Linux removes __get_user and __put_user from x86 in a 48-commit kernel cleanup

Unchecked user-access helpers deleted from x86

Linus Torvalds has removed __get_user() and __put_user() — and their entire interface — from the x86 kernel. According to a dev.to write-up, the cleanup arrives as 48 commits touching 50 files and deletes 801 lines. It clears every use from the architecture-independent parts of the tree, including kernel/, drivers/ and net/, and then removes the x86 definitions themselves: the header macros plus the __get_user_nocheck_1/2/4/8 assembly routines and their counterparts in getuser.S and putuser.S.

The kernel has long had two pairs of helpers for moving small values between user memory and kernel memory. get_user() and put_user() verify that a pointer is a valid user-space address before touching it. The underscore variants skip that verification, which made them a standing footgun: a caller handing over a bad or malicious pointer could point the kernel at memory it should never read or write.

A speed hack that modern CPUs reversed

Skipping the check once bought real performance. When code reads many fields from one base pointer, validating the range once and then repeatedly using the unchecked helpers produced smaller, faster machine code. Torvalds wrote in the merge commit that this "used to" be true but has not been for years: on current hardware the dominant cost is not range checking but switching user access on and off.

On x86 that switching is done with the STAC and CLAC instructions, which open and close the window in which the kernel may touch user memory under the SMAP security feature. Opening the window once and performing many unchecked accesses inside it now beats paying the toggle cost on every __get_user() call. As Torvalds put it, as quoted by dev.to, misuse — which he framed as effectively all use — is slower than doing things correctly and unsafe because no address range is checked.

Four patterns that kept the helpers alive

Torvalds' commit message catalogues four reasons the unchecked pair survived, and the series answers each. The performance argument dissolved once STAC/CLAC costs took over. Uses that leaned on the helpers' exception handling to read unreliable kernel pointers — in fault handlers such as Alpha's dik_show_code() and OpenRISC's show_registers() — now use the dedicated get_kernel_nofault() helper. Code that avoided might_fault() warnings in atomic contexts, like the vdpa_sim driver fix, instead calls pagefault_disable() explicitly so the standard helpers can be used. The hardest category was code handling pointers that might be either user or kernel memory, exemplified by the x86 SEV #VC interrupt handler's MMIO emulation; that gained explicit vc_get_mem() and vc_put_mem() helpers in a 205-line change.

AI-assisted patching and a fast merge

The groundwork was Thomas Gleixner's scoped user access region helpers, merged in 2025, which automatically manage the access window through block constructs such as scoped_user_read_access(). Torvalds started with a single hand-written example converting the sigaction signal-handling path and let the series grow from there. He described using Claude as "a fancy coccinelle script" — applying structured transformations rather than generating novel code — which dev.to notes is another sign of his accelerating use of AI tooling in kernel work. Review moved quickly: x86 maintainer Ingo Molnar reported successful builds and boots on both 64-bit and 32-bit systems, and vhost maintainer Michael S. Tsirkin tested in a VM and supplied an Acked-by. Torvalds conceded the patches are not perfect but argued it is better to merge early and find problems than to leave known broken code in place. The series even cleared out an i915 comment referencing verify_area(VERIFY_WRITE), a leftover from 32-bit COW handling dating to the Linux 2.5.x era.

Other architectures left to their maintainers

x86 loses the interface entirely; elsewhere the picture varies. On arm64 the checked and unchecked versions already had identical implementations, so nothing urgent remains. Architectures using asm-generic/uaccess.h keep the names as internal helpers. The genuinely hard conversions — sparc32, m68k, LoongArch, PA-RISC and MIPS — were left to their maintainers, with Torvalds saying he looked at the sparc32 signal-handling case, judged it too ugly, and ran out of motivation. Even so, the diffstat rewrites signal and trap handling across Alpha, ARM, Hexagon, Nios II, OpenRISC, PowerPC and s390.

Why it matters

Deleting the interface rather than patching individual call sites means no future x86 code can quietly opt out of user-pointer validation — an entire class of missing-check bugs is now off the table there. It is also a reminder that performance folklore has a shelf life: an optimisation justified by one hardware generation's cost model became both slower and dangerous on the next. And the method — a maintainer-written example patch followed by LLM-driven bulk conversion of the mechanical cases, with human review on the mailing list — is emerging as a repeatable pattern for large cleanups in one of the world's most security-critical codebases.