Columbia Researchers Win Best Paper at SOSP 2026 for Work on Linux Memory Management

The way an operating system manages memory affects how quickly software runs and how much memory it needs. This matters for everything from mobile apps to databases, AI tools, and large cloud services. A team of Columbia researchers and collaborators has developed a new Linux interface that lets applications customize part of that process while reducing the overhead associated with existing approaches.

The team, led by Tal Zussman, a PhD student in computer science at Columbia Engineering, and Columbia Engineering Associate Professor Asaf Cidon, developed bpf_fault, which allows applications to safely customize the handling of memory management within the operating system. The research shows how memory page fault customization can speed up mission critical tasks, like quickly loading a browser on a mobile device, more efficiently running agentic sandboxes, and migrating cloud virtual machines. Their paper, “It’s the Kernel’s Fault! Custom Page Fault Handling With bpf_fault,” received both a Best Paper Award and a Distinguished Artifact Award at the 32nd ACM Symposium on Operating Systems Principles (SOSP 2026), which is the top conference in computer systems. It was one of two papers recognized in each category.

“Memory management happens behind the scenes, but it shapes the performance of applications we rely on every day,” said Cidon, who has joint appointments in the Departments of Electrical Engineering and Computer Science. 

“These two awards recognize our team’s work on rethinking traditional kernel interfaces to become customizable to accommodate the wide variety of use cases of modern applications. We hope this can be the first step in upstreaming these ideas to Linux, which runs on billions of devices all over the world.” 

Understanding how software accesses memory

Programs depend on memory to store and retrieve the information they need. The operating system determines how much memory is available to each application. When a program tries to access a piece of memory that is not immediately available, it triggers what is called a page fault. Despite the name, this is often a normal part of running software. The operating system steps in to make the memory accessible so the program can continue.

Some applications need more control over how page faults are handled. Take a virtual machine running in the cloud. The software running it, called a hypervisor, can save a copy of the machine state, known as a snapshot, without stopping it. To do this, the hypervisor temporarily blocks access to some pieces of the memory while it saves them. If the virtual machine tries to access one of those pieces, it triggers a page fault, and the hypervisor has to make it available to the virtual machine as quickly as possible. 

Existing interfaces allow developers to customize this process, but they move the custom handling into user space, outside the kernel, the operating system’s core. Passing work between the kernel and userspace adds significant overhead, particularly when these events happen frequently, said Cidon.

Bringing custom page fault handling into the kernel

The team developed bpf_fault to reduce those handoffs while preserving the ability to tailor memory management to an application’s needs. The interface uses eBPF, a Linux technology that allows custom code to be verified before it runs inside the kernel. With bpf_fault, developers can use that capability to specify how certain page faults should be handled without exiting the kernel.

“Using eBPF, we can safely run verified custom code directly in the operating system kernel, resulting in reduced overhead compared to existing approaches, which offload this work to userspace,” Zussman explained.

Putting the interface to work

The researchers tested bpf_fault in four settings: taking virtual machine snapshots, accelerating startup of large applications, reclaiming unused memory in Java programs, and debugging memory errors. 

For virtual machine snapshots, custom page fault handling helps keep the saved copy consistent even as the machine continues to update its memory; bpf_fault makes it possible to perform that handling within the kernel. 

The team also integrated bpf_fault with dynamic linking, the process of loading shared code that large applications like Google Chrome and Clang commonly run. In that setting, the interface helped reduce startup time and memory use. The other integrations looked at Java garbage collection, which frees up memory a program no longer needs, and memory debuggers, which help developers find errors in how software uses memory. 

Across the workloads they studied, the research significantly improves performance and lowers CPU utilization compared with Linux’s existing mechanisms, said Cidon.

The immediate users would primarily be developers of low-level software, particularly software running on data center servers. More efficient memory handling could help those systems do more with available computing resources. Over time, such improvements could also contribute to lower operating costs and energy use.

Toward broader use in Linux

The team’s next goal is to bring bpf_fault to a wider community of developers. Zussman said upstream Linux developers expressed interest after he presented the work at Linux Plumbers Conference 2026, which is the primary conference where Linux maintainers develop their roadmap. Incorporating the interface into Linux would make it more readily available for developers seeking to customize memory handling in their own applications.

“The next step is getting bpf_fault into Linux so developers can put it to work,” Zussman said. “The interest we’ve seen from the Linux community is encouraging, and we’re excited to see where this can go.”