| Published | Title | Version | Author | Status |
|---|---|---|---|---|
| 2026-11-03 07:53 UTC | lockdown: fix the securityfs interface and add tests | 1 | caixinchen1@huawei.com | - |
| 2026-11-03 03:21 UTC | ima: initialize the real inode attributes of the iint cache | 2 | caixinchen1@huawei.com | - |
| 2026-11-02 13:05 UTC | af_unix: introduce MSG_CMSG_SEALED | 1 | omosnacek@gmail.com | finished in 4h32m0s |
| 2026-11-02 02:22 UTC | ima: initialize the real inode attributes of the iint cache | 1 | caixinchen1@huawei.com | finished in 4h11m0s |
| 2026-10-31 21:12 UTC | audit: fix UAF in kauditd_send_queue() | 1 | jeremy.jean@oss.cyber.gouv.fr | finished in 4h42m0s |
| 2026-10-31 09:28 UTC | KEYS: Reject restricted dest_keyring in construct_alloc_key() | 1 | jarkko@kernel.org | finished in 4h7m0s |
| 2026-10-29 16:40 UTC | ns: fixes for the namespace LSM hooks | 2 | brauner@kernel.org | finished in 3h53m0s |
| 2026-10-29 15:54 UTC | smack: do not override the subject label in overlayfs hooks | 1 | m.moscicki2@samsung.com | finished in 1h28m0s |
| 2026-10-29 03:39 UTC | cipso: fix optlen corruption in cipso_v4_delopt() | 4 | q.h.hack.winter@gmail.com | finished in 4h10m0s |
| 2026-10-28 22:16 UTC | userns: per-namespace capability bounding set and opt-in netns loopback | 1 | halg@google.com | finished in 4h11m0s |
| 2026-10-27 15:02 UTC | memcg: dma-buf cgroup accounting and charge transfer | 3 | aesteve@redhat.com | finished in 3h50m0s |
| 2026-10-27 14:22 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 8 | josef@toxicpanda.com | finished in 4h34m0s |
| 2026-10-27 11:43 UTC | mseal sysmap: Choose system mapping sealing at boot | 1 | chris@chrisdown.name | skipped |
| 2026-10-27 11:16 UTC | cipso_v4: fail the walk on malformed options | 2 | omniameasunt@proton.me | finished in 1h38m0s |
| 2026-10-27 08:46 UTC | pidfd: add task path ioctls | 4 | devnull@kernel.org | skipped |
| 2026-10-26 21:00 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 7 | josef@toxicpanda.com | finished in 3h52m0s |
| 2026-10-26 15:41 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 6 | josef@toxicpanda.com | finished in 3h54m0s |
| 2026-10-26 13:36 UTC | apparmor: handle diff-encoded states in leftmatch_fb() | 1 | invarianztheorem@posteo.com | finished in 4h15m0s |
| 2026-10-26 09:57 UTC | ns: fixes for the namespace LSM hooks | 1 | brauner@kernel.org | finished in 3h57m0s |
| 2026-10-25 20:45 UTC | fsverity: Tell LSMs about signature only after verity is enabled | 1 | ebiggers@kernel.org | finished in 4h2m0s |
| 2026-10-23 16:30 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 5 | josef@toxicpanda.com | finished in 3h47m0s |
| 2026-10-22 18:36 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 4 | josef@toxicpanda.com | finished in 3h59m0s |
| 2026-10-21 20:37 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 3 | josef@toxicpanda.com | finished in 3h54m0s |
| 2026-10-21 15:42 UTC | memcg: dma-buf cgroup accounting and charge transfer | 2 | aesteve@redhat.com | finished in 4h23m0s |
| 2026-10-21 09:35 UTC | cipso_v4: fail the walk on malformed options | 1 | omniameasunt@proton.me | finished in 3h48m0s |
| 2026-10-21 03:15 UTC | UUID and GUID user and group ids (*_r system calls) | 2 | jan.koester@tuxist.de |
