A vulnerability in the Linux kernel's IPv6 fragment reassembly code allows heap corruption due to stale metadata usage. This occurs when fragment queues are not properly invalidated before flushing, leading to out-of-bounds memory access. The flaw can be leveraged for local privilege escalation in environments with unprivileged network namespaces. The issue has been resolved by properly killing incomplete queues and flushing all queues owned by the dying rhashtable.
A use-after-free vulnerability was resolved in the Linux kernel's idpf driver. The issue occurs because the driver does not properly drain Tx/Rx Dynamic Interrupt Moderation (DIM) work before freeing the associated q_vectors memory, leading to potential execution of work on freed memory. This race condition can cause invalid memory access during network interrupt handling. The vulnerability affects specific versions of the linux-hwe-edge kernel. No configuration is required to trigger the issue, and it is a timing-dependent race rather than deterministic. The severity is assessed as medium.
A use-after-free vulnerability in the Linux kernel's framebuffer device (fbdev) virtual framebuffer (vfb) driver was resolved. The issue occurs because the colormap is freed immediately after unregistering the framebuffer, even if an open file still holds a reference, leading to a potential use-after-free during an ioctl operation. The fix defers cleanup until the last reference is released, preventing concurrent access to freed memory.
A vulnerability in the Linux kernel's erofs filesystem component related to LZMA decoder handling during pool resize has been resolved. The issue involved improper management of decoder streams when allocation failures occurred, potentially leaving invalid decoder states unrepaired. This could affect the stability of LZMA mounts using erofs. The fix ensures that replacements are allocated before freeing old decoders and that the global maximum dictionary size is only advanced after successful allocation for all streams.
A memory leak vulnerability was identified and fixed in the Linux kernel's autofs filesystem component. The issue occurred in the autofs_fill_super() function where a newly created inode was not freed upon failure to create the root inode, leading to a memory leak. This flaw has been resolved by adding proper cleanup code to free the inode on failure.
A vulnerability in the Linux kernel's vdpa ifcvf driver was resolved by ensuring that devices with unsupported features are properly handled through a common error path. This fix guarantees that allocated device and adapter pointers are consistently released after vdpa_alloc_device() when unsupported features are encountered.
A vulnerability in the Linux kernel's netfilter logging subsystem (nf_log) allows a race condition during logger unregistration. This occurs because global logger backends are unregistered after per-network namespace operations, leaving a window where a sysctl or netlink writer can rebind a still-registered logger. This can lead to dereferencing a stale pointer, potentially causing system instability or security issues. The issue is fixed by changing the order of unregistration to remove global logger backends before per-net teardown.
A use-after-free vulnerability in the Linux kernel's netfilter cttimeout module was resolved. The issue occurs during module unload when the timeout hook dereference and policy lookup are not properly synchronized, allowing access to freed memory. The fix involves clearing the hook and waiting for existing readers before unregistering per-net operations, preventing new lookups and ensuring safe memory access.
A vulnerability in the Linux kernel's netfs component was fixed where an uninitialized return value in netfs_unbuffered_write() could cause incorrect error reporting during synchronous writes. This occurs if preparation of the first subrequest fails, such as through CIFS when cifs_prepare_write() fails to reopen the file or obtain credits. The fix initializes the return value to ensure the caller receives the correct error or byte count.
A use-after-free vulnerability in the Linux kernel's Open vSwitch (OVS) flow table mask array was resolved. The issue occurs because the old mask array is retired before it is no longer reachable, causing a window where readers may access freed memory. This can lead to memory corruption and potential system instability.
A vulnerability in the Linux kernel's MPLS networking code allows stale inner network header information to persist after MPLS labels are popped. This can lead to out-of-bounds memory access and kernel crashes when Open vSwitch re-pushes MPLS labels on packets with outdated header offsets. The issue arises because skb_mpls_pop() does not clear the inner_protocol field, causing subsequent operations to use invalid offsets. This flaw has been resolved by clearing inner_protocol when the last MPLS label is removed.
