# page cache Published articles for page cache. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Linux'x New Core MM Tree Ready With Numerous Fixes For "Nasty Long-Standing Bugs" DevFeed: [Linux'x New Core MM Tree Ready With Numerous Fixes For "Nasty Long-Standing Bugs"]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-11-05T11:05:02Z Content type: news Language: en Sources: [Phoronix]() Topics: [Linux Kernel](), [Linux](), [bugfixes](), [Memory Safety]() Tags: [anthropic](), [bugs](), [corruption](), [data-loss](), [deadlocks](), [desktop-linux](), [kernel](), [leaks](), [linux](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-kernel-mailing-list](), [linux-performance](), [linux-server-benchmarks](), [loops](), [memory](), [memory-management](), [open-source-graphics](), [page-cache](), [phoronix](), [phoronix-test-suite](), [tlb](), [uaf](), [ubuntu-benchmarks](), [ubuntu-hardware]() ### AI overview Linux 7.4-rc2's new Core MM tree sent a set of stable-worthy memory-management fixes to the kernel mailing list, addressing long-standing bugs across THP, GUP, KSM, userfaultfd, shared memory, hugetlb, page cache and memory reclaim. The excerpt says fixes target information leaks and out-of-bounds writes, data loss, mapping corruption and reference-counting errors, incorrect TLB flushing and unmapping, use-after-free bugs, deadlocks and unkillable loops, especially in shmem swap handling. It also notes fixes to memfd execution-seal enforcement, accounting, quota and userfaultfd registration handling. The pull request was pending; the quoted maintainer says urgent fixes will be prioritized closer to release while avoiding too many late changes. ### Source excerpt New to the Linux 7.4 kernel cycle is the Core MM tree as the route for herding some of the core memory management Linux kernel patches to the mainline kernel rather than it all going through Andrew Morton's "MM" tree. As the second pull request from this new kernel tree, a number of fixes were sent out today to address "nasty long-standing bugs" within the kernel... ## Ceph In Linux 7.4 Adds Global Mount Option For Lazy I/O DevFeed: [Ceph In Linux 7.4 Adds Global Mount Option For Lazy I/O]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-10-31T10:30:00Z Content type: news Language: en Sources: [Phoronix]() Topics: [ceph](), [Linux](), [Linux Kernel](), [mount]() Tags: [2014](), [bug-fixes](), [cache](), [ceph](), [deprecated](), [desktop-linux](), [experimental](), [hpc](), [i-o](), [lazy](), [linux](), [linux-7-4](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-performance](), [linux-server-benchmarks](), [mount](), [open-source-graphics](), [page-cache](), [phoronix](), [phoronix-test-suite](), [rados](), [ubuntu-benchmarks](), [ubuntu-hardware]() ### AI overview Linux 7.4 adds Ceph's `lazyio` mount option to enable lazy I/O globally for regular files at open time; previously, Ceph offered an ioctl to enable it per file. Lazy I/O permits page-cache buffered I/O even when multiple clients have a file open for writing, for workloads such as HPC that can tolerate relaxed cache coherency. Linux 7.4 also makes the deprecated Ceph inline-data feature opt-in through `CEPH_FS_INLINE_DATA`, which defaults off. Users relying on inline data must set `CEPH_FS_INLINE_DATA=Y`; the excerpt says removal of the deprecated code is planned for a future release. The pull request also includes bug fixes and cleanup. ### Source excerpt The Ceph kernel client changes have been submitted for Linux 7.4 ahead of its merge window expected to wrap up on Sunday... ## ZDI-CAN-33367: Patched kernels available in testing DevFeed: [ZDI-CAN-33367: Patched kernels available in testing]() Original publisher: [Read original article]() Author: Andrew Lukoshko AlmaLinux Lead Architect Published: 2026-10-23T00:00:00Z Content type: news Language: en Sources: [AlmaLinux]() Topics: [Linux](), [staging](), [releases]() Tags: [2026](), [almalinux](), [cache](), [contents](), [cvss](), [cvss-score](), [files](), [kernel](), [kernel-security](), [kernel-vulnerability](), [kernels](), [linux](), [linux-kernel](), [linux-kernel-vulnerability](), [local](), [local-privilege-escalation](), [memory](), [page-cache](), [patched](), [testing]() ### AI overview ZDI-CAN-33367 lets an unprivileged local user alter cached contents of readable, unwritable files on AlmaLinux 8, 9, and 10. The flaw is in skb_zerocopy(): it drops the shared-fragment marker from file-backed packet pages, allowing IPsec ESP to decrypt over them in place. The change affects memory until pages are evicted or the system reboots; disk contents remain unchanged. Patched kernels are available in almalinux-testing: 4.18.0-553.177.2.el8_10, 5.14.0-687.59.2.el9_8, and 6.12.0-211.68.2.el10_2. Install the appropriate version or later and reboot; AlmaLinux Kitten 10 will receive the fix in its next regular kernel update. As a temporary mitigation, block and unload esp4 and esp6, but this breaks IPsec workloads and systems where either module