A vulnerability in the Linux kernel's virtual terminal (vt) selection code allows an unsigned integer underflow and slab-out-of-bounds read in the paste_selection() function. This occurs when a concurrent ioctl call replaces the selection buffer with a shorter one while paste_selection() is sleeping, causing the function to read memory beyond the allocated buffer. The issue has been fixed by terminating the loop when the pasted byte count reaches the buffer length.
CVE-2026-98834 is a vulnerability in the Linux kernel's memory technology device (mtd) core subsystem involving a double-free of the OTP NVMEM device. The issue occurs when the factory OTP setup fails after the user OTP NVMEM device has been registered, leading to multiple unregister attempts without clearing the pointer, which can cause memory corruption. This flaw has been fixed in Linux kernel versions 5.16, 6.2, 6.3, and 6.4.
CVE-2026-98832 is a Linux kernel vulnerability in the blk-cgroup subsystem where improper handling of interrupt state in blkg_tryget_closest() can lead to deadlocks. The issue arises because the function unconditionally enables local interrupts when releasing a spinlock, even if interrupts were previously disabled by the caller. This can cause nested lock acquisition and deadlock in certain I/O completion paths.
A vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem allows oversized fragmented frames to cause an overflow in a 16-bit length field, leading to a kernel crash. The issue arises because the sum of fragment lengths can exceed the maximum value of a 16-bit unsigned integer, causing an integer overflow and buffer overflow during packet reassembly. This flaw has been fixed by dropping oversized fragments to prevent the overflow.
CVE-2026-98828 is a vulnerability in the Linux kernel's ath9k wireless driver where short WMI command responses are not properly handled. This flaw could cause the driver to read beyond the expected buffer size, potentially leading to memory corruption or stale data consumption. The issue has been fixed by rejecting short responses and properly handling error conditions.
A vulnerability in the Linux kernel's ath9k_htc wifi driver allowed TX aggregation to exceed the allocated buffer size, causing a buffer overflow. This was due to the aggregation loop not limiting the cumulative byte length, leading to memory corruption when handling large frames. The issue was fixed by bounding the aggregation to the maximum buffer size and adjusting the buffer length accounting to prevent frame loss.
A use-after-free vulnerability in the Linux kernel's rtc ac100 driver was fixed. The issue occurs when the probe function fails after registering clocks that are not device-managed, leaving dangling pointers in the global clock provider list. This can lead to use of freed memory and resource leaks, causing later probe failures for the same device. The fix ensures proper device-managed registration and cleanup on probe failure.
A vulnerability in the Linux kernel's mac80211 wireless subsystem involves improper validation of TX status rate metadata. Malformed metadata could lead to out-of-bounds indexing in rate control tables, potentially corrupting mac80211 state. The issue has been fixed by validating rate metadata earlier in the TX status processing path to prevent invalid entries from propagating. This fix does not remove the need for drivers to report valid data but prevents a single bad report from causing kernel state corruption.
CVE-2026-98821 is a vulnerability in the Linux kernel related to polled direct I/O (DIO) operations with user integrity metadata. The flaw occurs because the kernel incorrectly handles the iocb->private pointer when metadata I/O is involved, leading to a general protection fault during polling. This issue has been fixed in Linux kernel version 6.17 and related commits.
A vulnerability in the Linux kernel's blk-mq subsystem involves improper setting of the RQF_USE_SCHED flag when reusing cached requests for different operations. This flaw can cause domain token leaks and queue stalls in the kyber scheduler. The issue is fixed by setting RQF_USE_SCHED only after the request is claimed by an operation, using a new helper function blk_mq_rq_late_init().
A deadlock vulnerability in the Linux kernel's memory management subsystem was fixed by preventing the wake-up of kswapd within the __kfree_rcu_sheaf() function. The issue arises because kfree_rcu() can be called while holding pi_lock, and waking kswapd under this lock leads to a circular locking dependency and potential deadlock. The deadlock was verified using a modified kernel with lock dependency detection. This flaw affects Linux kernel version 6.18 and was resolved in specific commits.
A vulnerability in the Linux kernel's ASoC SDCA component related to power management runtime error handling in the function probe has been resolved. The fix adds a common error path to properly balance the runtime PM reference during probe initialization.
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) JIT constant blinding logic could cause an overflow of the jump offset, leading to a kernel crash when running certain BPF programs with hardened JIT enabled. This issue arises from improper handling of backward jump offsets that wrap around the signed 16-bit integer limit.
A use-after-free vulnerability was identified and fixed in the Linux kernel NVMe driver affecting version 5.9. The issue occurred when an I/O passthrough command was sent through a multipath namespace head after the controller path that created the head was removed, causing a kernel slab-use-after-free error. The fix involved moving the log cache to the subsystem level to maintain valid log pointers until subsystem release.
CVE-2026-98813 is a use-after-free vulnerability in the Linux kernel's BPF subsystem related to handling map BTF references in the memory allocator destructor record. The flaw occurs when a map's BTF reference is released prematurely while deferred work still accesses it, leading to a kernel slab-use-after-free error. This issue affects certain Linux kernel versions prior to 6.13 and 6.19, as well as version 7.0. The vulnerability has been fixed by ensuring the map BTF reference is held until the duplicated record is fully freed during deferred destruction.
