A vulnerability in the Linux kernel's KVM s390 component involves improper handling of a NULL pointer in the dat_cond_set_storage_key() function. This flaw occurs because some callers pass NULL as the oldkey parameter, leading to a NULL pointer dereference in page_cond_set_storage_key(). The issue has been fixed by adding a check for NULL and assigning a dummy local variable to prevent crashes.
A race condition vulnerability in the Linux kernel's KVM s390 architecture was fixed. The issue involved potential concurrent splitting of large pages during storage key operations, which could lead to crashes. The flaw was addressed by changing how the crste pointer is accessed to avoid unsafe dereferencing during races.
A race condition vulnerability in the Linux kernel's KVM s390 architecture implementation was fixed by using READ_ONCE() in the _destroy_pages_crste() function to prevent multiple dereferences of a pointer. This fix addresses a concurrency issue that could potentially lead to unstable behavior in the kernel's memory management for this architecture.
A vulnerability in the Linux kernel s390/uv subsystem could cause an out-of-bounds read when the system has more than 85 secrets. This occurs because the uv_secret_list struct array only holds up to 85 items per page, but the code incorrectly loops over the overall count instead of the per sub-list count. This flaw has been fixed by correcting the loop to use the per sub-list count of stored secrets.
A divide-by-zero vulnerability was identified and fixed in the Linux kernel's bpf subsystem, specifically in the btf_struct_walk() function. The flaw occurs when accessing past a struct with a flexible array member whose element type has zero size, causing a divide-by-zero error at program load time. This can lead to kernel crashes during BPF program verification.
A vulnerability in the Linux kernel's TCP stack was fixed where the function cond_resched() was called in an invalid context under BPF (Berkeley Packet Filter) execution. This caused a kernel BUG due to a sleeping function being invoked while holding RCU read locks, which is not allowed. The issue occurs during socket destruction when a listening socket with children in its accept queue is aborted, triggering the problematic cond_resched() call. The fix involves skipping cond_resched() in this specific BPF context to avoid the invalid sleep.
A use-after-free vulnerability in the Linux kernel's HID winwing driver related to force feedback teardown has been fixed. The issue arises from improper freeing of driver private data, leading to double free and slab corruption during device teardown or system suspend. The fix involves changing the force-feedback context handling to prevent invalid frees.
A vulnerability in the Linux kernel's BPF subsystem could cause a soft lockup due to lack of rescheduling points in the __htab_map_lookup_and_delete_batch() function. This issue affects batch operations on large hash maps, potentially causing CPUs to be held for extended periods, triggering the kernel's soft lockup watchdog. The problem has been fixed by adding rescheduling points to avoid long CPU holds during batch lookups and deletions.
CVE-2026-98643 is a vulnerability in the Linux kernel's BPF sock_ops program where an out-of-bounds read occurs when accessing the rtt_min field. This happens because the code reads rtt_min without verifying the socket type, leading to reading beyond the end of a request_sock structure and leaking adjacent kernel memory. The issue is fixed by adding a guard check to ensure the socket is a fully locked tcp_sock before reading rtt_min.
CVE-2026-98642 is a use-after-free (UAF) vulnerability in the Linux kernel's BPF subsystem caused by concurrent access to ttrace lists in the alloc_bulk function. The flaw arises from a race condition between the __free_rcu() callback and alloc_bulk() operations on waiting_for_gp_ttrace and free_by_rcu_ttrace lists, leading to unsafe memory access. The issue has been fixed by adding a raw spinlock to synchronize these concurrent operations.
A vulnerability in the Linux kernel's BPF subsystem on arm64 architecture involves improper setup of the frame pointer for the exception callback. This flaw can cause a helper function to write over its own return address, potentially leading to a kernel panic due to a fatal exception in interrupt context. The issue arises because the frame pointer register (x25) is not correctly set during exception callbacks, causing stack accesses to reference invalid memory frames.
A vulnerability in the Linux kernel's amd_sfh driver allows out-of-bounds memory access due to lack of validation of PCI BAR 2 size before mapping. This can cause a page fault during device probe if the BAR size is smaller than expected. The issue is fixed by verifying the BAR size is at least 128KB before mapping.
A vulnerability in the Linux kernel's KVM implementation for RISC-V was fixed by correcting the order of updates to the nested HFENCE entry. The improper update order could cause the SBI implementation or NACL hardware to observe stale page number and count values, leading to incorrect TLB flush ranges.
A vulnerability in the Linux kernel's KVM arm64 code allows an invalid SVE vector length to reach a fatal condition at EL2 due to insufficient validation in pkvm_vcpu_init_sve(). This issue has been fixed by adding proper validation of the vector length before calculating the state size.
A vulnerability in the Linux kernel's KVM arm64 implementation involves improper handling of the Scalable Vector Extension (SVE) feature flag during virtual CPU initialization failures. Specifically, when pkvm_vcpu_init_sve() fails, it clears the KVM_ARM_VCPU_SVE flag but does not clear the KVM_ARCH_FLAG_GUEST_HAS_SVE flag, causing subsequent vCPUs to skip proper SVE setup and register with a NULL sve_state. This can lead to issues when the guest performs its first floating-point access.
A vulnerability in the Linux kernel's squashfs subsystem allows a shift-out-of-bounds error when mounting an abnormal SquashFS image with specific compression options. This occurs if the COMP_OPTS flag is set to 1 but the dictionary size is 0, leading to an invalid shift exponent of -1. The issue has been fixed by adding a dictionary size range check before the shift operation.
A vulnerability in the Linux kernel's SCSI block subsystem allows an out-of-bounds write in the zones_cond array during zone report processing. This occurs when a device reports more zones than the array can hold, particularly if the zone count exceeds 32 bits, causing an undersized array and unchecked index writes. The issue has been fixed by validating the index against the array size and refusing to revalidate when the zone count is too large.
A vulnerability in the Linux kernel's SCSI subsystem (sd_zbc) involves improper handling of disks reporting an excessive number of zones. The kernel's sd_zbc_read_zones() function truncates zone counts exceeding 32 bits, leading to inconsistent zone resource allocation. Additionally, sd_zbc_report_zones() uses a signed integer for zone indexing, which can overflow for devices reporting more than INT_MAX zones. The kernel now rejects such devices at scan time to prevent inconsistent zone bookkeeping.
A vulnerability in the Linux kernel Bluetooth btnxpuart driver causes a socket buffer (skb) memory leak when CONFIG_DEV_COREDUMP is disabled. This occurs because hci_devcd_append() returns an error without freeing the skb, preventing recovery functions from executing. The issue has been fixed by conditionally calling hci_devcd_append() only when CONFIG_DEV_COREDUMP is enabled.
CVE-2026-98632 is a use-after-free vulnerability in the Linux kernel's Bluetooth mesh management code. It occurs when pending mesh transmission objects are canceled but still referenced by queued work entries, leading to dereferencing freed memory. The flaw is fixed by properly dequeuing and completing these entries to avoid use-after-free conditions.