Linux 7.3.4 and 6.18.63 land on the same day, security-first
Two kernel branches, one release date, and more bounds-check fixes than you probably wanted to count.
Greg Kroah-Hartman queued two kernel releases on Tuesday, and both arrive with a heavy security bent. Linux 7.3.4 rides the new stable branch while 6.18.63 keeps the 2025 LTS kernel alive. They landed on the same day, 10 November 2026, and they're independent tracks, which is exactly why they can ship together.
Keep in mind this paired-release pattern is just how the kernel works. Plenty of days see only a single stable update. But two on one calendar day is a clean way to watch both halves of the kernel world at once: the fast new-feature branch and the battle-tested workhorse, both getting hit with the same wrench of fixes.
Linux 7.3.4: Xen, Zen 5, and AppArmor
The 7.3.4 changelog reads like a vulnerability checklist. Two of the fixes fold in Xen Security Advisories, both hitting the xen-netback virtual networking code.
XSA-532 zeroes out ring pointers on unmap. A failed frontend ring mapping could trigger a cleanup path that unmaps the same pointers twice, so authors Tu Dinh of Vates fixed it by nulling the pointers after the first unmap. XSA-531 is the sibling patch: it makes sure the queue count is unpublished before synchronize_net, so readers never poke at queues that are already gone.
Then there's the AMD angle. Zen 5 carries a CPU vulnerability called Targeted Serial Attack, including a third variant dubbed TSA_FILL. The kernel now detects and mitigates it. Notably, you don't need a microcode-revision table here because the right microcode just sets the VERW_CLEAR CPUID bit, which simplifies detection. That work is credited to Borislav Petkov of AMD.
AppArmor rounds out the security triad with a cluster of fixes. One stops profile files from being removed before their parent, which can otherwise leave a leaked dentry that blocks future policy loads. Another kills a refcount leak in aa_get_newest_profile() where the labels_profile() macro evaluates its argument twice.
Not every fix here is a vulnerability, and the ocfs2 work is the best example. It handles stale xattr entry pointers and empty-header reads, five defects where setxattr could overwrite a neighbor's value or read past the end of an array. That one is by Joseph Qi of Alibaba. There's also a splice fix that prevents a stale file position from letting readdir trust a bad offset, plus overlayfs and FUSE work that enforces append-only and immutable backing inodes. Because right now a server could overwrite a file marked immutable. Not great.
For context, 7.3 itself shipped on 18 October, just a month ago, and the source tree is now nearly 41 million lines. That's more than the whole kernel was a few years ago. It also means any single patch lands in a codebase most engineers couldn't fully map in a career, which is a little wild when you sit with it. 7.3 itself brought improved VRAM management for low-end GPUs, completed sched_ext, a failfs sandbox plus fchroot(2), and SMB Time Machine support.
Linux kernel 7.3.4 released
Linux kernel version 7.3.4 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.3.4.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v7.x/patch-7.3.4.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.3.4.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v7.3.4/v7.3.3
Linux 6.18.63: the LTS keeps punching
If 7.3.4 felt like a security update, 6.18.63 feels like the maintenance team clearing out an entire backlog at once. The changelog is massive, and that makes sense. This is the 2025 LTS kernel, running a large chunk of the world's servers and distro stable images.
The security fixes alone run long. The Ceph distributed filesystem client gets a cluster of network-client hardening: out-of-bounds reads in the inline-op path and readdir reply-count checks, integer overflows in a snap-trace bounds check, validation of encoded xattr name lengths, and a rejection of mdsmaps that claim more than CEPH_MAX_MDS ranks. It reads like a checklist of ways a malformed network response could tear things up.
BPF gets a queue/stack map u32 index overflow fix, the classic bounds bug. The networking stack gets fragment memory-accounting checks to prevent premature socket free, plus a reordering-overflow fix in MTU probing reachable through TCP_ZEROCOPY_RECEIVE.
The non-security list is even longer, and I'm only going to scratch the surface here. There's ext4 ABBA deadlocks, f2fs truncate races, dm-snapshot crashes, amdgpu VRAM accounting fixes, a division-by-zero guard in an audio driver, and Bluetooth L2CAP validation. On arm64, transparent contpte mappings get restricted to valid PTEs.
This is exactly what an LTS is for. You don't move to 6.18.63 to gain features. You move because leaving a known out-of-bounds read in the Ceph client unpatched is a bad night's sleep, and vendors like Red Hat, Debian, and SUSE still ship it in their stable images.
Linux kernel 6.18.63 released
Linux kernel version 6.18.63 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.63.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.18.63.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.63.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.18.63/v6.18.62
Where things stand
While 7.3.4 sits in pure maintenance mode, mainline has already moved on. 7.4-rc2 was tagged on 9 November, and linux-next sits at next-20261110. The 6.18 LTS keeps its long support tail, as do older branches like 6.12, 6.6, 6.1, 5.15, and 5.10.
One thing worth flagging is that both updates reflect a maintenance model increasingly shaped by automated bug-finding. The Linux 7.3's churn is partly driven by AI and LLM coding agents surfacing bugs and drafting patches. You can see the fingerprint here in the sheer volume of bounds and refcount fixes, many of which read like they were found by a machine that reads kernel code for a living.