cannot be unloaded remain exposed. Dropping the page cache may evict tampered pages, though mapped pages can persist; rebooting into the patched kernel is the most reliable way to clear tampering. No CVE had been assigned at publication. ### Source excerpt A new Linux kernel vulnerability, tracked by Trend Micro's Zero Day Initiative (ZDI) as ZDI-CAN-33367, was reported to the kernel security team and public kernel mailing lists on 2026-10-21. It lets an unprivileged local user change the contents of files they can read but not write, such as files owned by root, by corrupting the kernel's in-memory copy of those files (the page cache). ZDI classifies it as a local privilege escalation with a CVSS score of 7.8 (High). AlmaLinux 8, 9, and 10 are affected. Patched kernels are available in the testing repository today, and we would like your help verifying them before we release them to production. ## Linus Torvalds' AI Code Improved: Huge Performance Wins With Reworked Code DevFeed: [Linus Torvalds' AI Code Improved: Huge Performance Wins With Reworked Code]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-10-19T16:32:00Z Content type: news Language: en Sources: [Phoronix]() Topics: [Linux Kernel](), [XFS]() Tags: [amd](), [amd-ryzen](), [desktop-linux](), [ext4](), [linux](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-kernel](), [linux-performance](), [linux-server-benchmarks](), [memory-management](), [open-source-graphics](), [page-cache](), [performance](), [phoronix](), [phoronix-test-suite](), [threadripper](), [ubuntu-benchmarks](), [ubuntu-hardware](), [xfs]() ### AI overview Kiryl Shutsemau reworked code based on Linus Torvalds' Linux kernel memory-management changes for reading from the page cache without folio references. Tests across EXT4, TMPFS, XFS, and a raw block device showed promising performance results; the patches remain under review with open design questions. ### Source excerpt Last week I wrote about Linus Torvalds leveraging AI to come up with a hefty Linux kernel improvement using Claude Code. The code is for reading from the page cache without folio references to help workloads of small reads from a single file across many CPU threads. Meta engineer Kiryl Shutsemau has taken that code and reworked it and showing extremely promising performance results... ## How Linux Large Folios Can Amplify Disk Writes in PXC/Galera Workloads DevFeed: [How Linux Large Folios Can Amplify Disk Writes in PXC/Galera Workloads]() Original publisher: [Read original article]() Author: Przemysław Malkowski Published: 2026-10-16T12:58:08Z Content type: article Language: en Sources: [Percona]() Topics: [XtraDB Cluster (PXC)](), [Linux Kernel](), [XFS]() Tags: [galera](), [hardware-and-storage](), [insight-for-dbas](), [large-folios](), [mariadb](), [mmap](), [mysql](), [page-cache](), [uncategorized](), [xtradb-cluster-pxc]() ### AI overview An investigation into periodic disk-write bursts in a PXC/Galera cluster links the behavior to Linux large folios after an operating system upgrade. Galera's memory-mapped cache can trigger writeback of entire folios for small updates, amplifying disk writes. The article explains why InnoDB writes behaved differently and discusses diagnostic signals and possible workarounds. ### Source excerpt We've recently been dealing with an interesting customer case where a PXC version upgrade from 5.7 to 8.0 seemed to trigger a completely unexpected problem. Even though the workload and MySQL settings did not change, all PXC members began exhibiting sparse but regular bursts of massive disk writes. Yet the MySQL side workload statistics that ... Continued The post When a Small Change Writes Too Much - How A Linux Kernel Improvement Can Strike You in PXC/Galera Workloads appeared first on Percona. ## The skb that wasn't freed - the Fragnesia primitive via Open vSwitch DevFeed: [The skb that wasn't freed - the Fragnesia primitive via Open vSwitch]() Original publisher: [Read original article]() Published: 2026-09-16T22:00:00Z Content type: article Language: en Sources: [Doyensec]() Topics: [rhel](), [Cryptography](), [Virtual Private Network](), [payload](), [least privilege]() Tags: [2026](), [amazon](), [auditing](), [automation](), [cache](), [copy-fail](), [cve](), [cve-2026-43284](), [cve-2026-43500](), [debian](), [decrypt](), [dirty-frag](), [doyensec](), [doyensecurity](), [esp](), [exploit](), [fedora](), [hacking](), [infosec](), [linux](), [linux-kernel](), [local](), [local-privilege-escalation](), [offensive](), [page-cache](), [pentest](), [pentester](), [privilege-escalation](), [reverse-engineering](), [rhel](), [security](), [vulnerability]() ### AI overview The article describes a deterministic local privilege escalation caused by Open vSwitch clearing `SKBFL_SHARED_FRAG` on a packet it continues forwarding after a userspace upcall fails. The marker loss lets ESP decrypt in place over a foreign page-cache fragment; with a chosen key and IV, an attacker can write selected