diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index b5a92b56..3b43a558 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -51,15 +51,21 @@ jobs:
         with:
           submodules: true
 
+      - if: ${{ matrix.toolchain == 'gcc' }}
+        id: toolchain-version
+        name: Get the toolchain version
+        run: |
+          python3 -c 'import scripts.build_utils.toolchain_builder as tb
+          print(f"key=gcc-{tb.GCC_VERSION}-binutils-{tb.BINUTILS_VERSION}")' \
+            >> "$GITHUB_OUTPUT"
+
       - if: ${{ matrix.toolchain == 'gcc' }}
         id: toolchain-cache
         name: Restore the toolchain cache
         uses: actions/cache/restore@v4.2.2
-        env:
-          gcc-version: 15.1.0
         with:
           path: "${{ github.workspace }}/toolchain/tools-${{ matrix.toolchain }}-${{ matrix.arch }}"
-          key: "${{ runner.os }}-${{ runner.arch }}-${{ matrix.arch }}-gcc-${{ env.gcc-version }}"
+          key: "${{ runner.os }}-${{ runner.arch }}-${{ matrix.arch }}-${{ steps.toolchain-version.outputs.key }}"
 
       - name: Build the platform toolchain
         run: "${{ github.workspace }}/build.py --arch ${{ matrix.arch }} --toolchain ${{ matrix.toolchain }} --no-tune-native --toolchain-only"
diff --git a/.gitignore b/.gitignore
index b45008ea..3fa34d93 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,4 +11,6 @@ kernel-source/
 bin/
 hyper-*
 toolchain/tools-*
+toolchain/*_sources
+toolchain/*.tar.gz*
 __pycache__
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 8ae68a1a..56d661e8 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,4 +1,4 @@
-cmake_minimum_required(VERSION 3.16)
+cmake_minimum_required(VERSION 3.18)
 
 set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
 
diff --git a/kernel/CMakeLists.txt b/kernel/CMakeLists.txt
index ed8cb85c..1ff2318a 100644
--- a/kernel/CMakeLists.txt
+++ b/kernel/CMakeLists.txt
@@ -4,6 +4,7 @@ include(build_stamp.cmake)
 include(target_helpers.cmake)
 include(module.cmake)
 include(ld_template.cmake)
+include(ubsan.cmake)
 
 # The base kernel executable that contains an empty stub symbol table
 set(
@@ -122,6 +123,11 @@ endif ()
 
 ultra_compile_options(-O${CONFIG_OPTIMIZATION_LEVEL})
 
+if (CONFIG_UBSAN)
+    setup_ubsan()
+    ultra_sources_no_ubsan(ubsan.c)
+endif ()
+
 ultra_link_options(
     -nostdlib
     -Wl,--no-pie
diff --git a/kernel/Kconfig b/kernel/Kconfig
index e6a6fa19..104f64f3 100644
--- a/kernel/Kconfig
+++ b/kernel/Kconfig
@@ -59,6 +59,38 @@ config VERBOSE_INIT_LEVELS
 config DEBUG_MM
     bool "Enable debug assertions for the memory management subsystem"
 
+menuconfig UBSAN
+    bool "Undefined behavior sanitizer"
+    depends on ARCH_HAS_UBSAN
+
+if UBSAN
+
+config UBSAN_BOUNDS
+    bool "Check array indices against their statically known bounds"
+    default y
+
+config UBSAN_SHIFT
+    bool "Check for shifts that are out of range"
+    default y
+
+config UBSAN_SIGNED_OVERFLOW
+    bool "Check for signed integer overflow"
+    default y
+
+config UBSAN_DIV_ZERO
+    bool "Check for integer division by zero"
+    depends on TOOLCHAIN_GCC
+
+config UBSAN_UNREACHABLE
+    bool "Check for control flow reaching __builtin_unreachable()"
+    default y
+
+config UBSAN_BOOL
+    bool "Check for loads of bool values that are neither 0 nor 1"
+    default y
+
+endif
+
 endmenu
 
 rsource "arch/Kconfig"
diff --git a/kernel/arch/Kconfig b/kernel/arch/Kconfig
index ab4613d0..870f819c 100644
--- a/kernel/arch/Kconfig
+++ b/kernel/arch/Kconfig
@@ -33,6 +33,9 @@ config ARCH_PHYS_ADDR_WIDTH
     default 8 if (ARCH_64BIT || ARCH_FORCE_64BIT_PHYS_ADDR_WIDTH)
     default 4 if ARCH_32BIT
 
