A vulnerability in the Linux kernel's adi-axi-adc driver was fixed by initializing a state mutex that was previously uninitialized during probe. This mutex protects AXI ADC register access paths to serialize transactions, preventing potential race conditions.
A vulnerability in the Linux kernel's iio adc pac1934 driver involved improper handling of ACPI label duplication. The issue caused a failure that reached the terminating-byte write, potentially leading to access of a missing label. The flaw was detected by static analysis and fixed by adding checks to release the ACPI result and abort before accessing missing labels. The fix is included in specific Linux kernel commits.
A vulnerability in the Linux kernel's iio frequency driver for adf4377 was fixed by fully initializing the clk_init_data and clk_parent_data structures. Uninitialized members in these structures could cause crashes when certain kernel stack initialization configurations are enabled.
A vulnerability in the Linux kernel's Rohm BU27034 light sensor driver caused an infinite delay when reading the integration time failed. The code incorrectly used the error code to compute sleep time, leading to this issue. The flaw has been fixed by defaulting to the smallest integration time if reading fails.
A vulnerability in the Linux kernel's iio pressure driver for rohm-bm1390 causes the data reading function to ignore cached error values and always return 0, even when a read operation fails. This issue has been fixed by modifying the function to return the cached error value after stopping the measurement, allowing users to detect read failures and avoid using invalid data.
A vulnerability in the Linux kernel's AW96103 proximity sensor driver allows improper validation of firmware data length. The firmware parser reads a length field from the binary header and uses it to process register/value entries. A truncated or malformed firmware image can cause the parser to read beyond the allocated buffer or interpret an underflowed length as a very large value, potentially leading to memory corruption.
A vulnerability in the Linux kernel's KVM s390 subsystem related to the _gaccess_shadow_fault() function has been fixed. The issue involved a scenario where a nested guest memory page being shadowed might not be present in the parent guest's gmap, causing dat_entry_walk() to fail and erroneously propagate an error to userspace. The fix involves manually linking the nested guest memory if the mapping was missing.
A vulnerability in the Linux kernel's KVM s390 subsystem was fixed by adding a missing srcu lock in the function kvm_s390_set_irq_state(). This function, like kvm_s390_inject_vcpu(), requires the kvm->srcu or slots lock when performing the Store status operation to ensure proper synchronization. The fix involves taking the kvm->srcu lock in kvm_s390_set_irq_state().
A vulnerability in the Linux kernel's KVM s390 component involves improper handling of a NULL pointer in the dat_cond_set_storage_key() function. This flaw occurs because some callers pass NULL as the oldkey parameter, leading to a NULL pointer dereference in page_cond_set_storage_key(). The issue has been fixed by adding a check for NULL and assigning a dummy local variable to prevent crashes.
A race condition vulnerability in the Linux kernel's KVM s390 architecture was fixed. The issue involved potential concurrent splitting of large pages during storage key operations, which could lead to crashes. The flaw was addressed by changing how the crste pointer is accessed to avoid unsafe dereferencing during races.
A race condition vulnerability in the Linux kernel's KVM s390 architecture implementation was fixed by using READ_ONCE() in the _destroy_pages_crste() function to prevent multiple dereferences of a pointer. This fix addresses a concurrency issue that could potentially lead to unstable behavior in the kernel's memory management for this architecture.
A vulnerability in the Linux kernel s390/uv subsystem could cause an out-of-bounds read when the system has more than 85 secrets. This occurs because the uv_secret_list struct array only holds up to 85 items per page, but the code incorrectly loops over the overall count instead of the per sub-list count. This flaw has been fixed by correcting the loop to use the per sub-list count of stored secrets.
A divide-by-zero vulnerability was identified and fixed in the Linux kernel's bpf subsystem, specifically in the btf_struct_walk() function. The flaw occurs when accessing past a struct with a flexible array member whose element type has zero size, causing a divide-by-zero error at program load time. This can lead to kernel crashes during BPF program verification.
A vulnerability in the Linux kernel's TCP stack was fixed where the function cond_resched() was called in an invalid context under BPF (Berkeley Packet Filter) execution. This caused a kernel BUG due to a sleeping function being invoked while holding RCU read locks, which is not allowed. The issue occurs during socket destruction when a listening socket with children in its accept queue is aborted, triggering the problematic cond_resched() call. The fix involves skipping cond_resched() in this specific BPF context to avoid the invalid sleep.
A use-after-free vulnerability in the Linux kernel's HID winwing driver related to force feedback teardown has been fixed. The issue arises from improper freeing of driver private data, leading to double free and slab corruption during device teardown or system suspend. The fix involves changing the force-feedback context handling to prevent invalid frees.
A vulnerability in the Linux kernel's BPF subsystem could cause a soft lockup due to lack of rescheduling points in the __htab_map_lookup_and_delete_batch() function. This issue affects batch operations on large hash maps, potentially causing CPUs to be held for extended periods, triggering the kernel's soft lockup watchdog. The problem has been fixed by adding rescheduling points to avoid long CPU holds during batch lookups and deletions.
CVE-2026-98643 is a vulnerability in the Linux kernel's BPF sock_ops program where an out-of-bounds read occurs when accessing the rtt_min field. This happens because the code reads rtt_min without verifying the socket type, leading to reading beyond the end of a request_sock structure and leaking adjacent kernel memory. The issue is fixed by adding a guard check to ensure the socket is a fully locked tcp_sock before reading rtt_min.
CVE-2026-98642 is a use-after-free (UAF) vulnerability in the Linux kernel's BPF subsystem caused by concurrent access to ttrace lists in the alloc_bulk function. The flaw arises from a race condition between the __free_rcu() callback and alloc_bulk() operations on waiting_for_gp_ttrace and free_by_rcu_ttrace lists, leading to unsafe memory access. The issue has been fixed by adding a raw spinlock to synchronize these concurrent operations.
A vulnerability in the Linux kernel's BPF subsystem on arm64 architecture involves improper setup of the frame pointer for the exception callback. This flaw can cause a helper function to write over its own return address, potentially leading to a kernel panic due to a fatal exception in interrupt context. The issue arises because the frame pointer register (x25) is not correctly set during exception callbacks, causing stack accesses to reference invalid memory frames.
A vulnerability in the Linux kernel's amd_sfh driver allows out-of-bounds memory access due to lack of validation of PCI BAR 2 size before mapping. This can cause a page fault during device probe if the BAR size is smaller than expected. The issue is fixed by verifying the BAR size is at least 128KB before mapping.