CVE-2026-99173 is a use-after-free vulnerability in the Linux kernel's eventfs subsystem. It occurs because the eventfs_inode is freed after an SRCU grace period, which does not wait for rcu_read_lock() sections, allowing a pathwalk to access a freed eventfs_inode. This can lead to a kernel slab-use-after-free error detected by KASAN.
A vulnerability in the Linux kernel's IPC subsystem related to the mqueue mount handling was fixed. The issue involved improper cleanup of the mqueue mount on setup failure, causing a resource leak of the mount and superblock. The fix involves using kern_unmount() to properly drop the mqueue mount in failure scenarios.
A use-after-free vulnerability exists in the Linux kernel's ntfs3 filesystem driver related to improper handling of the superblock private information during unmount. The issue arises because ntfs_put_super() and ntfs3_kill_sb() drop the superblock info without an RCU delay, causing a use-after-free when a lookup is still active. The fix introduces an RCU callback to delay freeing the superblock info, preventing the use-after-free condition.
CVE-2026-99170 is a Linux kernel vulnerability involving mount namespaces where a mount that copy_tree() omits can improperly take over a lock. This allows a root task in its own user namespace to remove a locked cover on a file without a race condition or modifying the underlying filesystem. The issue arises from how locked mounts of mount namespace files are handled during mount tree copying and moving. The vulnerability has been fixed by refusing to leave out or move locked mounts of mount namespace files, preventing unshare() failures and unauthorized mount manipulations.
A vulnerability in the Linux kernel's futex subsystem related to FUT_OFF_MMSHARED futexes has been fixed. The issue allowed processes to wait on shared futexes linked to a freed memory management structure (MM), potentially causing wakeups intended for new MMs to be consumed incorrectly. The fix involves using a unique 64-bit ID per MM to key FUT_OFF_MMSHARED futexes, preventing cross-MM wakeup consumption.
A vulnerability in the Linux kernel's mshv_vtl component involves improper checking of per-CPU register pages before memory mapping. This can lead to a NULL pointer dereference when userspace faults in the mapping for a CPU without a register page. The issue arises because the global flag indicating register page presence is set if any CPU has a register page, but individual CPU pages may be NULL. The flaw has been fixed by adding a check for the selected per-CPU register page before referencing it, returning a VM_FAULT_SIGBUS if absent.
A use-after-free vulnerability in the Linux kernel's net/sched subsystem was fixed in the __tcf_action_put() function. The flaw occurs because the function decrements the reference count before the binding count, allowing another thread to free the action prematurely. This leads to an access of freed memory, which is detected by KASAN as a slab-use-after-free error.
A vulnerability in the Linux kernel's RDS subsystem causes a kernel crash due to an uninitialized pointer dereference in the RDMA CM event handler when handling connect requests on non-InfiniBand RDMA devices such as iWARP. This flaw leads to a NULL pointer dereference and kernel oops, crashing the system. The issue arises because the transport pointer is only assigned for InfiniBand devices, but is dereferenced unconditionally for other device types. The fix initializes the transport pointer explicitly, rejects connect requests on non-IB devices, and prevents route resolution on such devices.
A vulnerability in the Linux kernel SCTP implementation allows a NULL pointer dereference leading to a kernel panic. This occurs when message interleaving is enabled and the first send waits for association establishment, during which the output stream count can be reduced and extensions freed. Subsequent sending operations may dereference a NULL extension, causing a fatal kernel panic.
A vulnerability in the Linux kernel spi: imx driver caused slab corruption due to undersized DMA bounce buffers. The driver allocated DMA buffers smaller than the size used for DMA operations, leading to memory corruption and kernel crashes under heavy load. This issue was fixed by aligning buffer allocation size with the DMA mapping size.
A vulnerability in the Linux kernel's tracing/histograms subsystem allows improper handling of synthetic stacktrace fields. Specifically, non-stacktrace fields can be incorrectly accepted as stacktrace fields, leading to dereferencing of scalar values as kernel stacktrace pointers. This flaw affects certain Linux kernel versions and has been fixed in later releases.
A use-after-free (UAF) vulnerability was identified and fixed in the Linux kernel's GPIO shared proxy handling. The issue involved the GPIO lookup table outliving the kobject whose name string address was assigned to lookup->dev_id, potentially causing a UAF condition. The fix involved duplicating the string to prevent this unsafe memory reference.
A resource leak vulnerability was identified and fixed in the Linux kernel's viai2c-wmt driver. The issue involved the clock reference count not being decremented properly in the wmt_i2c_probe() function, leading to a clock leak. The fix involved switching from manual clock management with of_clk_get() to automatic management using devm_clk_get().
A vulnerability in the Linux kernel's ring-buffer implementation causes a NULL pointer dereference when accessing buffer_meta files for CPUs that never came online. This occurs because buffer_meta files are created for all possible CPUs, but the underlying buffer is only allocated when the CPU is online. The issue has been fixed by failing the open operation with -ENODEV for CPUs without a buffer.
A vulnerability in the Linux kernel's ring-buffer implementation was fixed in version 6.12. The function rb_meta_subbuf_idx() could return an incorrect sub-buffer index, causing an off-by-one error that led to a NULL pointer dereference when userspace mapped trace_pipe_raw. This flaw affected the handling of persistent ring buffers and could cause the loss of trace data from previous boots.
A vulnerability in the Linux kernel's ring buffer handling was fixed to address a false warning triggered by the mmap reader when it catches up with a writer still committing events. The issue involved incorrect error treatment of a NULL return from rb_get_reader_page(), leading to unnecessary warnings. The fix ensures that NULL is handled gracefully without warning and removes redundant checks.
A buffer overflow vulnerability in the Linux kernel's SCSI bsg interface was fixed by adjusting the reply buffer size to accommodate larger UFS ARPMB replies. The original buffer was 96 bytes, but the UFS RPMB reply structure requires 104 bytes, causing an 8-byte overflow when handling Advanced RPMB commands.
A use-after-free race condition was identified and fixed in the Linux kernel's SCSI tape driver (st). The issue occurred due to improper ordering in st_remove() where the scsi_tape structure could be freed while still accessible via an index, leading to potential use-after-free during concurrent open operations.
A vulnerability in the Linux kernel's xen/scsifront driver allows a malicious or buggy backend to cause a guest system crash by sending a backend response with an invalid request ID (rqid). The flaw occurs because the driver dereferences a NULL shadow entry without checking if it is populated, leading to a NULL pointer dereference. This issue affects Linux kernel version 5.19 and has been fixed in subsequent commits.
A vulnerability in the Linux kernel's libiscsi SCSI subsystem allows a negative task index to be used in parse_pdu_itt, leading to an out-of-bounds read from the session commands array. This occurs because the index is only bounded from above, not below, allowing negative values to access memory before the array. The issue is related to the beiscsi driver forwarding unsolicited NOP-In PDUs without properly sanitizing the ITT value. The flaw has been fixed by adding a lower bound check on the index in the relevant lookups.