+config ARCH_HAS_UBSAN
+    bool
+
 if ARCH_X86_64
 rsource "x86_64/Kconfig"
 endif
diff --git a/kernel/arch/x86_64/Kconfig b/kernel/arch/x86_64/Kconfig
index db6dc0b0..721018ea 100644
--- a/kernel/arch/x86_64/Kconfig
+++ b/kernel/arch/x86_64/Kconfig
@@ -14,6 +14,7 @@ config ARCH_X86_64_BASE
     bool
     select ARCH_LITTLE_ENDIAN
     select ARCH_64BIT
+    select ARCH_HAS_UBSAN
     select SMBIOS
     select ACPI
     select ACPI_PM
diff --git a/kernel/bug.c b/kernel/bug.c
index dd935937..4e100f90 100644
--- a/kernel/bug.c
+++ b/kernel/bug.c
@@ -17,7 +17,7 @@
 static bool s_panic_on_warn;
 parameter_with_flags(s_panic_on_warn, PARAM_RUNTIME_WRITABLE);
 
-static void finish_warn_report(struct registers *regs)
+void finish_warn_report(struct registers *regs)
 {
     if (s_panic_on_warn) {
         /*
diff --git a/kernel/console.c b/kernel/console.c
index a8d1306f..c207b4bf 100644
--- a/kernel/console.c
+++ b/kernel/console.c
@@ -23,7 +23,7 @@ error_t register_console(struct console *con)
     con->next = g_consoles;
     g_consoles = con;
 
-    log_flush_console(con);
+    log_flush_consoles();
     return EOK;
 }
 
diff --git a/kernel/include/common/bit.h b/kernel/include/common/bit.h
index 6fc19d5d..2eaa82f0 100644
--- a/kernel/include/common/bit.h
+++ b/kernel/include/common/bit.h
@@ -7,7 +7,7 @@
 #define BITS_PER_BYTE CHAR_BIT
 #define BITS_PER_TYPE(type) (sizeof(type) * BITS_PER_BYTE)
 
-#define BIT_OF_TYPE(type, x) (((type)1) << (x))
+#define BIT_OF_TYPE(type, x) ((type)(((type)1) << (x)))
 #define BIT_U8(x) BIT_OF_TYPE(u8, (x))
 #define BIT_U16(x) BIT_OF_TYPE(u16, (x))
 #define BIT_U32(x) BIT_OF_TYPE(u32, (x))
diff --git a/kernel/include/log.h b/kernel/include/log.h
index 012f3070..b3fe204f 100644
--- a/kernel/include/log.h
+++ b/kernel/include/log.h
@@ -65,11 +65,8 @@ enum log_level {
 
 void vprint(const char *msg, va_list vlist);
 
-// Defined in console.h
-struct console;
-
-// Writes every record the console has not seen yet to it
-void log_flush_console(struct console *con);
+// Writes out every record to every console that hasn't yet been output by it
+void log_flush_consoles(void);
 
 PRINTF_DECL(1, 2)
 void print(const char *msg, ...);
diff --git a/kernel/include/log_ring.h b/kernel/include/log_ring.h
index c94a560a..da74bed5 100644
--- a/kernel/include/log_ring.h
+++ b/kernel/include/log_ring.h
@@ -3,6 +3,7 @@
 
 #include <common/error.h>
 #include <common/attributes.h>
+#include <common/bit.h>
 #include <common/string_container.h>
 
 /*
@@ -137,6 +138,15 @@ BUILD_BUG_ON(
     offset_of_after(struct log_info_record, level)
 );
 
+enum log_ring_read_flags : u32 {
+    /*
+     * Skip a record that was reserved and never published, as long as
+     * newer records exist. Only for readers that know such a record will
+     * never be finished, e.g. during a panic.
+     */
+    LOG_RING_READ_SKIP_UNPUBLISHED = BIT_U32(0),
+};
+
 /*
  * Read a record from the log ring.
  *
@@ -148,11 +158,21 @@ BUILD_BUG_ON(
  * sequence number (if the requested record no longer exists
  * due to being overwritten by other log messages) is written to 'out_rec'.
  */
-error_t log_ring_read(
+error_t log_ring_read_with_flags(
     struct log_ring *ring, u64 seq_num, char *out_buf, size_t buf_size,
-    struct log_record *out_rec
+    enum log_ring_read_flags flags, struct log_record *out_rec
 );
 
+static inline error_t log_ring_read(
+    struct log_ring *ring, u64 seq_num, char *out_buf, size_t buf_size,
+    struct log_record *out_rec
+)
+{
+    return log_ring_read_with_flags(
+        ring, seq_num, out_buf, buf_size, 0, out_rec
+    );
+}
+
 /*
  * Check whether reading a record with 'seq_num' would succeed. Note that this
  * doesn't mean a record with this number actually exists, only that there is
diff --git a/kernel/include/panic.h b/kernel/include/panic.h
index 13ad67fe..0d867ddd 100644
--- a/kernel/include/panic.h
+++ b/kernel/include/panic.h
@@ -5,6 +5,8 @@
 #include <common/attributes.h>
 #include <common/helpers.h>
 
