Linus Torvalds Removes Unsafe Linux Kernel Functions
The Linux kernel project has eliminated legacy functions that lacked essential pointer validation checks.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you trust AI-assisted coding to improve the security of critical software systems?
Linus Torvalds has officially removed the __get_user and __put_user functions from generic Linux kernel code. These functions were deemed insecure due to their lack of required user address range checks.
Why it matters
Removing these insecure legacy functions helps prevent vulnerabilities by ensuring that pointer validation checks are properly enforced during kernel operations. This change marks a significant step in modernizing the kernel interface to improve overall system security.
The changes were applied to version 7.4 of the Linux kernel to deprecate the __get_user and __put_user helpers. While x86 and x86_64 architectures have fully removed the interface, remnants still exist in other supported CPU ports.
The players
Linus Torvalds
He is the creator and principal developer of the Linux kernel.
Claude Code
It is an AI-powered coding tool used for software analysis and transformation.
The details
The removal was executed through a Git merge of a code branch, utilizing Claude Code for static analysis and automated source-to-source transformations. This effort builds upon previous work from 2025 where scoped user access region helpers were implemented.
Timeline
October 21, 2026: Linus Torvalds merged the removal of the functions.
2025: Thomas implemented scoped user access region helpers.
The Tech Race
This development follows an established pattern of hardening the Linux kernel against memory-based exploits. It represents a shift toward replacing legacy, permissive code structures with modern, validated interfaces to better compete in high-security environments.
Developers and system administrators should prepare for potential compatibility issues in environments running older, architecture-specific kernel ports. Moving to updated kernel versions ensures that software leverages the latest security-hardened memory access protocols.
The takeaway
Maintaining modern security standards often requires the systematic removal of long-standing but unsafe legacy code. Developers should audit their own projects for similar patterns that bypass modern safety validation checks.
Further reading
Stay updated on evolving threats and defensive measures by visiting our Cybersecurity section.
Source note: This article includes information reported by Phoronix.
Live Poll
Do you trust AI-assisted coding to improve the security of critical software systems?
