Linux 7.3 released: failfs, fchroot(), programmable binfmt_misc and a record 18,765 commits

Linus Torvalds released Linux 7.3 on Sunday 18 October 2026, and by the numbers it is the biggest kernel cycle yet: 18,765 non-merge commits from 3,021 developers, 807 of them contributing to the kernel for the first time. The headline features are aimed at people who run containers, virtual machines, databases and build systems: a new sandboxing primitive built from a failfs pseudo-filesystem and an fchroot() system call, completed per-cgroup BPF schedulers, a programmable binfmt_misc, and a batch of filesystem speed-ups. The next merge window, for Linux 7.4, opens today.

Key points

• Linux 7.3 was released on Sunday 18 October 2026; Torvalds called it "a record-breaker on all fronts", with 18,765 non-merge commits from 3,021 developers (807 first-timers), according to LWN's account of his announcement.
• A new failfs pseudo-filesystem and fchroot() system call let a process drop its filesystem view completely, so every absolute path lookup fails with EOPNOTSUPP.
• The sched_ext subscheduler feature is complete: different cgroups can now each run their own BPF-based task scheduler.
• binfmt_misc handlers can now be written in BPF, which lets distributions such as NixOS pick an interpreter per exec instead of patching binaries.
• Kernel developers report large gains in Btrfs fsync-heavy workloads (up to 5x throughput) and a rise from 1.92 to 2.19 million IOPS for small direct I/O on ext4 in one sample workload.

What happened

Torvalds announced the release on Sunday afternoon, as LWN reported. He wrote that "nothing very special seems to have happened this last week", so the final 7.3 shipped on schedule rather than needing an extra release candidate. He also said that he would be on his annual family vacation when the merge window for 7.4 opens on Monday, and that his merging schedule "will be a bit unusual for a while".

The size of the release is what stands out. LWN quotes the figures from the announcement: 18,765 non-merge commits, 3,021 developers, and 807 first-time kernel developers. We could not compare these with earlier releases from the sources we opened, so we rely on Torvalds's own description that the release broke records on every measure.

Beyond the statistics, LWN lists the significant changes as binfmt_misc extensions, group-scheduling work for large systems, the new failfs filesystem, the fchroot() system call, global per-CPU data for BPF programs, the completed sched_ext subscheduler feature, working-set tracking for virtual machines, alternative data-stream support in the ntfs3 filesystem, and a long list of SMB server improvements. The KernelNewbies changelog fills in the details used below.

Background

Three of the 7.3 features continue long-running efforts.

sched_ext lets administrators write a CPU scheduler as a BPF program and load it without rebuilding the kernel. Until now one such scheduler governed the whole machine. KernelNewbies says 7.3 completes the cgroup sub-scheduler work, so processes in one cgroup can be managed by their own BPF scheduler while other cgroups use different ones and take different scheduling decisions.

nullfs is a permanently empty, immutable filesystem. KernelNewbies describes 7.3's changes around it: all kernel threads now start in a nullfs mount, and PID 1 (systemd on most distributions) gets its own separate fs_struct. Before, kernel threads and PID 1 shared filesystem state, which KernelNewbies calls "weird" because it allowed pivot_root() to rewrite the filesystem state of every kernel thread. The visible result is that /proc/2/root (a kernel thread) is a nullfs with an empty mountinfo, while /proc/1/root is the real root.

binfmt_misc is the mechanism that tells the kernel how to run foreign or unusual executables, for example ARM binaries through QEMU. Until now the interpreter was a fixed string recorded at registration time.

How it works

failfs and fchroot()

nullfs means "there is nothing here". The new failfs is its counterpart: "nothing is supported here". According to KernelNewbies, every operation that reaches the filesystem fails with EOPNOTSUPP. Nothing can be mounted on top of it, it cannot be mounted from userspace, it cannot be cloned, and it does not appear in statmount(), listmount(), /proc/<pid>/mountinfo or /proc/filesystems.

A process gets into failfs through the new fchroot(2) system call, which changes the root directory using a file descriptor rather than a path. Calling fchroot(FD_FAILFS_ROOT) moves the process's root into failfs; after that, every absolute path lookup and every absolute symlink fails. Combined with fchdir(FD_FAILFS_ROOT), the process is left with lookups anchored only at directory file descriptors it already holds. The process must have anchored every lookup at an explicit descriptor before the switch, or its lookups simply fail.