A vulnerability in the Linux kernel's MANA network driver was resolved by reserving an extra completion queue (CQ) slot for the fence completion CQE. Previously, the RX completion queue was sized to hold exactly one CQE per posted RX WQE, but the hardware posts an additional CQE_RX_OBJECT_FENCE which was not accounted for, potentially causing the fence completion CQE to be dropped. This could lead to the driver waiting while holding the RTNL lock for the duration of a timeout. The fix involves rounding up the CQ size to accommodate the extra CQE slot.
A vulnerability in the Linux kernel's net: dsa: tag_brcm legacy FCS tagger causes out-of-bounds memory reads when processing nonlinear socket buffers (skbs). This occurs because the tagger calculates the CRC over skb->len bytes starting at skb->data without properly declaring required tailroom, leading to reads past the linear head into unrelated slab memory. The issue is fixed by declaring the required tailroom and clearing certain features so that skbs are linearized before CRC calculation.
A vulnerability in the Linux kernel's network bridge code involving CFM and MRP frame handlers has been resolved. The issue arises because CFM and MRP register a global frame type node that is linked into multiple bridge lists, causing list corruption when unregistered on one bridge. This affects uncommon protocol handlers that can only be installed once per bridge. The fix involves tracking per-bridge enable state with option bits and removing the shared list structure, improving both correctness and performance.
A vulnerability in the Linux kernel's net/sched subsystem (CVE-2026-97616) involves improper release of action references during a batched RTM_NEWACTION request failure. Specifically, when a new action fails to initialize after replacing an existing one, certain temporary references are not released properly, causing resource leaks. This issue affects specific linux-aws kernel versions and has been resolved by adjusting the cleanup logic to ensure all references are released correctly.
A vulnerability in the Linux kernel's ring-buffer subsystem was resolved by ensuring that the resize_disabled state is checked before publishing a new sub-buffer order. The flaw involved storing the new order before verifying if any CPUs had resizing disabled, which could lead to race conditions when a user-mapped buffer is resized concurrently. This could cause the memory mapping to be resized incorrectly, potentially leading to memory corruption.
A vulnerability in the Linux kernel's io_uring/net subsystem was resolved that caused overconsumption of buffers when using recv/recvmsg with the MSG_TRUNC flag. When the incoming packet is larger than the provided buffer, the net layer incorrectly returns the full packet length instead of the actual copied bytes, leading io_uring to advance the buffer ring more than it should. This issue affects specific versions of linux-hwe-edge kernel. The vulnerability has been fixed to correctly consume only the filled buffer region while preserving MSG_TRUNC semantics.
A vulnerability in the Linux kernel's io_uring write accounting mechanism was resolved by changing where the write accounting ends. Previously, deferring the write accounting to task_work caused a deadlock with the superblock freeze mechanism, potentially blocking completion of writes. The fix moves the write accounting end to io_complete_rw(), preventing this deadlock condition.
A vulnerability in the Linux kernel's drm/xe component related to cache flushing was resolved. The issue involves the kernel not properly flushing the LSC untyped L1 dataport cache after certain GPU command batches, which could lead to stale data leakage when memory is reclaimed or evicted. This flaw affects newer Intel GPU platforms starting with Meteor Lake (MTL) and later, where hardware no longer couples the L1 cache flush with the pipeline flush as it did on earlier platforms. The fix explicitly sets the cache flush bit on affected platforms to ensure the L1 cache is clean before memory reuse.
A vulnerability in the Linux kernel's drm/rockchip analogix_dp driver allows a stack buffer overflow due to unchecked length of the endpoint name. The function rockchip_dp_drm_encoder_enable() uses sprintf() to write a device tree path into a fixed 32-byte buffer without length checks, which can overflow if the path is too long. This issue has been resolved by replacing sprintf() with snprintf() to ensure the buffer is not overflowed.