A slab-out-of-bounds read vulnerability exists in the Linux kernel's mac80211 wifi subsystem in the ieee80211_monitor_select_queue() function. The flaw arises because the function validates packet length using skb->len, which includes non-linear fragments, but then dereferences pointers assuming linear data, potentially reading beyond the allocated buffer. This issue also affects ieee80211_validate_radiotap_len() and ieee80211_monitor_start_xmit() functions. The vulnerability has been fixed by checking the linear data length instead of the total skb length before accessing skb->data pointers.
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix slab-out-of-bounds when handling team device events
The mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event()
functions check for LAG masters (which includes both bonding and team
devices) but only call bonding-specific APIs. When processing team device
events, calling bond_slave_get_rcu() and bond_is_slave_inactive() on
team_port structures causes KASAN to detect an out-of-bounds memory access
since team_port is smaller than bond slave.
Fix this by wrapping the bond-specific API calls with a check for bonding
devices. This allows the function to still process LAG events for both
bonding and teams but only calls bond-specific functions when dealing with
actual bonding devices.
For mlx5_handle_changeinfodata_event(), keep the explicit bond check as
mlx5 doesn't handle state information for team ports anyway.
Tested with Mellanox ConnectX-5 on Linux 7.2.0-rc6:
- Bonding: PASS (no regressions)
- Team device: PASS (no KASAN errors)
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled
Previously, BPID assignment under CONFIG_DCB assumed
`queue_to_pfc_map` was always initialized. For SDP VFs this leads to
invalid memory access as it was not initialized.
This patch adds a NULL check for `queue_to_pfc_map` before
dereferencing it. Also, simplifies the logic by always assigning a
default BPID first, then conditionally overriding it if CONFIG_DCB is
enabled and the map exists.
In the Linux kernel, the following vulnerability has been resolved:
net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()
With CONFIG_PAGE_POOL_STATS=y, page_pool_recycle_ring_bulk() updates
the recycle stats after dropping the producer lock. If it just recycled
the last inflight netmems of a pool being destroyed, page_pool_release()
can pass its producer-lock barrier and free the pool before
recycle_stat_add() runs.
Commit fcc680a647ba7 ("page_pool: allow mixing PPs within one bulk")
moved this stat update after the unlock. Commit 271683bb2cf32
("page_pool: Fix use-after-free in page_pool_recycle_in_ring") later
added the barrier, but only fixed page_pool_recycle_in_ring(). Move
the update back under the lock.
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: fix rx Scatter-Gather support
When a received frame is larger than dma_buf_sz, the DMA scatters it
across multiple RX descriptors (rx Scatter-Gather). The secondary RX
buffer (sec_page) was only allocated and programmed when split-header
(SPH) was active, so for regular frames buffer2 was neither allocated
nor backed by a valid mapping. As soon as an incoming frame overflowed
buffer1, the DMA wrote the overflow into the unmapped secondary-buffer
address, triggering an SMMU translation fault on IOMMU-based platforms:
arm-smmu 15000000.iommu: Unhandled context fault: fsr=0x402, iova=0x00000000, fsynr=0x7f0011, cbfrsynra=0x1c90, cb=11
arm-smmu 15000000.iommu: FSR = 00000402 [Format=2 TF], SID=0x1c90
arm-smmu 15000000.iommu: FSYNR0 = 007f0011 [S1CBNDX=127 WNR PLVL=1]
Enable scatter-gather for non-SPH frames on cores that can program an
independent secondary RX buffer (GMAC4/XGMAC): allocate and mark buffer2
as valid in stmmac_init_rx_buffers() and stmmac_rx_refill(), and account
for it in the buffer length computation. Legacy cores have no set_sec_addr
op, so they keep buffer2 disabled.
Since buffer2 is handed to the DMA at page offset 0, the page pool sync
window is widened to cover both buffers in every mode: offset is set to 0
and max_len to dma_buf_sz + stmmac_rx_offset().
The FCS can straddle the buffer1/buffer2 boundary and a descriptor
boundary, so it is now stripped from the tail of the assembled frame with
pskb_trim() instead of from a single buffer, avoiding an unsigned underflow
for frames that overflow a buffer by 1..3 bytes. For single-buffer frames
the XDP program must not see the FCS, so it is removed from the XDP buffer
before the program runs.
Native XDP currently only supports single-buffer (linear) frames. An
oversized frame accepted by the MAC (jumbo enabled) is received via
buffer2; the XDP program only sees buffer1, so on a TX/REDIRECT verdict
the frame is forwarded truncated. XDP multi-buffer support to handle
this case is planned as a follow-up.
AF_XDP zero-copy RX is not covered by this change: a ZC queue still
programs buffer2 at DMA address 0 (and XGMAC has no buffer2-valid bit),
so an oversized frame overflowing buffer1 can still trigger the same
SMMU translation fault. Handling is planned as a follow-up.