Using a descriptor instead of a path avoids re-resolving a path the caller already holds, so there is no gap between resolving the target and changing the root (a time-of-check/time-of-use race). It also works with O_PATH descriptors and with descriptors to detached mount trees created through open_tree(OPEN_TREE_CLONE). KernelNewbies adds that an unprivileged task can chroot() into failfs provided it has the no-new-privileges flag set. For sandbox authors, that is a cheap way to say "from here on, this process may only touch what I have already handed it".

Programmable binfmt_misc

In 7.3 the matching of a binary type and the choice of its interpreter can be delegated to a BPF program. KernelNewbies describes two further modes: transparent interpreters, which receive the binary through AT_EXECFD and leave the argument vector exactly as the caller built it, and PT_INTERP loader substitution, where the kernel runs the matched binary natively and swaps in the registered interpreter for its PT_INTERP. A BPF-backed entry can also be bound to an interpreter so that, for instance, ARM executables run under QEMU inside a chroot that does not contain QEMU. The stated motivation is that Nix and similar systems can make relocatable binaries without patchelf tricks or wrapper scripts, because the dynamic loader can be found relative to the binary.

Scheduling

For ordinary cgroup scheduling, KernelNewbies reports a switch to a single runqueue and new weight-distribution modes selectable through cgroup_mode: up, max, concur and tasks, with concur the default and, per the changelog, the most precise but most expensive. Tasks with shorter time slices should see better scheduling latency, and cluster scheduling on CPUs with asymmetric capacity was fixed.

Storage numbers

The changelog gives a few measured gains. We show the one with a before-and-after figure; the Btrfs numbers below it are stated as ratios.

Before1.92

Linux 7.32.19

ext4 small direct I/O in one sample workload (million IOPS)

	million IOPS
Before	1.92
Linux 7.3	2.19

Source: KernelNewbies, Linux 7.3 changelog (iomap simple dio path)

That is a rise of about 14 percent (2.19 / 1.92) for that workload; the changelog does not describe the hardware, so treat it as an illustration of the change, not a general benchmark. For Btrfs, KernelNewbies says direct I/O performance has recovered what it lost in earlier releases; on non-SSD disks, removing an unnecessary one-jiffy delay in logging workloads such as fsync cut latency and raised throughput five times; and fsync with the no-holes feature (the default since btrfs-progs 5.15) is also five times faster.

What it means

For container and sandbox builders: fchroot() plus failfs gives runtimes a way to strip a process's filesystem access after setup without a heavyweight mount namespace. It is a building block rather than a finished product, and runtimes will need to adopt it.

For virtualisation: the new UFFDIO_REGISTER_MODE_RWP flag in userfaultfd(2) tracks reads and writes to a memory range. KernelNewbies says it is similar to but faster than combining mprotect(PROT_NONE) with a signal handler, and is designed for VM memory managers that need to find cold guest pages to evict to tiered or remote storage.

For storage and databases: the RWF_DONTCACHE flag now works on block devices. A database that opens a raw block device can keep some data in the page cache and opt out per request for the rest, without full direct I/O. FUSE servers using io_uring can pass a buffer pool to the kernel and, with CAP_SYS_ADMIN, get zero-copy access to client pages.

For desktops and gamers: the dmem cgroup now lets the kernel evict unprotected buffers to make room for a protected one, which KernelNewbies says should help low-VRAM GPUs where two applications compete for video memory.

For file sharing: the in-kernel SMB server gains opt-in Apple Time Machine support, SMB3 request replay, per-share encryption and SMB Direct RDMA encryption, per KernelNewbies.

What we don't know yet

We have not compared 7.3's commit and contributor counts with earlier releases; the "record" claim is Torvalds's. The BPF binfmt_misc and sched_ext features are new interfaces, and distributions have not yet announced when or whether they will enable them. The ext4 and Btrfs figures come from kernel developers' own descriptions of their patches, not independent benchmarks. And we do not know which distribution kernels will pick up 7.3 first.

What to watch next

The 7.4 merge window opens on 19 October and normally lasts about two weeks, with Torvalds's own schedule irregular at the start, by his account. Watch for the first stable updates to 7.3, for container runtimes such as runc and crun adding fchroot() support, and for distribution announcements about the new BPF hooks. LWN's coming development statistics for 7.3 should show who contributed the record number of changes. For related coverage of kernel-level security this week, see our report on the PwnEscape KVM guest-escape bug.

Sources

• LWN.net: The 7.3 kernel has been released (primary: Torvalds's announcement and statistics)
• KernelNewbies: Linux 7.3 changelog