+bool panic_in_progress(void);
+
 NORETURN
 PRINTF_DECL(1, 2)
 void panic(const char *reason, ...);
diff --git a/kernel/include/private/bug.h b/kernel/include/private/bug.h
index 03b157c0..b06e6bcf 100644
--- a/kernel/include/private/bug.h
+++ b/kernel/include/private/bug.h
@@ -21,3 +21,7 @@
         ".short " TO_STR(trap_flags) "\n"                       \
         ".popsection\n"                                         \
     )
+
+struct registers;
+
+void finish_warn_report(struct registers *regs);
diff --git a/kernel/include/private/ubsan.h b/kernel/include/private/ubsan.h
new file mode 100644
index 00000000..32d59c83
--- /dev/null
+++ b/kernel/include/private/ubsan.h
@@ -0,0 +1,70 @@
+#pragma once
+
+#include <common/attributes.h>
+#include <common/bit.h>
+#include <common/types.h>
+
+#define UBSAN_TYPE_KIND_INT 0
+#define UBSAN_TYPE_INFO_SIGNED BIT_U16(0)
+#define UBSAN_TYPE_INFO_LOG2_WIDTH MAKE_BIT_MASK_U16(15, 1)
+
+struct ubsan_source_location {
+    const char *file;
+    u32 line;
+    u32 column;
+};
+
+struct ubsan_type {
+    u16 kind;
+    u16 info;
+    char name[];
+};
+
+struct ubsan_out_of_bounds_data {
+    struct ubsan_source_location loc;
+    const struct ubsan_type *array_type;
+    const struct ubsan_type *index_type;
+};
+
+struct ubsan_shift_data {
+    struct ubsan_source_location loc;
+    const struct ubsan_type *lhs_type;
+    const struct ubsan_type *rhs_type;
+};
+
+struct ubsan_value_data {
+    struct ubsan_source_location loc;
+    const struct ubsan_type *type;
+};
+
+struct ubsan_unreachable_data {
+    struct ubsan_source_location loc;
+};
+
+void __ubsan_handle_out_of_bounds(
+    struct ubsan_out_of_bounds_data *data, ptr_t index
+);
+void __ubsan_handle_shift_out_of_bounds(
+    struct ubsan_shift_data *data, ptr_t lhs, ptr_t rhs
+);
+void __ubsan_handle_add_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs
+);
+void __ubsan_handle_sub_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs
+);
+void __ubsan_handle_mul_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs
+);
+void __ubsan_handle_negate_overflow(
+    struct ubsan_value_data *data, ptr_t value
+);
+void __ubsan_handle_divrem_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs
+);
+void __ubsan_handle_load_invalid_value(
+    struct ubsan_value_data *data, ptr_t value
+);
+
+NORETURN
+void __ubsan_handle_builtin_unreachable(struct ubsan_unreachable_data *data);
diff --git a/kernel/log.c b/kernel/log.c
index d08fdfd4..84fdeaac 100644
--- a/kernel/log.c
+++ b/kernel/log.c
@@ -4,6 +4,8 @@
 #include <common/minmax.h>
 #include <common/string.h>
 #include <common/ctype.h>
+#include <common/atomic.h>
+#include <common/bit.h>
 
 #include <console.h>
 #include <log.h>
@@ -11,6 +13,7 @@
 #include <unwind.h>
 #include <log_ring.h>
 #include <param.h>
+#include <panic.h>
 
 #include <time/units.h>
 
@@ -200,7 +203,7 @@ static void format_record(
         out_buf_append(out, "\n", 1);
 }
 
-void log_flush_console(struct console *con)
+static void log_flush_console(struct console *con)
 {
     static char s_msg_buf[512], s_out_data[512 + 128];
 
@@ -210,10 +213,19 @@ void log_flush_console(struct console *con)
     u64 sec, usec;
     int stamp_len;
     char stamp[32];
+    enum log_ring_read_flags read_flags = 0;
+
+    /*
+     * A panic may have interrupted a writer between reserving and
+     * publishing its record, which would hide everything printed after it
+     */
+    if (panic_in_progress())
+        read_flags |= LOG_RING_READ_SKIP_UNPUBLISHED;
 
     for (;;) {
-        ret = log_ring_read(
-            &s_log_ring, con->log_seq_num, s_msg_buf, sizeof(s_msg_buf), &rec
+        ret = log_ring_read_with_flags(
+            &s_log_ring, con->log_seq_num, s_msg_buf, sizeof(s_msg_buf),
+            read_flags, &rec
         );
         if (ret != EOK)
             break;
@@ -242,12 +254,75 @@ void log_flush_console(struct console *con)
     }
 }
 
