Greg Kroah-Hartman has released stable kernel updates across eight major version branches, headlined by a critical network stack fix that prevents kernel panics when IP fragments enter tun/tap devices with Generic Segmentation Offload state. The upstream patch was authored by Anthropic researcher Xinyang Ge and can be triggered by unprivileged users or exploited across KVM virtualization boundaries, making it an immediate priority for multi-tenant cloud environments. The cycle also lands a separate TAP driver null pointer dereference fix tracking CVE-2026-74684 alongside additional networking vulnerabilities, while highlighting a growing trend of AI companies treating kernel reliability as essential infrastructure hygiene. Keep in mind that Linux 5.10 and 5.15 are approaching end-of-life in December 2026, so administrators running those branches should migrate to 6.1 or 6.6 LTS as soon as your maintenance window opens.

Greg Kroah-Hartman Ships Eight Stable Kernels With Critical TAP/GSO Panic Fix

Anthropic researcher Xinyang Ge authored the upstream patch. Cloud operators should apply the update as soon as your maintenance window opens.

Greg Kroah-Hartman released stable kernel updates across eight major version branches simultaneously today. The headline fix is a network stack security patch that prevents a kernel panic when IP fragments enter a tun/tap device with Generic Segmentation Offload state attached. If you run virtualized workloads, this one matters.

The patch, committed upstream on August 27, traces back to a tun driver change from over a decade ago. Nothing stops userspace from tagging an IP fragment with a virtio_net_hdr, and when the kernel reassembles those fragments, leftover GSO metadata survives into the reassembled socket buffer. The next segmentation call trips over an unmet assumption and hits a BUG_ON(). The same Anthropic researcher has quietly built out a portfolio of kernel security contributions, including BPF and IOMMU fixes earlier this year.

The Technical Details

An unprivileged user writing just two packets to a tun/tap device inside their own user namespace triggers the crash. The kernel dumps a KASAN stack trace pointing straight at skb_segment. The scope extends beyond local containers. A KVM guest whose VMM forwards virtio_net_hdrs to a tap device can potentially push the panic across the virtualization boundary. That crosses the VM-to-host line, which immediately escalates the risk for multi-tenant cloud environments.

The fix is surgical. It strips the gso_size, gso_type, and gso_segs fields inside inet_frag_queue_insert(). IPv4, IPv6, nf_conntrack_reasm, and 6lowpan all route through that function, so a single guard clears the state across the stack. The head of the reassembled skb can keep CHECKSUM_PARTIAL, and the receive path already handles that gracefully.

Other CVEs in This Cycle

The TAP driver also picks up a separate security patch tracking CVE-2026-74684, which scores 7.1 on CVSS v3.1. A malformed virtio-net TX descriptor with a zero ethertype trips a NULL pointer dereference in tap_get_user_xdp(). The patch simply reorders the skb->dev assignment before the header parsing call, matching existing safe patterns in the driver.

Network subsystem maintainers also landed fixes for a slab-out-of-bounds read in vcc_setsockopt() and a TOCTOU race in the SMC listener path. Both rate 7.1 and 7.5 on the CVSS scale. Keep in mind that these land alongside the GSO fix across all eight stable branches, so you only need one update cycle to cover the immediate surface.

Anthropic's contributions to the kernel have been steadily climbing. Jose Fernandez from the same lab patched a BPF TCP use-after-free in July, an ARM ftrace bug in June, and an AMD IOMMU bounds check in April. The pattern is clear. Companies building foundational AI models are now treating kernel reliability as infrastructure hygiene. They're also quietly funding the review process, with researchers citing internal tools like "Sashiko" for pre-submission code auditing.

The volume of AI-generated patches flooding the networking subsystem has been one of the most visible stress points in kernel development this year. Jakub Kicinski let maintainers spend hours triaging net-next during Q2, and we walked away impressed by the throughput. But in August, the sheer volume of LLM-driven cleanups had forced the team to lean heavily on frontier models for automated triage. Red Hat engineers have described the flood as a denial of service attack on maintainer triage pipelines. Linus Torvalds himself acknowledged using AI to debug an Intel Xe graphics regression in late August, calling the tooling enormously helpful for the grunt work. The kernel development process is adapting, even if the mailing list archives occasionally read like a stress test.

Keep in mind that Linux 5.10 and 5.15 are heading toward end-of-life in December 2026. The 5.15.219 release contains just the single GSO patch plus a release commit, which strongly suggests we're looking at a terminal stable drop for that branch. If your infrastructure still rides 5.10 or 5.15, the clock is ticking. Migration targets should be 6.1 or 6.6 LTS, both of which are actively maintained through 2027 and beyond.

Cloud operators should treat this as a priority update. Actually, it's a requirement. The tun/tap vector requires almost no privileges to trigger, and the attack crosses virtualization boundaries. If you're running macvtap devices with virtio-net passthrough, apply the 6.6.155, 6.12.107, or later stable releases as soon as your update window opens.

Linux kernel 5.10.268 released

Linux kernel version 5.10.268 is now available:

Full source: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.10.268.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v5.x/patch-5.10.268.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.10.268.tar.sign

You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v5.10.268/v5.10.267

Linux kernel 5.15.219 released

Linux kernel version 5.15.219 is now available:

Full source: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.219.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v5.x/patch-5.15.219.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.219.tar.sign

You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v5.15.219/v5.15.218

Linux kernel 6.1.186 released

Linux kernel version 6.1.186 is now available:

Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.1.186.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.1.186.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.1.186.tar.sign

You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.1.186/v6.1.185

Linux kernel 6.6.155 released

Linux kernel version 6.6.155 is now available:

Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.155.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.6.155.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.155.tar.sign

You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.6.155/v6.6.154

Linux kernel 6.12.107 released

Linux kernel version 6.12.107 is now available:

Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.12.107.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.12.107.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.12.107.tar.sign

You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.12.107/v6.12.106

Linux kernel 6.18.48 released

Linux kernel version 6.18.48 is now available:

Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.48.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.18.48.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.48.tar.sign

You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.18.48/v6.18.47

Linux kernel 7.1.12 released

Linux kernel version 7.1.12 is now available:

Full source: https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.12.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v7.x/patch-7.1.12.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.12.tar.sign

You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v7.1.12/v7.1.11

Linux kernel 7.2.2 released

Linux kernel version 7.2.2 is now available:

Full source: https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.2.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v7.x/patch-7.2.2.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.2.tar.sign

You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v7.2.2/v7.2.1