A use-after-free vulnerability in the Linux kernel's BPF trampoline program handling was fixed by ensuring that freeing trampoline programs waits for an RCU tasks grace period. This prevents tasks that were preempted in the trampoline from accessing freed memory, which could cause kernel crashes or memory corruption.
A vulnerability in the Linux kernel's BPF trampoline handling could lead to use-after-free conditions when BPF programs are detached while still in use by tasks. This occurs because detached BPF programs are freed after grace periods without accounting for tasks sleeping in other BPF programs within the same trampoline image. The issue has been fixed by introducing patchable no-op instructions before each program call to safely skip detached programs. This fix prevents kernel crashes caused by tasks resuming execution in freed program memory.
CVE-2026-98797 is a vulnerability in the Linux kernel's network stack involving improper handling of skb->queue_mapping during packet transmission. The flaw allows a local user with CAP_NET_ADMIN in a network namespace to redirect packets from a device with more TX queues to one with fewer, causing out-of-bounds access in the taprio_enqueue function. This occurs because stale queue_mapping values from the ingress device are used by the egress device, leading to potential memory corruption. The issue is fixed by properly capping skb->queue_mapping and managing related flags during packet transmission.
CVE-2026-98795 is a vulnerability in the Linux kernel's sparx5 network driver where a NULL pointer dereference occurs during driver unbinding if the Precision Time Protocol (PTP) initialization was skipped. This happens because sparx5_ptp_init() may return early without initializing PTP-related structures, but sparx5_ptp_deinit() does not check for this condition before cleanup, leading to a NULL dereference and potential kernel crash. The issue affects Linux kernel version 5.18 and has been fixed by adding an early return in sparx5_ptp_deinit() when PTP is not used.
A NULL pointer dereference vulnerability in the Linux kernel's net/mlx5e driver related to AF_XDP TX timestamp teardown has been fixed. The issue occurs during the teardown of the XSK TX queue when outstanding descriptors are completed without a completion queue entry (CQE). If a TX timestamp was requested, the code attempts to dereference a NULL CQE, causing a potential crash. The fix returns zero when no CQE is available, preventing the NULL dereference.
A vulnerability in the Linux kernel related to BPF memory object freeing has been fixed. The issue involved objects getting stuck in the free_by_rcu_ttrace state due to improper handling of the call_rcu_ttrace_in_progress flag, potentially causing unbounded accumulation of such objects. The fix introduces a three-state mechanism for call_rcu_ttrace_in_progress and changes the queuing behavior of __free_rcu() to ensure proper freeing of these objects.
A use-after-free vulnerability in the Linux kernel's futex private hash resizing mechanism was fixed. The issue involved improper ordering of assignments leading to a race condition where a reader could access a freed hash. The fix changes the order of assignments to ensure safe synchronization without relying on scoped RCU guards.
A vulnerability in the Linux kernel's BPF subsystem was fixed to address missing migration protection in the function __rhtab_map_lookup_and_delete_batch(). The issue involved improper handling of CPU migration during a delete loop, which could cause a kernel bug due to use of smp_processor_id() in preemptible code. The fix adds migrate_disable()/migrate_enable() calls to prevent task migration during this operation.
A use-after-free or null pointer dereference vulnerability was identified in the Linux kernel's AMD display driver related to MST mode validation. The flaw involves dereferencing the dc_sink pointer without a NULL check during certain mode validation and bandwidth calculation functions, which can occur due to asynchronous teardown of the sink on MST unplug. This can lead to invalid memory access. The issue has been fixed by adding checks to fail the port-support validation and skip the FRL conversion path when the sink is absent.
A use-after-free (UAF) vulnerability exists in the Linux kernel's binderfs subsystem, specifically in the binder_add_device function. The issue arises when a new device entry is published and then concurrently unlinked, causing the device object to be freed while still being accessed, leading to a write-after-free condition. This flaw was discovered through kernel address sanitizer (KASAN) testing and has been fixed in specific Linux kernel commits.
A vulnerability in the Linux kernel rust_binder component was fixed by ensuring deferred work items on a thread's todo list are properly canceled when the thread exits. Previously, these deferred work items were not cleaned up in the Thread::release() method if the thread died while having an active outgoing transaction.
A vulnerability in the Linux kernel's USB Type-C driver (tipd) was fixed by zero-initializing the typec_partner_desc structure in the cd321x_update_work() function. The flaw involved uninitialized fields in a stack-allocated descriptor that could lead to garbage function pointers being stored and invoked, as well as potential leakage of stack data through sysfs.
A use-after-free vulnerability in the Linux kernel's USB Type-C UCSI glink driver was identified and fixed. The issue occurs because work items can run after the UCSI instance has been unregistered and its memory freed, leading to dereferencing freed memory or double unregistering. The fix involves disabling work items before unregistering and checking registration status before unregistering again.
A NULL pointer dereference vulnerability in the Linux kernel's serial core subsystem was fixed. The flaw occurs in the function serial_core_unregister_port() when it dereferences a NULL port device pointer. This happens if no port device is installed or if registration failed before serial_core_port_device_add(). The fix involves returning early if the port device is NULL and properly synchronizing access with port_mutex. Additionally, the port device pointer is cleared on error paths to prevent use-after-free scenarios.
A vulnerability in the Linux kernel's EDAC/altera driver involves the improper use of __init annotation on ECC setup functions. These functions, which run during device probing, may be called after the __init memory is freed due to deferred probing or manual unbind/rebind operations, leading to dereferencing freed memory. The issue is fixed by removing the __init annotation to ensure these functions remain valid at runtime.
A vulnerability in the Linux kernel Bluetooth subsystem (btintel_pcie) was fixed to address a plen overflow in the btintel_pcie_recv_frame() function. The issue involved a 16-bit plen value that could wrap around when adding header size and data length, allowing packet truncation checks to be bypassed. The fix involved widening plen to 32 bits to prevent overflow.
A vulnerability in the Linux kernel Bluetooth subsystem (btintel_pcie) allows a user-space process with HCI_CHANNEL_USER access to inject oversized transmit packets, causing a buffer overflow in the send_frame() function. This occurs because the function copies data into a fixed-size 4096-byte DMA buffer without properly rejecting packets that exceed the buffer size minus the PCIe header length. The issue has been fixed by rejecting packets larger than the allowed size on entry.
A vulnerability in the Linux kernel version 6.13 affects x86 memory management on AMD F15h processors, specifically Carrizo and FX-8370E models. The issue involves incorrect application of virtual address alignment (va_align) to hugetlb mappings, causing vm_unmapped_area() to return addresses misaligned to huge page boundaries. This misalignment triggers a kernel BUG_ON during huge page teardown, potentially leading to system instability or crashes. The flaw has been fixed in specific commits addressing the alignment logic for hugetlbfs mappings.
A vulnerability in the Linux kernel's TPM subsystem was fixed to address an off-by-four bounds check error in the tpm2_get_random() function. The flaw allowed memcpy() to read up to 4 bytes beyond the end of a truncated TPM response, potentially leaking stale buffer contents as random bytes. The issue was corrected by adjusting the bounds check to properly account for the parameter size field in the response.
A vulnerability in the Linux kernel's nvme-multipath subsystem was addressed by changing when the BLK_FEAT_ZONED feature flag is set. Previously, the namespace head was marked as zoned at allocation based solely on the command set identifier, which could lead to incorrect zoned capability reporting and a zero zone size causing invalid shifts. The fix delays setting the zoned feature until the zone information is confirmed, preventing erroneous behavior.