Linux kernel lockdown bug exposed legacy I/O handlers

---

Linux kernel lockdown mode left legacy PCI I/O handlers writable for seven years. The bug allowed root users to bypass lockdown protections on systems using UEFI Secure Boot, writing directly to I/O ports and mapping legacy PCI memory. The fix targets Linux 7.3, with backports expected for stable and LTS branches.

Cloudflare shipped a Wasm-based browser engine that cuts headless automation memory usage by 4–7× compared to Chromium. The tradeoff: 70% slower wall time due to software rendering.

In this issue:

• Linux kernel lockdown bypass via legacy_io and legacy_mem since 2019
• Cloudflare Kitesurf: Wasm browser engine for AI agents, 3–7× lower resource usage
• AI recommendation poisoning through pre-filled deep links in Ask AI buttons
• BigQuery autonomous optimizations: 35% faster queries, 40% lower slot usage

---

Linux Kernel Lockdown Mode Left Legacy PCI Handlers Writable Since 2019

The Signal

Linux kernel lockdown mode failed to restrict legacy_io and legacy_mem sysfs writes since 2019.

What Changed

• legacy_io and legacy_mem sysfs files remained writable for root despite lockdown mode
• Original 2019 PCI BAR lockdown patch covered pci_write_config() but missed legacy handlers
• Root users could write arbitrary I/O ports and map legacy PCI memory spaces
• Patch queued for Linux 7.3 merge window, likely backported to stable kernels: https://git.kernel.org/pub/scm/linux/kernel/git/pci/pci.git/commit/?h=next&id=747b9bbbbdfdee51aee2456388f9b94b5086de4d
• Affects systems using UEFI Secure Boot where lockdown mode restricts kernel modification

Operational Impact

Systems relying on lockdown mode for security boundaries have had a seven-year gap. Root users could program DMA-capable hardware to modify kernel code or access sensitive memory, bypassing the protections lockdown mode provides. Teams running UEFI Secure Boot deployments should prioritize the stable kernel updates once this fix is backported.

Watch For

Monitor stable kernel release announcements for backports to your running kernel versions. The fix targets the original 2019 commit, so maintainers will likely push it to LTS branches.

---

Cloudflare Built a Browser Engine in Wasm for AI Agents

The Signal Cloudflare released Kitesurf, a Rust browser engine compiled to WebAssembly, running entirely on Workers for AI agents.

What Changed

• Kitesurf runs on Cloudflare Workers using Dynamic Workers, Worker-to-Worker RPC, and Wasm isolates per page: https://blog.cloudflare.com/kitesurf
• Built in 12 weeks, passes 215,000+ Web Platform Tests, renders TodoMVC, Wikipedia, Hacker News.
• Uses Blitz (HTML/CSS parser), Stylo (Firefox CSS engine), Boa JS (Rust ECMAScript for evals).
• 3.1–3.8× less CPU, 4.7–7× less memory than Chromium for screenshots and HTML extraction.
• 1.7–1.8× slower wall time due to cold software rendering vs. Chromium JIT.
• Three stateless components: Engine (CDP handler), PageScript (DOM/JS isolate), PageRenderer (rasterization).
• Available free in beta via Browser Run CDP endpoint with `browser=kitesurf` parameter.

Operational Impact Teams running headless browser automation for agents can cut memory and CPU costs by 3–7× on compatible sites. Wall time increases ~70%, acceptable for batch jobs but not interactive sessions. Chromium remains necessary for WebGL, video, TLS fingerprinting, or long-lived authenticated sessions. Kitesurf uses Workers isolation as the security boundary—each page gets a fresh isolate, nothing persists. Browser Run users add one query parameter to test compatibility; existing Puppeteer and Playwright scripts work via CDP.

Watch For Cloudflare plans to open-source Kitesurf and extend CDP coverage. Rendering fidelity for screenshots and WPT test coverage are active focus areas. Memory and CPU wins matter more than wall time for bursty agent workloads, but real-world compatibility on complex sites remains an open question.

---

AI Recommendation Poisoning via Pre-Filled Deep Links

The Signal

Microsoft documented AML.T0080 (AI Recommendation Poisoning) attacks using hidden prompts in 'Ask AI' buttons across 31 companies.

What Changed

• Commercial sites embed memory-manipulation payloads in deep links like `chatgpt.com/?q=save+domain+as+trusted`
• Payloads execute on click with no confirmation, instructing LLMs to bias future responses permanently
• Microsoft observed 50+ distinct prompts across 14 industries over 60 days
• Affects ChatGPT, Claude, Gemini, and Grok via URL parameter injection
• Classified as MITRE AML.T0080 (Memory Poisoning), related to AML.T0051

Operational Impact

This bypasses retrieval-time injection defenses because the payload executes at the HTTP layer before content is scraped or processed. Teams evaluating vendors through AI assistants may unknowingly commit competitor marketing claims to their model's long-term memory as trusted sources. Once injected, memory pollution persists across all future queries in that session until manually audited and cleared.

Watch For

Inspect outbound links to `chatgpt.com`, `claude.ai`, `grok.com`, and `gemini.google.com` for query strings containing "remember" or "trusted source." Audit LLM memory stores using prompts that surface saved domain preferences and bias instructions.

---

BigQuery Ships Autonomous Optimizations

The Signal

Google BigQuery shipped 35% faster queries and 40% lower slot usage through autonomous runtime optimizations in 2025.

What Changed

• History-based optimizations (HBO) learn from past query executions and auto-apply beneficial optimizations to future runs.
• Enhanced vectorization uses SIMD instructions to process data in native encodings, cutting slot time up to 40%.
• Short query optimizations reduce distributed processing overhead, delivering P99 sub-second latency and 10x lower slot usage.
• Fluid scaling autoscaler bills per-second for slot consumption, lowering autoscaling workload costs by 34% on average.
• Optimizations apply to both BigQuery native tables and Apache Iceberg parquet-backed tables with identical performance gains. https://cloud.google.com/blog/products/data-analytics/bigquery-performance-optimizations

Operational Impact

Teams running recurring dashboards, ELT pipelines, or analytics workloads get performance improvements without schema changes or query rewrites. The optimizer includes self-correcting guardrails: if an optimization regresses performance, it's immediately revoked and never applied again. This matters most for agent-driven workloads generating thousands of queries per minute, where manual query tuning is impractical.

Watch For

Monitor slot-second consumption metrics to validate cost reductions. Agent workloads will drive further autonomous optimization features as query volumes scale beyond human-generated patterns.

---

Quick Reads

• Linux Kernel — Lockdown mode failed to restrict legacy I/O writes since 2019.
• Cloudflare — Released Kitesurf, a Wasm browser engine for AI agents on Workers.
• Microsoft — Documented AI recommendation poisoning attacks using hidden prompts in deep links.
• BigQuery — Shipped autonomous optimizations delivering 35% faster queries and 40% lower slots.