CVE-2026-98642 is a use-after-free (UAF) vulnerability in the Linux kernel's BPF subsystem caused by concurrent access to ttrace lists in the alloc_bulk function. The flaw arises from a race condition between the __free_rcu() callback and alloc_bulk() operations on waiting_for_gp_ttrace and free_by_rcu_ttrace lists, leading to unsafe memory access. The issue has been fixed by adding a raw spinlock to synchronize these concurrent operations.
A vulnerability in the Linux kernel's BPF subsystem on arm64 architecture involves improper setup of the frame pointer for the exception callback. This flaw can cause a helper function to write over its own return address, potentially leading to a kernel panic due to a fatal exception in interrupt context. The issue arises because the frame pointer register (x25) is not correctly set during exception callbacks, causing stack accesses to reference invalid memory frames.
A vulnerability in the Linux kernel's amd_sfh driver allows out-of-bounds memory access due to lack of validation of PCI BAR 2 size before mapping. This can cause a page fault during device probe if the BAR size is smaller than expected. The issue is fixed by verifying the BAR size is at least 128KB before mapping.
A vulnerability in the Linux kernel's KVM implementation for RISC-V was fixed by correcting the order of updates to the nested HFENCE entry. The improper update order could cause the SBI implementation or NACL hardware to observe stale page number and count values, leading to incorrect TLB flush ranges.
A vulnerability in the Linux kernel's KVM arm64 code allows an invalid SVE vector length to reach a fatal condition at EL2 due to insufficient validation in pkvm_vcpu_init_sve(). This issue has been fixed by adding proper validation of the vector length before calculating the state size.
A vulnerability in the Linux kernel's KVM arm64 implementation involves improper handling of the Scalable Vector Extension (SVE) feature flag during virtual CPU initialization failures. Specifically, when pkvm_vcpu_init_sve() fails, it clears the KVM_ARM_VCPU_SVE flag but does not clear the KVM_ARCH_FLAG_GUEST_HAS_SVE flag, causing subsequent vCPUs to skip proper SVE setup and register with a NULL sve_state. This can lead to issues when the guest performs its first floating-point access.
A vulnerability in the Linux kernel's squashfs subsystem allows a shift-out-of-bounds error when mounting an abnormal SquashFS image with specific compression options. This occurs if the COMP_OPTS flag is set to 1 but the dictionary size is 0, leading to an invalid shift exponent of -1. The issue has been fixed by adding a dictionary size range check before the shift operation.
A vulnerability in the Linux kernel's SCSI block subsystem allows an out-of-bounds write in the zones_cond array during zone report processing. This occurs when a device reports more zones than the array can hold, particularly if the zone count exceeds 32 bits, causing an undersized array and unchecked index writes. The issue has been fixed by validating the index against the array size and refusing to revalidate when the zone count is too large.
A vulnerability in the Linux kernel's SCSI subsystem (sd_zbc) involves improper handling of disks reporting an excessive number of zones. The kernel's sd_zbc_read_zones() function truncates zone counts exceeding 32 bits, leading to inconsistent zone resource allocation. Additionally, sd_zbc_report_zones() uses a signed integer for zone indexing, which can overflow for devices reporting more than INT_MAX zones. The kernel now rejects such devices at scan time to prevent inconsistent zone bookkeeping.
A vulnerability in the Linux kernel Bluetooth btnxpuart driver causes a socket buffer (skb) memory leak when CONFIG_DEV_COREDUMP is disabled. This occurs because hci_devcd_append() returns an error without freeing the skb, preventing recovery functions from executing. The issue has been fixed by conditionally calling hci_devcd_append() only when CONFIG_DEV_COREDUMP is enabled.
CVE-2026-98632 is a use-after-free vulnerability in the Linux kernel's Bluetooth mesh management code. It occurs when pending mesh transmission objects are canceled but still referenced by queued work entries, leading to dereferencing freed memory. The flaw is fixed by properly dequeuing and completing these entries to avoid use-after-free conditions.
A vulnerability in the Linux kernel's xsk_map_gen_lookup function allows an out-of-bounds read due to improper comparison of a 32-bit key against max_entries. The issue arises because BPF_JMP_IMM sign-extends immediates to 64 bits, causing the bounds check to be bypassed for large max_entries values. This flaw has been fixed by changing the comparison to use a 32-bit unsigned check.
A vulnerability in the Linux kernel's fbnic network driver involves improper cleanup of the payload page pool when allocation fails. The error pointer is incorrectly passed to page_pool_destroy(), potentially causing a dereference of an error pointer and leaving the header page pool allocated. This issue has been fixed by ensuring the header page pool is properly destroyed during cleanup.
CVE-2026-98629 is a vulnerability in the Linux kernel's net/sched cls_u32 component involving improper handling of manual hash table handles that causes IDR aliasing. This flaw leads to permanent resource leaks and potential misrouting of network traffic due to handle collisions between manual and auto-allocated tables. The issue affects certain Linux kernel versions prior to fixed releases and has been resolved by aligning allocation and removal key domains and rejecting conflicting manual handles.
A vulnerability in the Linux kernel's BPF verifier post-verification instruction rewrite process could cause a privileged loader task to become unkillable during lengthy rewrites. The issue arises because the rewrite passes do not check for signals or reschedule, preventing termination signals like SIGKILL from interrupting the task. The fix introduces cancellation and rescheduling points to make the rewrite process preemptible, allowing prompt termination of killed loaders.
A vulnerability in the Linux kernel's BPF subsystem involves improper handling of packet pointer class displacement in the regsafe() function. The flaw allows an out-of-bounds packet access due to unsound preservation of displacement between registers sharing a packet pointer ID. This issue has been fixed in specific commits.
CVE-2026-98626 is a vulnerability in the Linux kernel's BPF CO-RE (Compile Once - Run Everywhere) relocation handling. It involves improper poisoning of instructions when relocation cannot be resolved, allowing malformed metadata to replace critical instructions such as jumps, calls, and exits. The issue has been fixed by restricting poisoning only to relocatable instructions and validating instruction forms before poisoning. The fix applies to both libbpf and in-kernel CO-RE code.
A use-after-free vulnerability was identified and resolved in the Linux kernel's netfilter flowtable component. The issue arises from improper ordering of state flags (HW_DEAD and HW_PENDING) during flow offload worker execution, which can lead to premature freeing of flow objects while still in use. This flaw affects Linux kernel version 5.7 and has been fixed in subsequent commits.
A concurrency issue in the Linux kernel's netfilter nfnetlink_queue subsystem was fixed by ensuring the nfnl mutex is held in the event notifier. This prevents parallel UNBIND and URELEASE events that could cause a general protection fault (kernel crash). The fix serializes release notifier and config netlink functions to avoid race conditions during socket close and unbind operations.
A use-after-loop vulnerability in the Linux kernel's drm/nouveau/clk component was fixed. The issue arises when the function nvkm_clk_ustate_update uses a list cursor incorrectly if the loop exits without a break, leading to an invalid pointer dereference. This can be triggered from userspace via the 'pstate' debugfs file by requesting an invalid pstate id, causing an out-of-bounds read.