Linux 7.3 Merge Window

19 Aug 2026 tags: audit lsm selinux

Linux v7.2 was released on Sunday, August 16th, with the Linux v7.3 merge window opening immediately afterwards. Below are the highlights of the LSM, SELinux, and audit pull requests which have been merged into Linus’ tree.

LSM

• Removed the task_euid() function and its Rust counterpart. The function returned the objective effective UID of a task, which is an odd thing to need, and with the only user in the kernel now gone, it made little sense to keep the API.

• Fixed a memory leak in the LSM syscall selftests.

• Corrected the kdoc documentation for the security_task_prctl() LSM hook.

• Clarified the comments in the Rust task UID accessor code.

SELinux

• In order to be a good neighbor in the kernel, and promote more efficient use of memory, we converted some old code that used the __get_free_page() function to use kmalloc() instead.

• With the recent removal of DCCP support in the kernel there are some userspace tools which still try to configure and query the kernel about DCCP support. Unfortunately, these tools can generate a number of SELinux “unrecognized netlink message” errors as SELinux’s DCCP support has been removed. Starting with Linux v7.3 we will now only print a single error message on the first occurrence, and the error message will indicate that the message is unrecognized due to the removal of DCCP from the Linux kernel.

• In order to support the effort to remove strlcat() from the kernel, we converted the strlcat() calls in the SELinux IMA measurement code to use the sequential buffer, e.g. seq_buf_printf(), APIs.

• Improved the SELinux IMA measurement code by only calculating the size of the measurement string once at boot. Previously the string length was recalculated on every measurement.

• Added additional SELinux policy load time verifications to help ensure that only properly formed policies are loaded.

• A number of minor code cleanups and improvements.

Audit

• Fixed a reference counting problem involving audit file watches that could result in unintentionally dropping the last reference while the watch was still active.

• Added a number of missing syscalls to the kernel’s audit permissions table which is used when filtering file operations based on permissions.

• Removed two BUG_ON() assertions in the audit code in favor of less catastrophic runtime validations.