Linux Plumbers Conference 2026

Session

Toolchains Track

5 Oct 2026, 10:00

348. Security Features status update

Justin Stitt (Google), Kees Cook (Google)

05/10/2026, 10:00

Another year of work is behind us, with lots of progress across GCC, Clang, and Rust to provide the Linux kernel with a variety of security features. Let's review and discuss where we are with parity between toolchains, approaches to solving open problems, and exploring new features.

Parity reached since last year:
- Various little behavioral corner-case bug fixes

In progress:
-...

113. Compiler-Based Context Analysis for Compile-Time Lock Safety

Marco Elver (Google)

05/10/2026, 10:30

Compiler-Based Context Analysis is a language extension which enables statically checking that required contexts are active (or inactive) by acquiring and releasing user-definable “context locks”. An obvious application of this feature is lock-safety checking for the kernel's various synchronization primitives, verifying at compile time that locking rules are not violated. This session will...

331. BPF support in the GNU Toolchain

Cupertino Miranda, David Faust, Jose E. Marchesi (GNU Project, Oracle Inc.), Vineet Gupta

05/10/2026, 11:00

In this activity we will first provide a very brief update on the status of the port of GNU binutils and GCC to the BPF target, with emphasis on the level of support for extant BPF programs and the kernel BPF selftests. Then we will address a set of particular issues for which we need feedback and/or consensus from the BPF kernel and clang/LLVM hackers.

401. Are your types the same as mine?

Kris Van Hees (Oracle USA)

05/10/2026, 12:00

This session is aimed at discussing the benefits (and requirements) of having a unified type representation that can be used in tracing tools to facilitate type management, type compatibility checks, etc. With type info from the kernel, type info from userspace, and types that may be defined in tracing scripts, the hoops that one may need to jump through to make it all work as a single...

357. Towards real-time ABI compatibility assurance with libctf

Nick Alcock

05/10/2026, 12:30

The CTFv4 extension of the CTF file format into a superset of BTF is nearly complete. Once it's working, what can we do with systemwide type information for all C programs?

One possibility we explore in this talk is to use some simple linker extensions to provide real-time, linear-time ABI checking in ld.so to determine for every running program whether any of the C libraries it uses has...

396. Adding C library wrappers for all Linux syscalls - The Return

Mr Carlos O'Donell (Red Hat)

05/10/2026, 13:00

At Linux Plumbers Conference 2025 in Tokyo I gave part 1 of this talk, this year I want to revisit progress made against the use cases presented last year including progress made on raw futex.

In review we'll look at systemd and if we were able to solve their most thorny calls to syscall with actual libc wrappers.

I'll include a more formal review of what is currently missing in glibc,...

390. Kernel module support for PGO AutoFDO and Propeller

Rong Xu (Google)

05/10/2026, 15:00

Recent support for profile-based optimizations—specifically PGO, AutoFDO, and Propeller—has delivered double-digit performance gains to the core kernel. However, kernel modules do not automatically inherit these benefits. Since a significant portion of execution time can be spent inside these modules depending on configuration, their lack of optimization remains a drawback compared to builtin...

301. Upgrading Runtime Leaks to Compile-Time Errors: Adopting Clang’s require_explicit_initialization

Ian Rogers (Google)

05/10/2026, 15:30

The Linux kernel makes heavy use of aggregate struct initializers to configure subsystem interfaces, driver registries, and object lifecycles (such as struct kobj_type and struct device_type). However, omitting mandatory struct members—such as a kobject's release callback—may result in silent memory leaks or deferred runtime panics.

Clang offers a static alternative attribute...

399. Kage: device driver isolation in the Linux kernel with LFI

Zachary Yedidia (Stanford University and Google)

05/10/2026, 16:00

Drivers in Linux run with full kernel privileges and account for a significant share of exploitable vulnerabilities. Kage is an experimental kernel subsystem that runs kernel modules inside of in-kernel sandboxes using LLVM's Lightweight Fault Isolation (LFI) feature. Kaged drivers still run in the same hardware privilege level and address space as the rest of the kernel, but are compiled such...

416. Crossing borders between user space and kernel space: GDB/Valgrind/drgn close cooperation

Alexandra Petlanova Hajkova

05/10/2026, 17:00

While is GDB is primarily a user space tool, drgn is a kernel space one. Using them together may improve user experience as drgn can help GDB to get access to various kernel structures. Right now, GDB can show what a thread is doing in user space, drgn can show what it is doing in the kernel — but the two tools do not talk to each other. I would like to discuss what it would mean to cross...

384. GCC Rust support for Linux

David Edelsohn (NVIDIA)

05/10/2026, 17:30

A conversation about the Linux kernel requirements from GCC Rust and how to promote GCC Rust as another compiler for the Rust components of the Linux kernel. The technical and community issue.

74. Beyond Coverage: Per-Task Function Boundary Extraction for Kernel Contract Verification

Mr Yunseong Kim (Ericsson Software Technology)

05/10/2026, 17:45

KCOV's trace-pc provides edge coverage feedback for kernel fuzzers, but captures no data-flow context. Two syscalls hitting identical basic blocks with different argument values (e.g., vfs_open with O_RDONLY vs O_WRONLY|O_TRUNC) are indistinguishable to the fuzzer. This "semantic gap" causes coverage saturation on value-dependent state transitions in complex subsystems (binder, io_uring,...