A vulnerability in the Linux kernel's ath9k_htc wifi driver allowed TX aggregation to exceed the allocated buffer size, causing a buffer overflow. This was due to the aggregation loop not limiting the cumulative byte length, leading to memory corruption when handling large frames. The issue was fixed by bounding the aggregation to the maximum buffer size and adjusting the buffer length accounting to prevent frame loss.
A use-after-free vulnerability in the Linux kernel's rtc ac100 driver was fixed. The issue occurs when the probe function fails after registering clocks that are not device-managed, leaving dangling pointers in the global clock provider list. This can lead to use of freed memory and resource leaks, causing later probe failures for the same device. The fix ensures proper device-managed registration and cleanup on probe failure.
A vulnerability in the Linux kernel's mac80211 wireless subsystem involves improper validation of TX status rate metadata. Malformed metadata could lead to out-of-bounds indexing in rate control tables, potentially corrupting mac80211 state. The issue has been fixed by validating rate metadata earlier in the TX status processing path to prevent invalid entries from propagating. This fix does not remove the need for drivers to report valid data but prevents a single bad report from causing kernel state corruption.
CVE-2026-98821 is a vulnerability in the Linux kernel related to polled direct I/O (DIO) operations with user integrity metadata. The flaw occurs because the kernel incorrectly handles the iocb->private pointer when metadata I/O is involved, leading to a general protection fault during polling. This issue has been fixed in Linux kernel version 6.17 and related commits.
A vulnerability in the Linux kernel's blk-mq subsystem involves improper setting of the RQF_USE_SCHED flag when reusing cached requests for different operations. This flaw can cause domain token leaks and queue stalls in the kyber scheduler. The issue is fixed by setting RQF_USE_SCHED only after the request is claimed by an operation, using a new helper function blk_mq_rq_late_init().
A deadlock vulnerability in the Linux kernel's memory management subsystem was fixed by preventing the wake-up of kswapd within the __kfree_rcu_sheaf() function. The issue arises because kfree_rcu() can be called while holding pi_lock, and waking kswapd under this lock leads to a circular locking dependency and potential deadlock. The deadlock was verified using a modified kernel with lock dependency detection. This flaw affects Linux kernel version 6.18 and was resolved in specific commits.
A vulnerability in the Linux kernel's ASoC SDCA component related to power management runtime error handling in the function probe has been resolved. The fix adds a common error path to properly balance the runtime PM reference during probe initialization.
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) JIT constant blinding logic could cause an overflow of the jump offset, leading to a kernel crash when running certain BPF programs with hardened JIT enabled. This issue arises from improper handling of backward jump offsets that wrap around the signed 16-bit integer limit.
A use-after-free vulnerability was identified and fixed in the Linux kernel NVMe driver affecting version 5.9. The issue occurred when an I/O passthrough command was sent through a multipath namespace head after the controller path that created the head was removed, causing a kernel slab-use-after-free error. The fix involved moving the log cache to the subsystem level to maintain valid log pointers until subsystem release.
CVE-2026-98813 is a use-after-free vulnerability in the Linux kernel's BPF subsystem related to handling map BTF references in the memory allocator destructor record. The flaw occurs when a map's BTF reference is released prematurely while deferred work still accesses it, leading to a kernel slab-use-after-free error. This issue affects certain Linux kernel versions prior to 6.13 and 6.19, as well as version 7.0. The vulnerability has been fixed by ensuring the map BTF reference is held until the duplicated record is fully freed during deferred destruction.
A slab-out-of-bounds read vulnerability exists in the Linux kernel's mac80211 wifi subsystem in the ieee80211_monitor_select_queue() function. The flaw arises because the function validates packet length using skb->len, which includes non-linear fragments, but then dereferences pointers assuming linear data, potentially reading beyond the allocated buffer. This issue also affects ieee80211_validate_radiotap_len() and ieee80211_monitor_start_xmit() functions. The vulnerability has been fixed by checking the linear data length instead of the total skb length before accessing skb->data pointers.
