Linux 7.2.7 Stable Kernel Lands With 737 Commits and a Networking-Focused Security Sweep
The latest point release closes remotely exploitable SMB and IPv6 bugs while quietly documenting how much the kernel now runs on AI-assisted development.
Linux Kernel 7.2.7 is out. It landed today and bring roughly 737 bug-fix commits backported into the 7.2 stable series, several of them patching holes you would much rather not leave open.
Greg Kroah-Hartman assembled the release, keeping the weekly stable cadence the Linux Foundation coordinates. The bleeding-edge mainline has already rolled on to 7.3-rc4, released the day before, so this one lives squarely in maintenance territory. That's the whole point of the stable tree. And for anyone running the 7.2 line, this is the recommended update, not the optional one.
The fixes span nearly the entire kernel. Networking dominates, pulling in about 242 commits, or roughly a third of the total. Core net: work, Multipath TCP hardening, scheduling fixes, and a wave of driver corrections across Broadcom, Marvell, Intel, and Mellanox adapters lead the charge. The rest break down as you'd expect: roughly 171 for the core kernel and scheduling, BPF and tracing, and even Rust; about 105 for miscellaneous drivers; 86 for filesystems; and smaller slices for architecture code, storage, and graphics.
The security fixes that matter
The newsworthy part of 7.2.7 is the sheer volume of security-relevant commits. Dozens of them touch use-after-free, out-of-bounds writes, heap corruption, and kernel panics. A handful are worth knowing by name.
The biggest one is a heap overflow in the SMB client. When CIFS rewrites an existing access-control list, the output buffer used to be sized for the original ACL. Longer replacement entries could overflow it. The result, confirmed with KASAN, is a kernel heap write triggered simply by connecting to a remote SMB share, which makes it remotely exploitable.
There's also an out-of-bounds read in the legacy SMB1 read path. A malicious server used to be able to push the copy source past the response buffer and leak adjacent heap memory or crash the host. Now it's guarded with overflow-safe bounds checks. Keep in mind that SMB1 requires explicit vers=1.0 mounting, so this mostly bites legacy setups that shouldn't be running it in the first place.
Two more use-after-free bugs round out the serious list. One is an IPv6 fib walker exposed through /proc/net/ipv6_route that could be freed mid-operation; researchers at Nebusec reported it. The other is an x86 page-attribute path that could race with a collapse operation and dereference a freed page-table entry. That one is fixed by taking the init_mm read/write lock across the operation, with careful lock-dropping around allocations so you don't deadlock yourself. A netfilter module-unload bug and a pile of fixes in the Marvell qla2xxx Fibre Channel driver close out the batch.
It's a solid haul. Not cheap in terms of attention required to apply it, though. But for anyone on the 7.2 stable series, the math is simple. Update.
The real story hiding in the metadata
Here's the detail most tech watchers actually care about. 7.2.7 makes its AI dependence explicit in the commit metadata, and it's more than you'd think.
Roughly 149 commits, about one in five, carry an Assisted-by: line acknowledging AI help. The tools cited span just about everything on the market: generic "LLM" helpers, Anthropic's Claude variants, OpenAI's Codex and GPT-5, DeepSeek, Google Gemini, GitHub Copilot, and a handful of specialized code-review assistants.
Another 33 commits are formally tagged Reported-by: Sashiko, Google's AI code-review tool, with roughly 64 more referencing it in some form.
That puts 7.2.7 at a specific moment in the open-source timeline. In late 2026, AI tools are no longer experimental helpers quietly doing something at the margins. They're routine participants in the bug-finding pipeline, credited in commit history right alongside human authors. It's arguably the single most interesting thing about this release, even if it's buried in the fine print.
The whole thing only ships because a community of 12 stable testers vetted it first. That roster spans LibreCast, Red Hat, Broadcom, Debian, Intel's CIP program, Google, UnionTech, and independent maintainers like Ron Economos. That "Tested-by" process is exactly what lets the stable tree deliver weekly fixes without the tree breaking under your feet.
Linux kernel 7.2.7 released
Linux kernel version 7.2.7 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.7.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v7.x/patch-7.2.7.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.7.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v7.2.7/v7.2.6