finished
in 56m0s
[1 findings] |
| 2026-10-20 14:00 UTC | apparmor: check address length before reading AF_UNSPEC bind address | 1 | mike.michalo@gmail.com | finished in 4h25m0s |
| 2026-10-20 12:50 UTC | audit: don't use the caller's root when it has no fs | 2 | ngocthang2710.1999@gmail.com | finished in 4h11m0s |
| 2026-10-19 22:28 UTC | lsm: don't call d_path() when current->fs is NULL | 1 | drifabdelmalekmohamedsaid@gmail.com | finished in 3h54m0s |
| 2026-10-19 21:40 UTC | IPE: add a dedicated policy keyring | 1 | devnull@kernel.org | finished in 4h0m0s |
| 2026-10-19 14:56 UTC | KEYS: Return user session keyring on lookup | 2 | jarkko@kernel.org |
finished
in 4h16m0s
[1 findings] |
| 2026-10-18 17:31 UTC | cred: gather the "same uid" checks between tasks in one place | 1 | josef@toxicpanda.com | finished in 4h0m0s |
| 2026-10-17 15:21 UTC | keys: big_key: Remove the redundant quota reservation | 2 | 4ncienth@gmail.com | finished in 3h51m0s |
| 2026-10-16 14:37 UTC | selinux: don't label bridged packets in selinux_ip_forward() | 1 | joasantonio108@gmail.com | finished in 2h22m0s |
| 2026-10-16 04:00 UTC | keys: big_key: Reserve the final quota before destroying the payload | 1 | 4ncienth@gmail.com | finished in 4h11m0s |
| 2026-10-15 09:38 UTC | vfs: add inode iteration method super_iter_inodes | 1 | huangsj@hygon.cn | skipped |
| 2026-10-14 20:47 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 2 | josef@toxicpanda.com | finished in 4h0m0s |
| 2026-10-14 08:27 UTC | Landlock: Namespace and capability control | 6 | mic@digikod.net | finished in 3h50m0s |
| 2026-10-13 16:47 UTC | fs: unified VFS ancestor walk for Landlock and BPF | 1 | utilityemal77@gmail.com | finished in 3h53m0s |
| 2026-10-13 09:03 UTC | keys: Fix quota-owner reads and ownership accounting | 4 | nicoyip.dev@gmail.com | finished in 3h58m0s |
| 2026-10-12 21:57 UTC | apparmor: fix query_data() output overlapping the lookup key | 1 | cenzhang@linux.microsoft.com | finished in 4h37m0s |
| 2026-10-10 10:20 UTC | pidfd: add task path ioctls | 3 | devnull@kernel.org | finished in 3h56m0s |
| 2026-10-09 15:59 UTC | calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() | 2 | joasantonio108@gmail.com | finished in 4h41m0s |
| 2026-10-08 20:57 UTC | keys: Add well known IDs for fs-verity/dm-verity keys | 2 | andrew@amutable.com | finished in 4h1m0s |
| 2026-10-08 15:28 UTC | calipso: keep BIG TCP payload_len in calipso_skbuff_setattr() | 1 | joasantonio108@gmail.com | finished in 4h15m0s |
| 2026-10-08 15:28 UTC | calipso: update payload_len when removing the CALIPSO option | 2 | joasantonio108@gmail.com | finished in 4h12m0s |
| 2026-10-07 15:25 UTC | calipso: update payload_len when removing the CALIPSO option | 1 | joasantonio108@gmail.com | finished in 5h2m0s |
| 2026-10-07 15:25 UTC | calipso: hash the cache key, not the option start, in calipso_cache_add() | 1 | joasantonio108@gmail.com | finished in 5h1m0s |
| 2026-10-07 10:02 UTC | Landlock: Namespace and capability control | 5 | mic@digikod.net |
finished
in 1h31m0s
[1 findings] |
| 2026-10-06 15:44 UTC | capabilities: close the ways around the CAP_SETFCAP rule for uid 0 | 1 | josef@toxicpanda.com | finished in 4h1m0s |