-static void print_flush(void)
+/*
+ * The whole flush state lives in one word, so every transition is a
+ * single compare-and-exchange. PENDING is only set when a writer context
+ * notices there's already an in-progress flush operation that is being
+ * performed by someone else (meaning it sees the OWNED bit was set). The
+ * context currently performing the flush operation then notices that later
+ * on and also flushes the new record left behind by the setter of PENDING.
+ *
+ * (There's one real downside with this scheme and it's that there's no flush
+ *  handover operation defined between writers, meaning the first writer to
+ *  acquire the OWNED bit, gets to flush every single newly inserted record by
+ *  other CPUs. This may lead to hard lockups if other CPUs do heavy-enough
+ *  logging. Fixing this is a TODO.)
+ */
+#define FLUSH_OWNED BIT_U32(0)
+#define FLUSH_PENDING BIT_U32(1)
+
+static u32 s_flush_state;
+
+static bool flush_try_acquire(void)
+{
+    u32 state, desired;
+
+    state = atomic_load_relaxed(&s_flush_state);
+
+    for (;;) {
+        desired = state ? state | FLUSH_PENDING : FLUSH_OWNED;
+
+        if (atomic_cmpxchg_acq_rel(&s_flush_state, &state, desired))
+            return state == 0;
+    }
+}
+
+static bool flush_release(void)
+{
+    u32 state = FLUSH_OWNED;
+
+    /*
+     * Fails when a record was left behind by another writer, which noticed
+     * there was already a flush in-progress that we owned.
+     */
+    if (atomic_cmpxchg_acq_rel(&s_flush_state, &state, 0))
+        return true;
+
+    /*
+     * Go back and take another pass so we flush the record(s) left behind by
+     * concurrent writers. Clear the pending bit so we notice if this happens
+     * again.
+     */
+    atomic_xchg(&s_flush_state, FLUSH_OWNED, MO_ACQ_REL);
+    return false;
+}
+
+void log_flush_consoles(void)
 {
     struct console *con;
 
-    for (con = g_consoles; con; con = con->next)
-        log_flush_console(con);
+    /*
+     * Always allow panic to take over flushing, we have no other way to make
+     * sure the interrupted context that was doing the flushing ever gets to
+     * run again.
+     */
+    if (!flush_try_acquire() && !panic_in_progress())
+        return;
+
+    do {
+        for (con = g_consoles; con; con = con->next)
+            log_flush_console(con);
+    } while (!flush_release());
 }
 
 static size_t extract_msg_level(const char *msg, enum log_level *out_level)
@@ -340,7 +415,7 @@ void vprint(const char *msg, va_list vlist)
     }
 
     log_ring_publish(&res);
-    print_flush();
+    log_flush_consoles();
 }
 
 void print(const char *msg, ...)
diff --git a/kernel/log_ring.c b/kernel/log_ring.c
index 37ae467c..07a5dbcb 100644
--- a/kernel/log_ring.c
+++ b/kernel/log_ring.c
@@ -339,7 +339,8 @@ static error_t log_descriptor_read(
 }
 
 static error_t do_log_ring_read(
-    struct log_ring *ring, u64 *in_out_seq, struct log_record *out_rec
+    struct log_ring *ring, u64 *in_out_seq, enum log_ring_read_flags flags,
+    struct log_record *out_rec
 )
 {
     u64 tail_seq, seq = *in_out_seq;
@@ -372,7 +373,15 @@ static error_t do_log_ring_read(
          * we're done.
          */
         WARN_ON(ret != EINVAL);
-        break;
+
+        if (!(flags & LOG_RING_READ_SKIP_UNPUBLISHED))
+            break;
+
+        // The newest record is never skipped, its writer may still finish it
+        if (seq + 1 >= log_ring_next_assigned_sequence_number(ring))
+            break;
+
+        seq++;
     }
 
     *in_out_seq = seq;
@@ -393,7 +402,7 @@ static void update_last_published_sequence_number(struct log_ring *ring)
         for (;;) {
             new_id++;
 
-            ret = do_log_ring_read(ring, &new_id, nullptr);
+            ret = do_log_ring_read(ring, &new_id, 0, nullptr);
             if (ret != EOK)
                 break;
             cur_id = new_id;
@@ -670,9 +679,9 @@ void log_ring_reservation_set_facility(
     atomic_store_release(&info->facility, facility);
 }
 