A slab-out-of-bounds memory access vulnerability in the Linux kernel's mlx5 driver was fixed. The issue occurred when handling team device events, where bonding-specific APIs were incorrectly called on team_port structures, causing out-of-bounds access detected by KASAN. The fix ensures bonding-specific functions are only called for actual bonding devices, preventing memory errors.
A vulnerability in the Linux kernel's octeontx2-pf driver related to BPID assignment when CONFIG_DCB is enabled has been fixed. The issue was due to an assumption that the queue_to_pfc_map was always initialized, which could lead to invalid memory access for SDP VFs. The fix adds a NULL check before dereferencing queue_to_pfc_map and simplifies the assignment logic.
A use-after-free vulnerability was identified and fixed in the Linux kernel's page_pool_recycle_ring_bulk() function. The issue occurs when page_pool_recycle_ring_bulk() updates recycle statistics after releasing a lock, potentially allowing the pool to be freed prematurely during destruction. This flaw affects Linux kernel version 6.14 and has been addressed in subsequent commits.
A vulnerability in the Linux kernel's stmmac network driver affects the handling of received frames larger than the DMA buffer size. The flaw causes the DMA to write overflow data into an unmapped secondary buffer address, triggering an SMMU translation fault on IOMMU-based platforms. This occurs because the secondary RX buffer was not allocated for regular frames, only when split-header mode was active. The issue has been fixed by enabling scatter-gather support for non-split-header frames on certain cores, properly allocating and marking the secondary buffer as valid, and adjusting buffer length computations and frame trimming.
A vulnerability in the Linux kernel's segment routing (seg6) code allows modification of packet data without ensuring it is writable. Specifically, advance_nextseg() and seg6_next_csid_advance_arg() functions modify the SRH Segments Left field and IPv6 destination address without verifying writability, potentially altering cloned packets shared with AF_PACKET sockets. This can cause a read from such a socket to return a modified packet instead of the original. The issue is fixed by adding skb_ensure_writable() calls before modifications, which may reallocate packet data. The fix is implemented in specific commits.
A vulnerability in the Linux kernel related to the SO_RESERVE_MEM socket option has been resolved. The issue involved improper handling of SO_RESERVE_MEM on UDP sockets, which are only supported for TCP sockets. This could lead to memory accounting corruption due to concurrent access and lack of proper locking. Additionally, there was no upper bound on the SO_RESERVE_MEM value, allowing values near INT_MAX to cause integer overflows and memory corruption. The fix restricts SO_RESERVE_MEM usage to TCP sockets and caps the maximum value to 1GB.
A use-after-free vulnerability in the Linux kernel's BPF trampoline program handling was fixed by ensuring that freeing trampoline programs waits for an RCU tasks grace period. This prevents tasks that were preempted in the trampoline from accessing freed memory, which could cause kernel crashes or memory corruption.
A vulnerability in the Linux kernel's BPF trampoline handling could lead to use-after-free conditions when BPF programs are detached while still in use by tasks. This occurs because detached BPF programs are freed after grace periods without accounting for tasks sleeping in other BPF programs within the same trampoline image. The issue has been fixed by introducing patchable no-op instructions before each program call to safely skip detached programs. This fix prevents kernel crashes caused by tasks resuming execution in freed program memory.
CVE-2026-98797 is a vulnerability in the Linux kernel's network stack involving improper handling of skb->queue_mapping during packet transmission. The flaw allows a local user with CAP_NET_ADMIN in a network namespace to redirect packets from a device with more TX queues to one with fewer, causing out-of-bounds access in the taprio_enqueue function. This occurs because stale queue_mapping values from the ingress device are used by the egress device, leading to potential memory corruption. The issue is fixed by properly capping skb->queue_mapping and managing related flags during packet transmission.