News › linux
By The Linux Camp News, October 22, 2026
Merged October 21 for the reported Linux 7.4 cycle, the cleanup replaces unchecked access patterns with checked helpers and scoped regions. Architecture maintainers still have migration work and testing limits to consider.
Linus Torvalds merged the __get_user()/__put_user() removal branch into mainline Linux on October 21, 2026, as commit 22a78a25438d. The series removes their calls from generic kernel code and completes removal of the interface on x86. Phoronix places the work in the Linux 7.4 cycle. The sources retrieved October 22 establish a mainline merge, not availability in a final release or distribution package. 2 1 5
These helpers transfer individual values between user space and the kernel. The legacy double-underscore variants omit the user-address-range check, leaving validation to surrounding code. Torvalds describes misuse as insecure because that check is absent. This is a kernel-maintainer assessment of an unsafe interface, rather than evidence here of a particular exploited vulnerability. 1 2 4
The old sigaction conversion shows why this is more than adding checks. Previously, one range check preceded several field accesses, but each helper separately enabled and disabled user access. Scoped access regions instead group those operations: one range check and, on x86, one STAC/CLAC instruction pair around the transfers. The inner unsafe_get_user()/unsafe_put_user() helpers remain, but inside that checked region. The benefit described by the patch is fewer access-state transitions; it supplies no measured workload speedup. 4
Architecture choice changes what removal means. Arm64 already makes the double-underscore names equivalent to the checked helpers, so Torvalds says it did not have the legacy danger described here. Architectures using asm-generic/uaccess.h retain those names as underlying helpers, and other architecture-specific conversions remain unfinished. Consequently, finding the name in a source tree is not, by itself, evidence of an unchecked access or an incomplete x86 conversion. 2
For custom-kernel maintainers, migration requires classifying accesses rather than mechanically renaming helpers. Some old callers used __get_user() to read unreliable kernel pointers with exception handling; Torvalds identifies get_kernel_nofault() as the replacement. Architecture maintainers should also check their no-fault implementation: Ingo Molnar warns that removing __get_user() requires defining arch_get_kernel_nofault(), otherwise generic no-fault implementations introduce references to the removed helpers again. 2 3
Operators testing kernels containing the series should distinguish successful boot testing from coverage of failure handling. Molnar reported that quick builds and boots worked on both 32-bit and 64-bit x86, while explicitly warning that ordinary testing did not fully exercise the changed exception paths. The practical inference is to include those paths in validation rather than treating a clean boot as sufficient evidence; the supplied review does not establish comprehensive regression coverage. 3