| 2026-10-06 03:51 UTC | cipso: adjust cached option offsets when removing CIPSO | 2 | 4ncienth@gmail.com | finished in 4h12m0s |
| 2026-10-06 00:20 UTC | fs: unified VFS ancestor walk for Landlock and BPF | 1 | utilityemal77@gmail.com | finished in 3h48m0s |
| 2026-10-02 12:43 UTC | Landlock: Namespace and capability control | 4 | mic@digikod.net |
finished
in 58m0s
[1 findings] |
| 2026-09-30 14:04 UTC | cipso: adjust cached option offsets when removing CIPSO | 1 | 4ncienth@gmail.com | finished in 3h54m0s |
| 2026-09-29 13:01 UTC | security: Add PR_CAPBSET_DROP_MASK | 2 | ruanjinjie@huawei.com | finished in 4h31m0s |
| 2026-09-24 10:35 UTC | landlock: Add READ_METADATA and WRITE_METADATA access rights | 1 | caixinchen1@huawei.com | skipped |
| 2026-09-22 19:19 UTC | audit: log all six syscall arguments in the SYSCALL record | 3 | rrobaina@redhat.com | finished in 4h16m0s |
| 2026-09-21 09:20 UTC | sched: introduce for_each_process_rculock and for_each_thread_rculock | 4 | ye.liu@linux.dev | finished in 4h6m0s |
| 2026-09-20 23:52 UTC | certs: x509: duplicate cert->tbs when sig->algo_takes_data is set | 2 | benquike@gmail.com | finished in 4h16m0s |
| 2026-09-19 22:34 UTC | netlabel: calipso, x509: clean up ADDRSELECT on DOI removal and check AKID len | 1 | benquike@gmail.com | finished in 5h16m0s |
| 2026-09-19 21:52 UTC | netlabel: cipso_v4: reject empty MLS level/cat lists and zero tail in cipso_v4_delopt() | 1 | benquike@gmail.com | finished in 5h2m0s |
| 2026-09-19 21:06 UTC | ipv6: calipso: fix 8-bit hdrlen overflow and missing pskb_may_pull() in hop-by-hop options | 1 | benquike@gmail.com | finished in 5h17m0s |
| 2026-09-19 03:53 UTC | smack: reject relabel-self writes from io_uring workers | 1 | ngocthang2710.1999@gmail.com | finished in 2h40m0s |
| 2026-09-18 18:50 UTC | landlock: Fix tracepoint policy context | 1 | mic@digikod.net | finished in 3h51m0s |
| 2026-09-17 16:43 UTC | apparmor: Fix namespace reference leak in __aa_find_or_create_ns() | 1 | vulab@iscas.ac.cn | finished in 5h2m0s |
| 2026-09-17 16:41 UTC | apparmor: Fix label reference leak in aa_unix_file_perm() | 1 | vulab@iscas.ac.cn | finished in 4h44m0s |
| 2026-09-14 16:41 UTC | keys: Add well known IDs for fs-verity/dm-verity keys | 1 | andrew@amutable.com | finished in 4h4m0s |
| 2026-09-11 07:57 UTC | sched: introduce for_each_process_rculock and for_each_thread_rculock | 3 | ye.liu@linux.dev | finished in 4h10m0s |
| 2026-09-10 09:00 UTC | rust: add `Ownable` trait and `Owned` type | 21 | a.hindborg@kernel.org | finished in 3h57m0s |
| 2026-09-09 19:37 UTC | BPF interface for applying Landlock rulesets | 3 | utilityemal77@gmail.com | finished in 4h6m0s |
| 2026-09-09 15:34 UTC | KEYS: encrypted: fix integer overflow of datablob_len | 3 | cenzhang@linux.microsoft.com | finished in 3h54m0s |
| 2026-09-09 09:01 UTC | fs: preserve superblock inode walk positions across lock drops | 1 | sunjunchao@bytedance.com | finished in 4h49m0s |
| 2026-09-07 21:00 UTC | proc,security,selinux: let SELinux block FOLL_FORCE for /proc/self/mem | 3 | jannh@google.com | finished in 3h56m0s |
| 2026-09-07 08:13 UTC | sched: introduce for_each_process_rculock and for_each_thread_rculock | 2 | ye.liu@linux.dev | finished in 4h25m0s |
