A vulnerability in the Linux kernel's net/sched cls_route component causes a memory leak by not freeing emptied buckets when filters are moved between buckets. This occurs because the bucket is not freed after the last filter is unlinked, leading to stale empty buckets remaining in memory. The issue affects specific linux-aws kernel versions and has been resolved by adding reference counting to free buckets when no filters remain.
A vulnerability in the Linux kernel's perf subsystem for x86 Intel processors allows reentry into the drain_pebs() function, which manages the PEBS buffer shared by all CPU events. This reentry can cause stale buffer state observation and potential out-of-bound memory access. The issue arises because drain_pebs() can be called from process context without fully disabling the PMU, allowing interrupts that lead to reentry. The vulnerability has been resolved by introducing helpers to disable the full PMU during critical operations, preventing reentry.
A vulnerability in the Linux kernel's perf/core subsystem could lead to list corruption during perf_event_overflow() processing. This occurs because the code uses an unsafe list traversal method (for_each_list_entry) that does not handle concurrent removal of list entries, potentially corrupting the sched_cb_list. The issue arises when ioctl(fd, PERF_EVENT_IOC_REFRESH, xxx) is invoked and the event_limit reaches zero, triggering removal of list entries while they are still in use. The vulnerability has been resolved by changing the list traversal to a safe variant (for_each_list_entry_safe) to prevent corruption.
A vulnerability in the Linux kernel's mlx5e network driver was resolved by moving the representor vnic health reporter lifecycle management to the eswitch devlink port register/unregister paths. Previously, the reporter was created and destroyed along the representor netdev load/unload path without proper serialization, causing a kernel warning and potential instability during driver unbind. The fix ensures proper serialization by using the devlink instance lock and stores the reporter handle on mlx5_devlink_port.
A vulnerability in the Linux kernel's stmmac network driver involves the improper initialization timing of the ptp_lock read-write lock. The lock was only initialized during interface open operations but is used even when the interface is down, leading to undefined behavior due to use of an uninitialized lock. The issue has been resolved by initializing the ptp_lock at probe time to ensure it is always valid.
A vulnerability in the Linux kernel's ppp_synctty component was resolved. The function ppp_sync_txmunge() did not ensure the socket buffer (skb) header was writable before modifying it, potentially allowing data corruption when bridging PPP channels. This could occur if a received skb bypassed the usual writable checks, such as when a PPPoE frame shares its buffer with a clone queued to an AF_PACKET socket and is bridged to a synchronous tty channel. The fix involves using skb_cow_head() to guarantee both sufficient headroom and a writable header.
A vulnerability in the Linux kernel's VXLAN implementation (CVE-2026-97965) involves uninitialized stack memory being used when certain VXLAN device flags are set and specific tunnel options are missing. This can cause uninitialized kernel stack data to be leaked in the VXLAN header on the network. The issue is fixed by zero-initializing the relevant metadata structure.
A vulnerability in the Linux kernel's octeontx2-pf component related to the HTB scheduler topology handling has been resolved. The issue involved improper clearing of topology settings when freeing scheduler queues, potentially causing residual priority settings to persist and affect later allocations. The fix involves resetting the topology for certain scheduler queue levels during teardown and configuration rollback. This vulnerability affects specific versions of the linux-hwe-edge kernel.
A vulnerability in the Linux kernel hwmon subsystem (corsair-cpro driver) was resolved where debugfs entries were not removed if the probe failed. This caused stale debugfs files to reference freed memory, leading to potential use-after-free conditions when accessed. The fix ensures debugfs entries are removed on error paths to prevent access to freed pointers.
A vulnerability in the Linux kernel hwmon subsystem (corsair-cpro driver) was resolved by changing the timing of debugfs entry creation to occur after hwmon device registration. Previously, debugfs entries were created before device registration, and if registration failed, the entries remained referencing freed memory, leading to potential use-after-free when accessed. The fix ensures debugfs entries are only created after successful device registration, preventing stale references.
A vulnerability in the Linux kernel watchdog driver for msc313e was resolved. The issue involved the msc313e_wdt_settimeout() function unconditionally calling msc313e_wdt_start(), causing two bugs: an unbalanced clock reference count when the watchdog is already active, and accidental starting of the hardware timer when the watchdog is stopped. The fix involved refactoring the register-writing logic to only start the timer if the watchdog is running, otherwise just updating the timeout value.
A vulnerability in the Linux kernel watchdog driver for msc313e could cause a division by zero panic due to clk_get_rate() returning zero. This issue has been resolved in specific linux-hwe-edge versions.
A vulnerability in the Linux kernel's namespace handling (CVE-2026-97971) was resolved. The issue involved taking a reference on a candidate namespace before verifying listing permissions, which could lead to a voluntary context switch within an RCU read-side critical section, potentially causing kernel instability. This flaw was fixed by ensuring permission checks occur before taking references, preventing improper reference dropping while holding RCU locks.
A vulnerability in the Linux kernel's macb network driver caused a memory leak by not releasing a reference to the 'mdio' child node on successful initialization. This issue was fixed by ensuring the reference is dropped after registration, preventing the leak. The affected versions include specific builds of linux-hwe-edge kernel versions 3.11.0-12.19 through 3.13.0-8.28.
A vulnerability in the Linux kernel's macb network driver was resolved. The issue involved a resource leak where the phylink instance created during initialization was not destroyed on certain probe error paths, leading to a memory leak. This was fixed by ensuring the phylink instance is properly destroyed during error handling.
A null pointer dereference vulnerability was identified and resolved in the Linux kernel's IPv6 routing code, specifically in the __ip6_del_rt_siblings() function. The issue arises due to a missing null check on fib6_node, which can be set to NULL during concurrent route modifications without proper locking. This can lead to a kernel crash or denial of service when accessing a null pointer. The vulnerability affects specific versions of the linux-hwe-edge kernel. A fix has been implemented to add the necessary null check before accessing fib6_node.
A race condition vulnerability in the Linux kernel's Bluetooth subsystem (hci_sysfs) causes a NULL pointer dereference in device_del() due to concurrent unregistration and reparenting of child devices. This issue arises from improper handling of device references during device removal, leading to a stale pointer dereference. The flaw was introduced by a prior commit intended to fix a use-after-free but inadvertently caused this race. The fix involves holding an explicit reference to the parent device throughout the child's lifecycle and restoring a filtering condition to prevent the race condition.
A vulnerability in the Linux kernel Bluetooth driver btintel_pcie was resolved. The issue involved the function btintel_pcie_submit_rx_work() reading a packet length value without validating if it exceeded the receive buffer size, potentially causing an out-of-bounds read. The fix adds validation to ensure the packet length is non-zero and does not exceed the buffer size, logging an error if invalid. This vulnerability affects specific linux-hwe-edge kernel versions.
A use-after-free (UAF) vulnerability in the Linux kernel Bluetooth driver (btusb) was resolved. The issue arises because asynchronous cancellation of delayed work does not guarantee that the work has stopped before the associated data is freed, leading to potential dereferencing of freed memory. This occurs during Bluetooth device disconnection and closing operations. The fix involves using synchronous cancellation of delayed work and reordering operations to prevent race conditions.
A vulnerability in the Linux kernel's ice network driver was resolved to prevent dereferencing invalid pointers in TP_printk() trace events. The issue involved double dereferencing pointers after event recording, which could lead to invalid memory access when printing trace events. This was fixed by copying scalar values into the event instead of dereferencing pointers later.