Linux 7.3 hardens NTFS, KSMBD, and the BPF verifier ahead of its October release
The Linux 7.3 cycle — with rc2 out on September 6, 2026 and rc3 on September 13 — stands out for filesystem and BPF verifier hardening, plus a surge in sched_ext work. Teams that will maintain this kernel long-term should anticipate which security fixes to backport.
September 6, 2026. Linus Torvalds releases the rc2 of Linux 7.3. September 13, 2026. rc3 follows with security fixes for XFS and SMB. October 18, 2026. The stable release is expected, barring a catch-up rc8. Why it matters: this cycle stands out less for a headline feature than for deep hardening — filesystems, the BPF verifier — that enterprise kernel maintainers will need to track closely.
sched_ext: the tooling explodes
The cycle’s surprise lies in the distribution of code. Outside drivers, which dominate as always, developer tooling is the biggest contributor to rc2, at roughly 20% of the patch. The jump is largely driven by sched_ext, the extensible scheduling framework that lets policies written in BPF steer the kernel scheduler.
The sched_ext updates bring synchronized common and compatibility headers, cleaner documentation, and improved BPF scheduler callbacks. They also fix a spurious-abort bug during ownership-change races. Around the framework, a wave of kernel self-tests covers cgroups, BPF verification, and the LSMs (Linux Security Modules), locking in long-term stability. The trend is clear: the kernel is absorbing more programmable scheduling logic, and automated testing is following suit.
Filesystem hardening
The filesystem layer receives a hardening pass that anyone exposing file servers should read carefully. NTFS fixes directory-lookup failures by correctly returning DT_UNKNOWN on lookup error, bounds the $AttrDef table walk to prevent out-of-bounds reads, and rejects invalid boot-sector cluster configurations. A race between fallocate and mmap reads is also resolved.
On the SMB and KSMBD side — the in-kernel SMB server, a recurring target for security researchers — the fix is more sensitive. The cycle closes use-after-free bugs in tree connections and in oplock break notifications, validates normalized response name lengths, and implements safer session draining during logoffs to prevent corruption. Btrfs restores active device pointers after a failed sprout operation and fixes lost error values during send.
The BPF verifier closes ranks
The BPF verifier — the gatekeeper that guarantees a BPF program cannot compromise the kernel — receives a batch of hardening that shrinks the attack surface. It now correctly infers whether a register is NULL during conditional jumps, blocking unsafe memory operations. It rejects pseudo-function references to the main program, blocks dangerous direct tail call invocations from callback frames, and marks certain syscall helpers as sleepable. It also prevents out-of-bounds pointer leaks on speculative execution paths.
These fixes are not cosmetic. The verifier is the boundary between “a loaded BPF program” and “an execution primitive inside the kernel.” Every relaxation it closes is one fewer door for an attacker trying to turn eBPF access into privilege escalation.
The rest of the cycle: EDAC, DRM, and audio
rc2 also merges the EDAC (Error Detection and Correction) code “forgotten” during the rc1 merge window. The subsystem gains support for Intel Starfire SoCs, DIMM-width decoding decoupled from enum ordering, and the use of sysfs_emit_at() for location display. On the graphics side, the DRM layer receives fixes for AMD (queue reset, OLED backlight), Nouveau (HDMI infoframes on GB20x), and Virtio-GPU. Audio adds power-management guards on Audient, Scarlett, and RME interfaces, plus quirks for recent laptops.
In memory management, the kernel fixes flag usage in tmpfs, sleeping allocations in bulk page allocations, and locked-page accounting in secretmem. Discrete fixes, but together they stabilize a kernel ahead of release.
What it means for operators
For an operations team, the 7.3 cycle raises two concrete questions. First, backporting: the KSMBD and BPF fixes are exactly the kind of security patches LTS maintainers will want to carry onto stable branches, and that distributions will fold into their kernels. Watch your distribution’s announcements rather than compiling mainline. Second, timing: the stable release is expected around October 18, 2026, but an rc8 would push it to October 25 in the event of a late regression.
The underlying message remains one of caution: a release candidate kernel is not meant for production. Servers that must run without interruption stay on the latest stable branch — 7.2.5 as it stands — while the 7.3 cycle matures.
Verdict
Linux 7.3 introduces no spectacular feature, but it hardens the kernel where security matters: filesystems, the built-in SMB server, and the BPF verifier. If you expose KSMBD or maintain an SMB server, track the use-after-free fixes in this cycle and backport them as soon as they reach your stable branch. If you load eBPF programs, read the verifier changelog: a program that passed before may now be rejected. If you are planning a migration, wait for the October stable release and leave the release candidates to testers.