-error_t log_ring_read(
+error_t log_ring_read_with_flags(
     struct log_ring *ring, u64 seq_num, char *out_buf, size_t buf_size,
-    struct log_record *out_rec
+    enum log_ring_read_flags flags, struct log_record *out_rec
 )
 {
     error_t ret;
@@ -680,7 +689,7 @@ error_t log_ring_read(
     if (out_rec != nullptr)
         out_rec->data = MAKE_STR(out_buf, buf_size);
 
-    ret = do_log_ring_read(ring, &seq_num, out_rec);
+    ret = do_log_ring_read(ring, &seq_num, flags, out_rec);
     if (ret == EOK && out_rec != nullptr)
         out_rec->data.size = MIN(buf_size, out_rec->length);
 
@@ -689,7 +698,7 @@ error_t log_ring_read(
 
 error_t log_ring_readable(struct log_ring *ring, u64 seq_num)
 {
-    return do_log_ring_read(ring, &seq_num, nullptr);
+    return do_log_ring_read(ring, &seq_num, 0, nullptr);
 }
 
 u64 log_ring_first_readable_sequence_number(struct log_ring *ring)
diff --git a/kernel/panic.c b/kernel/panic.c
index 68863563..315f12cc 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -10,6 +10,11 @@
 
 static bool s_in_panic;
 