bytes into a root-owned file's cached page and replace a setuid binary long enough to obtain a root shell. The described attack requires unprivileged user namespaces, autoloadable Open vSwitch, a forwarding flow with a failing userspace upcall, and an ESP-in-UDP receiver. It is reported to affect default installs of Arch, Fedora, Debian, Amazon Linux, and RHEL under those conditions; Ubuntu's default AppArmor restriction is said to prevent the default-install attack. The write is transient and disappears when cached pages are evicted. Mitigations include blocking Open vSwitch autoload, blocking ESP where unused, or disabling unprivileged user namespaces, which the article says can disrupt sandboxed applications. The fix is described as in mainline and beginning to reach stable; distribution kernel availability varies. ### Source excerpt TLDR: Exploit. This is a deterministic local privilege escalation affecting the default install of the latest Arch, Fedora, Debian, Amazon Linux and RHEL distributions, having unprivileged user namespaces enabled, openvswitch auto-loading, and a stock kernel carrying the Fragnesia fix. The issue has been public since 08/13/2026 on netdev, and the fix landed in mainline and shipped in stable on 09/04/2026. Introduction Earlier this year a small family of Linux kernel bugs appeared, starting with Copy Fail. Unlike standard memory corruption, their defining feature was that an unprivileged user could overwrite read-only memory mappings simply through legitimate operations, without any race condition or strict timing. That made privilege escalation to root relatively trivial. Copy Fail was followed a week later by Dirty Frag (also called Copy Fail 2), and then by variants such as Fragnesia and DirtyDecrypt. Fragnesia showed that an unprivileged user could get the kernel to decrypt an ESP packet in place, on top of page-cache pages the user is only allowed to read. The result is a Dirty COW-class primitive, where attacker-chosen bytes end up in the page cache of a root-owned file. Fragnesia reached it through the TCP coalesce path, where skb_try_coalesce() drops the shared-frag marker. Dirty Frag had reached the page cache by two complementary routes. One was the ESP-in-UDP datagram splice path (CVE-2026-43284), the other rxkad_verify_packet_1() (CVE-2026-43500). DirtyDecrypt (also DirtyCBC) landed a structurally similar write in rxgk_decrypt_skb(), in the RxRPC subsystem. The skb-side bugs all share one weak point, an in-place decrypt running over frags the kernel does not privately own. The Dirty Frag fixes turned that into an explicit rule that ownership is carried by a single flag, SKBFL_SHARED_FRAG, and every in-place-decrypt consumer is expected to check it via skb_has_shared_frag() and take a private copy if needed before writing. Fragnesia is what happens when th ## Copy Fail and Its Descendants: A Real Human's Guide to Kernel Page-Cache LPEs DevFeed: [Copy Fail and Its Descendants: A Real Human's Guide to Kernel Page-Cache LPEs]() Original publisher: [Read original article]() Author: Landon Rice Published: 2026-06-11T00:00:00Z Content type: article Language: en Sources: [VulnCheck]() Topics: [Linux Kernel](), [Linux](), [Cache](), [Artificial Intelligence]() Tags: [agentic](), [ai](), [ai-assistance](), [ai-assisted](), [ai-models](), [ai-tools](), [algorithm](), [apparmor](), [arch-linux](), [backdoor](), [cache](), [copy-fail](), [dirty-frag](), [kernel](), [linux](), [linux-kernel](), [local-privilege-escalation](), [page-cache](), [privilege-escalation](), [vulnerabilities]() ### AI overview The five Linux local privilege escalation bugs described share a page-cache overwrite pattern: kernel I/O paths modify shared, clean file pages in place without marking them dirty, so the kernel can use altered cached data. Copy Fail uses a four-byte write in the `algif_aead` crypto path, with `splice()` redirecting it into a readable file's cached copy. Dirty Frag uses similar primitives in IPsec ESP and RxRPC networking paths; the RxRPC variant writes eight bytes and may require costly key brute-forcing. Fragnesia is described as a related networking bug. PinTheft instead exploits stale page ownership in RDS and is less widely exposed because that module ships by default on Arch Linux among common distributions. The article warns that overwriting a cached SUID binary is temporarily destructive and that many public PoCs are derivative or obfuscated, complicating defender assessment. It argues defenders should examine the underlying primitive and real-world exploitation evidence rather than headlines or CVE records alone. ### Source excerpt Recent disclosures around two recent Linux LPEs Copy Fail and Dirty Frag discovered with the assistance of AI have exposed a broader class of Linux kernel local privilege escalation vulnerabilities involving page-cache overwrite primitives. This analysis separates the technical reality from the noisy wave of AI-generated disclosures and recycled proofs of concept