026-10-21 15:42 UTC | memcg: dma-buf cgroup accounting and charge transfer | 2 | aesteve@redhat.com | finished in 4h23m0s |
| 2026-10-21 03:15 UTC | UUID and GUID user and group ids (*_r system calls) | 2 | jan.koester@tuxist.de |
finished
in 56m0s
[1 findings] |
| 2026-10-20 14:00 UTC | apparmor: check address length before reading AF_UNSPEC bind address | 1 | mike.michalo@gmail.com | finished in 4h25m0s |
| 2026-10-19 22:28 UTC | lsm: don't call d_path() when current->fs is NULL | 1 | drifabdelmalekmohamedsaid@gmail.com | finished in 3h54m0s |
| 2026-10-19 21:40 UTC | IPE: add a dedicated policy keyring | 1 | devnull@kernel.org | finished in 4h0m0s |
| 2026-10-19 14:56 UTC | KEYS: Return user session keyring on lookup | 2 | jarkko@kernel.org |
finished
in 4h16m0s
[1 findings] |
| 2026-10-18 17:31 UTC | cred: gather the "same uid" checks between tasks in one place | 1 | josef@toxicpanda.com | finished in 4h0m0s |
| 2026-10-17 15:21 UTC | keys: big_key: Remove the redundant quota reservation | 2 | 4ncienth@gmail.com | finished in 3h51m0s |
| 2026-10-16 14:37 UTC | selinux: don't label bridged packets in selinux_ip_forward() | 1 | joasantonio108@gmail.com | finished in 2h22m0s |
| 2026-10-16 04:00 UTC | keys: big_key: Reserve the final quota before destroying the payload | 1 | 4ncienth@gmail.com | finished in 4h11m0s |
| 2026-10-15 12:26 UTC | landlock: Add READ_METADATA and WRITE_METADATA access rights | 2 | caixinchen1@huawei.com | finished in 4h40m0s |
| 2026-10-15 09:38 UTC | vfs: add inode iteration method super_iter_inodes | 1 | huangsj@hygon.cn | skipped |
| 2026-10-14 20:47 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 2 | josef@toxicpanda.com | finished in 4h0m0s |
| 2026-10-14 08:27 UTC | Landlock: Namespace and capability control | 6 | mic@digikod.net | finished in 3h50m0s |
| 2026-10-13 16:47 UTC | fs: unified VFS ancestor walk for Landlock and BPF | 1 | utilityemal77@gmail.com | finished in 3h53m0s |
| 2026-10-13 09:03 UTC | keys: Fix quota-owner reads and ownership accounting | 4 | nicoyip.dev@gmail.com | finished in 3h58m0s |
| 2026-10-12 21:57 UTC | apparmor: fix query_data() output overlapping the lookup key | 1 | cenzhang@linux.microsoft.com | finished in 4h37m0s |
| 2026-10-10 10:20 UTC | pidfd: add task path ioctls | 3 | devnull@kernel.org | finished in 3h56m0s |
| 2026-10-09 15:59 UTC | calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() | 2 | joasantonio108@gmail.com | finished in 4h41m0s |
| 2026-10-08 20:57 UTC | keys: Add well known IDs for fs-verity/dm-verity keys | 2 | andrew@amutable.com | finished in 4h1m0s |
| 2026-10-08 15:28 UTC | calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() | 1 | joasantonio108@gmail.com | finished in 4h15m0s |
| 2026-10-08 15:28 UTC | calipso: update payload_len when removing the CALIPSO option | 2 | joasantonio108@gmail.com | finished in 4h12m0s |
| 2026-10-07 15:25 UTC | calipso: update payload_len when removing the CALIPSO option | 1 | joasantonio108@gmail.com | finished in 5h2m0s |
| 2026-10-07 15:25 UTC | calipso: hash the cache key, not the option start, in calipso_cache_add() | 1 | joasantonio108@gmail.com | finished in 5h1m0s |
| 2026-10-07 10:02 UTC | Landlock: Namespace and capability control | 5 | mic@digikod.net |
finished
in 1h31m0s
[1 findings] |
| 2026-10-06 15:44 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 1 | josef@toxicpanda.com | finished in 4h1m0s |
| 2026-10-06 10:58 UTC | landlock: Fix superblock use-after-free in release_inode() | 1 | gnoack@google.com | finished in 4h5m0s |