A vulnerability in the Linux kernel's KVM SEV implementation involves improper handling of the "have run CPUs" mask pointer during freeing, which could lead to a double-free condition. The issue occurs when the mask is freed in the error path of __sev_guest_init(), causing potential memory management errors. The fix involves nullifying the pointer properly and adding helper functions to manage allocation and freeing safely.
A vulnerability in the Linux kernel's KVM SEV implementation involves improper cache maintenance timing during intra-host VM migration. The issue arises because cache flushes are performed after clearing the SEV active state on the source VM, creating a small window where memory pages could be reclaimed and reused without proper cache flushing. This could lead to memory corruption or data leakage between virtual machines.
CVE-2026-98715 addresses a flaw in the Linux kernel's KVM SVM implementation where the TLB control state was improperly reset on a failed VMRUN operation. This could cause the CPU to skip a required TLB flush, potentially leading to stale translations being used. The fix preserves the TLB control state on failure and tracks flush requirements per CPU to prevent this issue.
A vulnerability in the Linux kernel's KVM arm64 implementation related to fine-grained undefined instruction (UNDEF) handling without FEAT_FGT feature support has been resolved. The fix ensures that fine-grained undefined traps (FGUs) are applied regardless of hardware support for FEAT_FGT, preventing spurious warnings and incorrect trap handling in certain guest configurations.
A vulnerability in the Linux kernel's KVM arm64 virtual generic interrupt controller (vgic) was addressed by ensuring a reference count is taken on interrupts referenced by last_lr_irq. This fixes a fragile condition where the last interrupt inserted in a list register (LR) could disappear if a concurrently unmapped local peripheral interrupt (LPI) occurred.
A vulnerability in the Linux kernel's mac80211 wifi subsystem allows a received Channel Switch Announcement (CSA) frame with an invalid 320 MHz bandwidth indication on a non-6 GHz link to cause a kernel panic when panic_on_warn is enabled. This occurs due to an uninitialized read of vht_operation.chan_width after the validator warns but does not reject the invalid bandwidth. The issue has been fixed by rejecting the invalid channel definition before processing the VHT operation conversion.
A vulnerability in the Linux kernel's Thunderbolt driver was fixed by ensuring that a router reference is held for each allocated HopID. Previously, tb_stop() dropped references to DP tunnels without deactivating them, allowing tunnels to outlive their expected lifecycle and causing operations on freed IDAs, which triggered warnings. This issue could be triggered by unbinding the driver while a DP tunnel was still awaiting a capabilities read, notably causing problems on Apple NHI devices when unplugging cables. The fix involves holding and releasing router references properly to keep ports and HopID IDAs alive as long as they are in use.
A vulnerability in the Linux kernel's Thunderbolt driver was fixed by making the DisplayPort (DP) tunnel activation callback mandatory. Previously, tunnels created without this callback leaked references, causing resource leaks and potential delays during hibernation restore. The fix ensures the DP capabilities are always read asynchronously, preventing reference leaks and reducing hibernation restore delays.
A vulnerability in the Linux kernel's Thunderbolt subsystem was addressed by ensuring inactive DisplayPort (DP) tunnels are properly torn down when the domain is stopped. Previously, tb_stop() only removed DMA tunnels, leaving DP tunnels waiting for work completion, which could cause operations to run against a torn-down domain and block completion waits until a timeout. The fix cancels queued work for inactive DP tunnels without affecting active display tunnels.
A vulnerability in the Linux kernel's Thunderbolt driver causes a domain reference leak when a DisplayPort (DP) tunnel read operation is canceled. This leak can block driver unbinding indefinitely, leading to resource management issues. The flaw occurs if a DP tunnel is torn down before the DPRX read completes, such as unplugging within a timeout window. The issue has been fixed by adjusting reference ownership within the DPRX work scheduling logic.
A vulnerability in the Linux kernel's Thunderbolt driver allows access to a DisplayPort (DP) tunnel after its DPRX read operation was canceled. This occurs because the code checks a cancellation flag without proper locking, leading to callbacks on tunnels that have already been torn down during system suspend or disconnect. The issue has been fixed by adding proper locking and flag management to prevent accessing inactive tunnels.
A NULL pointer dereference vulnerability was identified and fixed in the Linux kernel's Thunderbolt subsystem. The flaw arises from a race condition between tb_remove_work() and tb_domain_remove() functions, leading to a NULL dereference of the tb->root_switch pointer inside tb_free_unplugged_xdomains(). This can cause kernel instability or crashes. The issue was resolved by ensuring proper locking and pointer checks during the removal of XDomains from the Thunderbolt topology.
A vulnerability in the Linux kernel SMB client was fixed where the pagecache beyond the end-of-file (EOF) was not properly discarded when extending a file via clone range. This could cause data dirtied past EOF through mmap to become visible as file content after the file extension.
A vulnerability in the Linux kernel SMB client related to the handling of allocated ranges queries can cause data corruption when interacting with Windows servers. The issue arises because the client queries allocated ranges without first flushing and committing data, leading to zero-filling of live data due to incoherent server responses. This flaw has been fixed in Linux kernel versions 5.11, 5.13, and 5.14.
A vulnerability in the Linux kernel SMB client implementation allowed stale data to be read from zeroed file ranges due to improper flushing of dirty data before zeroing. This flaw was fixed by ensuring dirty data is always flushed before invalidating the page cache and issuing zero-range commands to the server. The issue affected multiple Linux kernel versions prior to 6.2, 6.7, 6.11, and the exact 6.11 release.
A Linux kernel vulnerability in the SMB client affects server-side copy and clone operations. The flaw involves improper serialization of the destination page cache during these operations, leading to potential file corruption due to stale data being written after the server-side copy completes. This issue has been fixed in Linux kernel versions 6.2, 6.7, and later.
A memory leak and improper state handling vulnerability was identified and fixed in the Linux kernel driver for the Kionix KX022A accelerometer. The issue occurs when regmap operations fail during buffer enabling, causing allocated memory not to be freed and hardware state not to be reverted. This could leave interrupts and buffers enabled incorrectly and driver state flags in an inconsistent state.
A vulnerability in the Linux kernel's AD4030 ADC driver was fixed by correcting the validation of the oversampling_ratio parameter. The function ad4030_set_avg_frame_len() previously calculated a logarithm on the input before validating it, which could lead to undefined behavior if zero or negative values were passed. The fix ensures the input is strictly positive before computing the logarithm.
A NULL pointer dereference vulnerability in the Linux kernel's ade9000 ADC driver was fixed. The issue occurs during clkout registration when a NULL register address is passed, causing a crash if the ADE9000 is configured as a clock provider with an external input clock. The fix changes the clock registration to use a 1:1 fixed-factor clock that does not require register access, preventing the crash. This does not affect configurations using the internal clock.
A vulnerability in the Linux kernel's ADE9000 ADC driver caused Phase C dip events to be unreported due to an incorrect upper bound in scanning event bits. This issue was fixed by increasing the scanning range to include the missing event bit, ensuring proper handling of Phase C dip events.