DEV Community

Cover image for Linux 7.4 adds TAINT_FORCED_BIND for forced driver binds
techaiwire
techaiwire

Posted on Originally published at techaiwire.com

Linux 7.4 adds TAINT_FORCED_BIND for forced driver binds

#opensource #security #linux

Linux 7.4 will flag any kernel where someone has attached a driver to a device by hand. Greg Kroah-Hartman's new TAINT_FORCED_BIND flag, shown as the letter Y, marks crash reports from systems that used the sysfs bind and unbind files. Fuzzing tools had been using those files to force drivers onto unsuitable hardware. The result was a flood of bug reports that matter to no real user.

Phoronix reported on October 19, 2026 that the change is in the driver core pull request for Linux 7.4. That pull request went out before the 7.4 merge window opened. Linux 7.3 shipped on October 18, and the 7.4 merge window, when new features land, opened the next day.

What TAINT_FORCED_BIND does

A taint is a marker the kernel sets on itself when something unusual has happened. It is printed in crash reports. A developer reading one then knows the system was not in a normal state.

sysfs is a virtual file system, mounted at /sys, that shows kernel objects as files. Each driver has a "bind" and an "unbind" file. Writing a device's bus ID into them attaches or detaches that driver by hand, Phoronix explains.

Kroah-Hartman's patch sets the new flag "if the bind/unbind sysfs files are ever written to," his cover letter says. "The flag is 'Y' which was unused." The flag is set before the driver's own bind or unbind code runs. Crashes often happen inside that code, so the resulting oops report shows what was attempted. An oops is the kernel's error report for a serious fault.

Detail TAINT_FORCED_BIND
Taint letter Y
Set when A driver's bind or unbind sysfs file is written
Timing Before the bind or unbind callback runs
Ships in The Linux 7.4 driver core pull request
Patch history First posted August 26, v2 on August 31, v3 on September 4, 2026
Files touched 8, including drivers/base/bus.c and kernel/panic.c

Why syzbot forced the change

Fuzzing means feeding a program random or unexpected input to find crashes. syzbot is an automated fuzzer that runs against the kernel. According to Kroah-Hartman, the bind interface "has been abused and recently come under a major fuzzing 'attack' through tools like syzbot."

syzbot began attaching drivers to devices they were never written for. Kroah-Hartman wrote that this caused "loads of unneeded errors and pointless kernel patches" from new developers. The interface was meant to help kernel developers work faster on drivers. It was also "a debugging way for users to attempt to add a new device to a driver without having to rebuild their kernel."

Nothing is blocked. Setups that depend on bind and unbind "will still work properly, but now the kernel will be flagged," the v3 cover letter says. Real use-after-free bugs found this way "should still be worked on." A use-after-free bug is code that touches memory after releasing it, a classic source of security holes.

Kroah-Hartman also told fuzzer operators what to do. Tools without hand-written rules should "be run with panic_on_taint enabled so that they fall over and don't continue on." The panic_on_taint setting halts the kernel as soon as it becomes tainted.

Floods of low-value reports are a wider problem this year. Google paused its open-source bug bounty on October 1 after a surge of AI-generated submissions.

Pushback from VFIO and USB users

Not every reviewer liked the trade-off. A review bot, sashiko-bot, rated it a "High" concern that legitimate setups would now be marked as tainted. It named VFIO, which hands a device to a virtual machine, plus DPDK networking and USB over IP. Phoronix lists hardware resets and passing devices to a virtual machine among the legitimate uses.

Replying to the bot, Kroah-Hartman called such use "not a 'standard' setup" and "an abuse of the api." Armin Wolf noted that vfio-pci with driver_override still needs bind and unbind. He suggested tainting on driver_override instead. Kroah-Hartman answered that this would miss forced removals. "It's a taint flag being set, not a panic," he wrote.

Johan Hovold called the taint "a good compromise" next to adding complexity or hiding the files. He gave the patch Reviewed-by and Tested-by tags. Aaron Tomlin and Bradley Morgan also reviewed it.

What this means for developers

  • Check your taint output after moving to Linux 7.4. If you rebind devices through sysfs for VFIO passthrough, DPDK or USB over IP, expect the Y flag. It will appear in /proc/sys/kernel/tainted and in crash reports.
  • Explain the Y in bug reports. Maintainers may read a Y-tainted report as a forced-bind problem and set it aside. If your bug is real, say how you bind the device and whether it happens without a manual bind.
  • Fuzzer operators: turn on panic_on_taint. That is Kroah-Hartman's direct request for tools that write to bind and unbind without exclusion rules. The run stops at the forced bind instead of producing a report nobody will act on.
  • Driver authors: crashes still count. Kroah-Hartman says real use-after-free bugs reached through bind and unbind still need fixing. Phoronix notes the same 7.4 driver core pull also brings new Rust additions for kernel drivers.
  • Watch the final 7.4 release. Wolf asked whether the taint could apply only to buses that do not support hot-plugging. Any such change would narrow who sees the Y flag.

This article was first published on Tech AI Wire.

Also available in

Deutsch · 日本語 · Français · Español · Português

Related on Tech AI Wire

Sources

Top comments (0)