+bool panic_in_progress(void)
+{
+    return atomic_load_acquire(&s_in_panic);
+}
+
 #undef panic
 void panic(const char *fmt, ...)
 {
diff --git a/kernel/target_helpers.cmake b/kernel/target_helpers.cmake
index c74c03ab..419f30a4 100644
--- a/kernel/target_helpers.cmake
+++ b/kernel/target_helpers.cmake
@@ -71,3 +71,14 @@ function(ultra_include_directories)
         ${ARGN}
     )
 endfunction()
+
+function(ultra_sources_no_ubsan)
+    ultra_sources(${ARGN})
+    set_property(
+        SOURCE ${ARGN}
+        TARGET_DIRECTORY ${ULTRA_KERNEL_OBJECTS}
+        APPEND
+        PROPERTY COMPILE_OPTIONS
+        -fno-sanitize=undefined
+    )
+endfunction()
diff --git a/kernel/ubsan.c b/kernel/ubsan.c
new file mode 100644
index 00000000..43fa85bd
--- /dev/null
+++ b/kernel/ubsan.c
@@ -0,0 +1,284 @@
+#define MSG_FMT(msg) "ubsan: " msg
+
+#include <common/atomic.h>
+#include <common/bit.h>
+#include <common/format.h>
+#include <common/types.h>
+
+#include <log.h>
+#include <panic.h>
+
+#include <private/bug.h>
+#include <private/ubsan.h>
+
+#define UBSAN_MAX_INT_WIDTH BITS_PER_TYPE(u128)
+#define UBSAN_COLUMN_REPORTED UINT32_MAX
+#define UBSAN_VALUE_STR_SIZE 48
+
+// TODO: move this into struct task once we have it
+static bool s_in_report;
+
+static u32 type_bit_width(const struct ubsan_type *type)
+{
+    return BIT_U32(BIT_FIELD_READ(type->info, UBSAN_TYPE_INFO_LOG2_WIDTH));
+}
+
+static bool type_is_int(const struct ubsan_type *type)
+{
+    return type->kind == UBSAN_TYPE_KIND_INT &&
+           type_bit_width(type) <= UBSAN_MAX_INT_WIDTH;
+}
+
+static bool type_is_signed(const struct ubsan_type *type)
+{
+    return type_is_int(type) && (type->info & UBSAN_TYPE_INFO_SIGNED);
+}
+
+// Values wider than a pointer are passed by reference
+static bool value_is_inline(const struct ubsan_type *type)
+{
+    return type_bit_width(type) <= BITS_PER_TYPE(ptr_t);
+}
+
+static u128 value_unsigned(const struct ubsan_type *type, ptr_t value)
+{
+    u32 extra_bits;
+
+    if (!type_is_int(type))
+        return 0;
+    if (!value_is_inline(type))
+        return *(const u128*)value;
+
+    extra_bits = UBSAN_MAX_INT_WIDTH - type_bit_width(type);
+    return ((u128)value << extra_bits) >> extra_bits;
+}
+
+static i128 value_signed(const struct ubsan_type *type, ptr_t value)
+{
+    u32 extra_bits;
+
+    if (!type_is_int(type))
+        return 0;
+    if (!value_is_inline(type))
+        return *(const i128*)value;
+
+    extra_bits = UBSAN_MAX_INT_WIDTH - type_bit_width(type);
+    return (i128)((u128)value << extra_bits) >> extra_bits;
+}
+
+static void format_value(
+    char *buf, size_t size, const struct ubsan_type *type, ptr_t value
+)
+{
+    i128 sval;
+    u128 uval;
+
+    if (!type_is_int(type)) {
+        snprintf(buf, size, "<unknown>");
+        return;
+    }
+
+    if (type_is_signed(type)) {
+        sval = value_signed(type, value);
+
+        if (sval >= INT64_MIN && sval <= INT64_MAX) {
+            snprintf(buf, size, "%lld", (i64)sval);
+            return;
+        }
+    }
+
+    uval = value_unsigned(type, value);
+
+    if (uval <= UINT64_MAX) {
+        snprintf(buf, size, "%llu", (u64)uval);
+        return;
+    }
+
+    snprintf(
+        buf, size, "0x%016llX%016llX", (u64)(uval >> BITS_PER_TYPE(u64)),
+        (u64)uval
+    );
+}
+
+static bool report_begin(struct ubsan_source_location *loc, const char *check)
+{
+    u32 column;
+
+    if (atomic_xchg(&s_in_report, true, MO_ACQ_REL))
+        return false;
+
+    /*
+     * The compiler emits the location as writable data, reuse the column
+     * field as the per-site "reported" flag.
+     */
+    column = atomic_xchg(&loc->column, UBSAN_COLUMN_REPORTED, MO_RELAXED);
+    if (column == UBSAN_COLUMN_REPORTED) {
+        atomic_store_release(&s_in_report, false);
+        return false;
+    }
+
+    pr_warn("%s in %s:%u:%u\n", check, loc->file, loc->line, column);
+    return true;
+}
+
+static void report_end(void)
+{
+    finish_warn_report(nullptr);
+    atomic_store_release(&s_in_report, false);
+}
+
+void __ubsan_handle_out_of_bounds(
+    struct ubsan_out_of_bounds_data *data, ptr_t index
+)
+{
+    char index_str[UBSAN_VALUE_STR_SIZE];
+
+    if (!report_begin(&data->loc, "array-index-out-of-bounds"))
+        return;
+
+    format_value(index_str, sizeof(index_str), data->index_type, index);
+    pr_warn(
+        "index %s is out of range for type %s\n", index_str,
+        data->array_type->name
+    );
+
+    report_end();
+}
+
+void __ubsan_handle_shift_out_of_bounds(
+    struct ubsan_shift_data *data, ptr_t lhs, ptr_t rhs
+)
+{
+    char lhs_str[UBSAN_VALUE_STR_SIZE], rhs_str[UBSAN_VALUE_STR_SIZE];
+    const struct ubsan_type *lhs_type = data->lhs_type;
+    const struct ubsan_type *rhs_type = data->rhs_type;
+
+    if (!report_begin(&data->loc, "shift-out-of-bounds"))
+        return;
+
+    format_value(lhs_str, sizeof(lhs_str), lhs_type, lhs);
+    format_value(rhs_str, sizeof(rhs_str), rhs_type, rhs);