| 2026-09-04 14:48 UTC | lsm: expose mount idmaps to inode hooks | 3 | devnull@kernel.org | finished in 3h49m0s |
| 2026-09-02 22:01 UTC | Change skb secmarks to x-array indexes | 2 | casey@schaufler-ca.com | finished in 4h33m0s |
| 2026-09-02 14:43 UTC | audit: log all six syscall arguments in the SYSCALL record | 2 | rrobaina@redhat.com | finished in 4h47m0s |
| 2026-09-01 12:50 UTC | lsm: expose mount idmaps to inode hooks | 2 | devnull@kernel.org | finished in 4h24m0s |
| 2026-09-01 12:14 UTC | fs: port to const struct mnt_idmap | 1 | brauner@kernel.org | skipped |
| 2026-08-31 22:37 UTC | Change skb secmarks to x-array indexes | 1 | casey@schaufler-ca.com |
finished
in 1h50m0s
[1 findings] |
| 2026-08-31 14:58 UTC | BPF interface for applying Landlock rulesets | 2 | utilityemal77@gmail.com | finished in 3h42m0s |
| 2026-08-31 13:27 UTC | netlabel: fix IPv6 unlabeled address add error handling | 1 | sashal@kernel.org | skipped |
| 2026-08-31 11:09 UTC | Add new way to add BPF LSM hooks | 1 | a.s.protopopov@gmail.com | finished in 4h41m0s |
| 2026-08-31 02:59 UTC | pidfd: add task path ioctls | 2 | devnull@kernel.org | finished in 4h8m0s |
| 2026-08-29 21:32 UTC | selinux: fix nested backing-file mprotect checks | 3 | kmehltretter@gmail.com | finished in 2h6m0s |
| 2026-08-25 18:39 UTC | proc,security,selinux: let SELinux block FOLL_FORCE for /proc/self/mem | 2 | jannh@google.com | finished in 3h57m0s |
| 2026-08-24 13:28 UTC | lsm: expose mount idmaps to inode hooks | 1 | devnull@kernel.org | finished in 57m0s |
| 2026-08-24 11:17 UTC | rust: add `Ownable` trait and `Owned` type | 20 | a.hindborg@kernel.org | skipped |
| 2026-08-20 17:58 UTC | selinux: preserve user SID across nested backing files | 2 | kmehltretter@gmail.com | finished in 1h31m0s |
| 2026-08-20 06:13 UTC | selinux: preserve user SID across nested backing files | 1 | kmehltretter@gmail.com | finished in 1h28m0s |
| 2026-08-20 05:45 UTC | pidfd: add task path ioctls | 1 | devnull@kernel.org | finished in 4h9m0s |
| 2026-08-18 19:51 UTC | proc,security,selinux: let SELinux block FOLL_FORCE for /proc/self/mem | 1 | jannh@google.com | finished in 4h11m0s |
| 2026-08-18 18:28 UTC | audit: free proctitle in context so it can be re-set by fork on exec_binprm | 3 | rgb@redhat.com | finished in 4h11m0s |
| 2026-08-15 11:20 UTC | lsm: give BPF programs a way to query locked_down state | 1 | utilityemal77@gmail.com | finished in 1h40m0s |
| 2026-08-13 20:48 UTC | Change skb secmarks to x-array indexes | 1 | casey@schaufler-ca.com | finished in 5h7m0s |
| 2026-08-13 17:02 UTC | audit: log all six syscall arguments in the SYSCALL record | 1 | rrobaina@redhat.com | finished in 4h18m0s |
| 2026-08-13 00:26 UTC | bpf: Introduce LOADER_LOAD_FD | 1 | tweek@google.com | finished in 4h0m0s |
| 2026-08-11 17:52 UTC | CRASH_WIPE_SECRETS: Wipe secrets before kdump (was: CRASH_ZEROIZE) | 2 | linux@jaseg.de | finished in 4h1m0s |
| 2026-08-06 21:16 UTC | audit: free proctitle in context so it can be re-set by fork on exec_binprm | 2 | rgb@redhat.com | finished in 4h25m0s |
| 2026-08-04 03:42 UTC | fs: fix user path of nested backing files | 1 | libaokun@linux.alibaba.com | finished in 4h40m0s |