A memory leak vulnerability in the Linux kernel's clear_inode() function has been resolved. The issue involved a hard-to-hit leak of xarray nodes, which could be triggered by certain operations such as madvise. The fix involves freeing excess xarray nodes by calling xa_destroy(), which also cycles the i_pages lock.
A critical vulnerability in the Linux kernel's mlx5e network driver allows stale XSK buffers to be released during refill retries when an XDP redirect to an AF_XDP socket fails due to a full RX ring. This can cause double publication of UMEM frames, leading to potential memory corruption and data integrity issues. The flaw is silent and does not produce kernel warnings. It was detected under high packet load conditions and has been resolved by marking WQEs as released immediately after driver-side free to prevent stale pointer usage.
CVE-2026-99078 is a critical vulnerability in the Linux kernel's mlx5e network driver related to AF_XDP zero-copy buffer management. It involves a flaw where stale XSK buffers may be released multiple times during MPWQE refill retries, potentially causing memory corruption. The issue occurs when buffer allocation fails with -ENOMEM, leading to improper handling of buffer release bitmaps. This flaw has been resolved by ensuring idempotent retries through proper bitmap management.
CVE-2026-99077 is a vulnerability in the Linux kernel's IPv4 UDP implementation where exceptions in the FIB nexthop exception (FNHE) cache are only created after matching a UDP packet to an existing socket. This allows off-path attackers to perform side-channel attacks to discover ephemeral UDP ports. Previous mitigations were bypassable. The fix involves always creating FNHE entries before socket matching, ensuring that attacker guesses always result in cache updates, preventing reliable side-channel discovery.
A vulnerability in the Linux kernel's IPv6 UDP handling allows off-path attackers to conduct side-channel attacks on the IPv6 exception cache to discover ephemeral UDP ports. The issue arises because exceptions are only created in the cache if a matching socket is found, enabling attackers to infer port usage. The vulnerability has been addressed by changing the kernel to always create exceptions before socket matching, preventing this side-channel. This fix may cause additional route lookups and exceptions but does not introduce new exception creation capabilities beyond previous behavior.
A vulnerability in the Linux kernel's rust_binder component causes a node's delivery and count state to become desynchronized when a thread exits while holding a pending node refcount increment. This occurs because the refcount increment is dropped due to no-op cancel functions, potentially causing the node to never be freed from the process's nodes tree after all external references are dropped. The issue is fixed by rescheduling the pending refcount update to the process's work queue on thread exit.
A vulnerability in the Linux kernel's IPv4 implementation allows a null pointer dereference during Path MTU (PMTU) updates when a nexthop group shrinks. This occurs because the code does not properly handle cases where the nexthop group size changes concurrently, leading to a kernel crash (KASAN null pointer dereference). The issue requires CAP_NET_ADMIN privileges in the network namespace, but can be exploited by local users in unprivileged user namespaces.
A vulnerability in the Linux kernel IPv4 implementation could cause an exception dump when a nexthop group shrinks during concurrent routing table dumps. This occurs due to a race condition where the nexthop group size changes between two related function calls, leading to a NULL pointer dereference. The issue has been resolved by stopping the walk when the indexed path is absent.
A vulnerability in the Linux kernel's IPv4 routing notification mechanism could cause a null pointer dereference when a nexthop group shrinks during route notification sizing. This occurs because the code does not properly handle the case where the nexthop group has fewer paths after an update, leading to a potential crash or instability. The issue has been resolved by stopping the sizing process when the indexed path is absent.
This vulnerability in the Linux kernel concerns a warning triggered by a race condition in route notification size handling. The issue arises when asynchronous route notifications for hardware flag changes are processed, potentially causing a legitimate size error that was previously misinterpreted as a bug. The fix removes the warning while maintaining error handling and notification to listeners.
A Linux kernel vulnerability related to IPv6 route notification size warnings has been addressed. The issue involves a race condition in fib6_info_hw_flags_set() where skb sizing and filling operations can mismatch due to concurrent changes, causing incorrect warnings. The fix removes the misleading warning while preserving error handling.
A type confusion vulnerability was fixed in the Linux kernel's ati_remote2 input driver. The issue involved device attribute handlers incorrectly using to_usb_device() on a usb_interface pointer, leading to invalid pointer usage. This was due to a change in how device attributes were managed, moving from the parent usb_device to the bound usb_interface devices without updating the callbacks accordingly.
A memory leak vulnerability in the ALSA ctxfi component of the Linux kernel was fixed. The issue occurred because the function dao_clear_input() removed mapper entries without freeing the allocated memory, causing a leak each time it was called. The fix involves properly freeing the allocated array after clearing the entries.
A reference leak vulnerability exists in the Linux kernel's btrfs filesystem scrub functionality. Specifically, the function scrub_print_warning_inode() fails to drop a local_root reference when paths_from_inode() fails, causing a reference leak. This issue occurs during error handling when printing scrub warnings, potentially leading to resource exhaustion over time.
A vulnerability in the Linux kernel's CAN network subsystem caused by missing skb header initialization can lead to a kernel panic. The issue arises because the skb_reset_mac_header(), skb_reset_network_header(), and skb_reset_transport_header() calls were removed, causing RX skbs to carry invalid header values. When these skbs reach packet_rcv_spkt(), an overflow in push length calculation triggers a kernel BUG and full machine panic. This flaw was originally reported in 2014 and has been reintroduced by a recent commit.
CVE-2026-99065 is a race condition vulnerability in the Linux kernel's cgroup cpuset subsystem related to CPU hotplug handling. The issue arises because the cpuset hotplug operation became synchronous, removing previous race handling code, but a subsequent change caused a race to reappear between cpu_active_mask updates and cpuset effective_cpus updates. This race can lead to the top cpuset having no active CPU, resulting in a NULL pointer dereference. The vulnerability affects specific Linux kernel versions and has been fixed by reintroducing a NULL check in guarantee_active_cpus().
A vulnerability in the Linux kernel's CIPSO option handling causes cached option offsets to become incorrect when CIPSO bytes are removed from a packet. This leads to consumers accessing wrong bytes, potentially causing incorrect interpretation and copying of packet data. The issue affects specific Linux kernel versions and has a high severity CVSS score of 8.1.
CVE-2026-99063 is a Linux kernel vulnerability in the device mapper ioctl interface where a buffer over-read can occur due to improper bounds checking of the data_start pointer relative to the buffer size. This flaw can cause a small out-of-bounds read of up to seven bytes past the allocated buffer. The issue arises because the struct dm_ioctl has trailing padding, and the kernel code does not clamp data_start to the actual buffer size. The vulnerability can only be triggered by root privileges and has been fixed by clamping data_start to the buffer size.
A vulnerability in the Linux kernel's vsock/virtio subsystem caused incorrect accounting of unread bytes in the read_skb() function. This led to underflow of the rx_bytes counter after partial stream receives, resulting in negative socket buffer indications, empty reads returning ELOOP, and misleading poll reports of socket readability. The flaw was fixed by adjusting the accounting to subtract only the unread portion of the packet, preventing counter underflow and ensuring accurate exposure of queued data.
A race condition vulnerability in the Linux kernel's brcmfmac WiFi driver can cause a kernel crash when the driver is removed while a user space process that created a P2P device (such as wpa_supplicant) is still exiting. This occurs due to the P2P device interface being removed twice, leading to a use-after-free fault and kernel panic.