+
+    if (type_is_signed(rhs_type) && value_signed(rhs_type, rhs) < 0)
+        pr_warn("shift exponent %s is negative\n", rhs_str);
+    else if (value_unsigned(rhs_type, rhs) >= type_bit_width(lhs_type))
+        pr_warn(
+            "shift exponent %s is too large for %u-bit type %s\n", rhs_str,
+            type_bit_width(lhs_type), lhs_type->name
+        );
+    else if (type_is_signed(lhs_type) && value_signed(lhs_type, lhs) < 0)
+        pr_warn("left shift of negative value %s\n", lhs_str);
+    else
+        pr_warn(
+            "left shift of %s by %s places cannot be represented in type %s\n",
+            lhs_str, rhs_str, lhs_type->name
+        );
+
+    report_end();
+}
+
+static void handle_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs, char op
+)
+{
+    char lhs_str[UBSAN_VALUE_STR_SIZE], rhs_str[UBSAN_VALUE_STR_SIZE];
+
+    if (!report_begin(&data->loc, "integer-overflow"))
+        return;
+
+    format_value(lhs_str, sizeof(lhs_str), data->type, lhs);
+    format_value(rhs_str, sizeof(rhs_str), data->type, rhs);
+    pr_warn(
+        "%s %c %s cannot be represented in type %s\n", lhs_str, op, rhs_str,
+        data->type->name
+    );
+
+    report_end();
+}
+
+void __ubsan_handle_add_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs
+)
+{
+    handle_overflow(data, lhs, rhs, '+');
+}
+
+void __ubsan_handle_sub_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs
+)
+{
+    handle_overflow(data, lhs, rhs, '-');
+}
+
+void __ubsan_handle_mul_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs
+)
+{
+    handle_overflow(data, lhs, rhs, '*');
+}
+
+void __ubsan_handle_negate_overflow(
+    struct ubsan_value_data *data, ptr_t value
+)
+{
+    char value_str[UBSAN_VALUE_STR_SIZE];
+
+    if (!report_begin(&data->loc, "integer-overflow"))
+        return;
+
+    format_value(value_str, sizeof(value_str), data->type, value);
+    pr_warn(
+        "negation of %s cannot be represented in type %s\n", value_str,
+        data->type->name
+    );
+
+    report_end();
+}
+
+void __ubsan_handle_divrem_overflow(
+    struct ubsan_value_data *data, ptr_t lhs, ptr_t rhs
+)
+{
+    char lhs_str[UBSAN_VALUE_STR_SIZE];
+
+    if (!report_begin(&data->loc, "division-overflow"))
+        return;
+
+    if (type_is_signed(data->type) && value_signed(data->type, rhs) == -1) {
+        format_value(lhs_str, sizeof(lhs_str), data->type, lhs);
+        pr_warn(
+            "division of %s by -1 cannot be represented in type %s\n",
+            lhs_str, data->type->name
+        );
+    } else {
+        pr_warn("division by zero\n");
+    }
+
+    report_end();
+}
+
+void __ubsan_handle_load_invalid_value(
+    struct ubsan_value_data *data, ptr_t value
+)
+{
+    char value_str[UBSAN_VALUE_STR_SIZE];
+
+    if (!report_begin(&data->loc, "invalid-load"))
+        return;
+
+    format_value(value_str, sizeof(value_str), data->type, value);
+    pr_warn(
+        "load of value %s is not a valid value for type %s\n", value_str,
+        data->type->name
+    );
+
+    report_end();
+}
+
+void __ubsan_handle_builtin_unreachable(struct ubsan_unreachable_data *data)
+{
+    panic(
+        "ubsan: reached unreachable code in %s:%u:%u", data->loc.file,
+        data->loc.line, data->loc.column
+    );
+}
diff --git a/kernel/ubsan.cmake b/kernel/ubsan.cmake
new file mode 100644
index 00000000..19ca737f
--- /dev/null
+++ b/kernel/ubsan.cmake
@@ -0,0 +1,35 @@
+function(setup_ubsan)
+    set(CHECKS "")
+
+    if (CONFIG_UBSAN_BOUNDS)
+        list(APPEND CHECKS ${ULTRA_TOOLCHAIN_UBSAN_BOUNDS})
+    endif ()
+    if (CONFIG_UBSAN_SHIFT)
+        list(APPEND CHECKS shift)
+    endif ()
+    if (CONFIG_UBSAN_SIGNED_OVERFLOW)
+        list(APPEND CHECKS signed-integer-overflow)
+    endif ()
+    if (CONFIG_UBSAN_DIV_ZERO)
+        list(APPEND CHECKS integer-divide-by-zero)
+    endif ()
+    if (CONFIG_UBSAN_UNREACHABLE)
+        list(APPEND CHECKS unreachable)
+    endif ()
+    if (CONFIG_UBSAN_BOOL)
+        list(APPEND CHECKS bool)
+    endif ()
+
+    if (CHECKS)
+        list(JOIN CHECKS "," CHECKS)
+        ultra_compile_options(-fsanitize=${CHECKS})
+    endif ()
+
+    if (CONFIG_TOOLCHAIN_CLANG)
+        string(REPLACE "/" ";" SOURCE_DIR_PARTS "${CMAKE_SOURCE_DIR}")
+        list(LENGTH SOURCE_DIR_PARTS SOURCE_DIR_DEPTH)
+        ultra_compile_options(
+            -fsanitize-undefined-strip-path-components=${SOURCE_DIR_DEPTH}
+        )
+    endif ()
+endfunction()
diff --git a/scripts/build_utils b/scripts/build_utils
index 1655098c..e4920dbc 160000
--- a/scripts/build_utils
+++ b/scripts/build_utils
@@ -1 +1 @@
-Subproject commit 1655098c202ff50ef23849b87e800fe12e9ff83b
+Subproject commit e4920dbcc2a847a28e78ac1c1c3e81c0c83ee150
diff --git a/tests/kernel_helpers.cpp b/tests/kernel_helpers.cpp
index 88bc798a..b439f67f 100644
--- a/tests/kernel_helpers.cpp
+++ b/tests/kernel_helpers.cpp
@@ -43,9 +43,8 @@ void print(const char *msg, ...)
     va_end(vlist);
 }
 
-void log_flush_console(struct console *con)
+void log_flush_consoles(void)
 {
-    UNREFERENCED_PARAMETER(con);
 }
 
 #undef panic
diff --git a/tests/test-cases/test_bit.c b/tests/test-cases/test_bit.c
index f194a86c..2b5047e4 100644
--- a/tests/test-cases/test_bit.c
+++ b/tests/test-cases/test_bit.c
@@ -16,6 +16,11 @@ TEST_CASE(bit_constants_and_single_bit_macros)
     ASSERT_EQ(BIT_U16(9), (u16)0x0200);
     ASSERT_EQ(BIT_U32(31), 0x80000000u);
     ASSERT_EQ(BIT_U64(63), 0x8000000000000000ull);
+
+    ASSERT_EQ(sizeof(BIT_U8(0)), sizeof(u8));
+    ASSERT_EQ(sizeof(BIT_U16(0)), sizeof(u16));
+    ASSERT_EQ(sizeof(BIT_U32(0)), sizeof(u32));
+    ASSERT_EQ(sizeof(BIT_U64(0)), sizeof(u64));
 }
 
 TEST_CASE(bit_mask_helpers)
diff --git a/tests/test-cases/test_log_ring.c b/tests/test-cases/test_log_ring.c
index 8cd3c77c..029f4720 100644
--- a/tests/test-cases/test_log_ring.c
+++ b/tests/test-cases/test_log_ring.c
@@ -181,6 +181,44 @@ TEST_CASE(extend_record)
     READ_ONE_EXPECT_EINVAL();
 }
 
+TEST_CASE(skip_unpublished)
+{
+    TEST_RING(RING_4K, 5);
+    struct log_ring_reservation reservation;
+    struct log_record record;
+
+    WRITE_ONE_EXPECT_SUCCESS("first");
+
+    // Reserved and never finished, like a writer interrupted by a panic
+    ASSERT_EQ(log_ring_reserve(ring, 8, SYSLOG_CRIT, &reservation), EOK);
+
+    WRITE_ONE_EXPECT_SUCCESS("third");
+
+    READ_ONE_EXPECT("first");
+    READ_ONE_EXPECT_EINVAL();
+
+    ASSERT_EQ(
+        log_ring_read_with_flags(
+            ring, seq, read_buf, sizeof(read_buf),
+            LOG_RING_READ_SKIP_UNPUBLISHED, &record
+        ),
+        EOK
+    );
+    ASSERT_EQ(record.seq_num, 2);
+    ASSERT_EQ(record.length, strlen("third"));
+    ASSERT_EQ(memcmp(read_buf, "third", record.length), 0);
+
+    // The newest record is never skipped, its writer may still finish it
+    ASSERT_EQ(log_ring_reserve(ring, 8, SYSLOG_CRIT, &reservation), EOK);
+    ASSERT_EQ(
+        log_ring_read_with_flags(
+            ring, 3, read_buf, sizeof(read_buf),
+            LOG_RING_READ_SKIP_UNPUBLISHED, &record
+        ),
+        EINVAL
+    );
+}
+
 #define MSG0 "00000000"
 #define MSG1 "11111111"
 #define MSG2 "22222222"
diff --git a/toolchain/toolchain_clang.cmake b/toolchain/toolchain_clang.cmake
index 5e815759..bfc1e333 100644
--- a/toolchain/toolchain_clang.cmake
+++ b/toolchain/toolchain_clang.cmake
@@ -33,3 +33,4 @@ set(CMAKE_C_COMPILER_TARGET "${ULTRA_TARGET_TRIPLE}")
 set(CMAKE_ASM_COMPILER_TARGET "${ULTRA_TARGET_TRIPLE}")
 
 set(ULTRA_TOOLCHAIN_LTO_FLAGS "-flto=full")
+set(ULTRA_TOOLCHAIN_UBSAN_BOUNDS "array-bounds")
diff --git a/toolchain/toolchain_gcc.cmake b/toolchain/toolchain_gcc.cmake
index 46143f2d..57488df2 100644
--- a/toolchain/toolchain_gcc.cmake
+++ b/toolchain/toolchain_gcc.cmake
@@ -12,3 +12,4 @@ set(CMAKE_RANLIB "${ULTRA_TOOLCHAIN_PREFIX}gcc-ranlib")
 set(CMAKE_NM "${ULTRA_TOOLCHAIN_PREFIX}gcc-nm")
 
 set(ULTRA_TOOLCHAIN_LTO_FLAGS "-flto;-flto-partition=none")
+set(ULTRA_TOOLCHAIN_UBSAN_BOUNDS "bounds")