A vulnerability in the Linux kernel's calipso_skbuff_setattr() function mishandles the payload length for large TCP packets using IPv6. This causes incorrect payload_len values when packets exceed IPV6_MAXPLEN, potentially affecting network functions relying on this field. The issue has been fixed in specific kernel commits.
A memory leak vulnerability was identified and fixed in the Linux kernel's gpiolib subsystem within the function gpiod_set_array_value_complex(). The issue occurs on error paths where allocated bitmaps may not be freed if gpiochip_set_multiple() fails, leading to potential memory leakage. This is considered an unlikely error path but is possible. The fix defers the return code check until after the bitmap_free() call to ensure proper cleanup.
A race condition vulnerability in the Linux kernel's mxc GPIO driver was fixed. The issue involved installing a chained IRQ handler before the IRQ domain and related data structures were fully initialized, which could lead to the handler accessing incomplete or freed memory. This could cause system instability or crashes. The fix moves the handler installation to after all dependencies are ready and ensures it is not installed if probe fails.
A vulnerability in the Linux kernel's stmmac driver for the dwmac1000 Ethernet controller causes a soft lockup and system hang during resume from low-power states. The issue arises because the RGMII status interrupt (GMAC_RGSMIIIS) is not cleared properly, leading to an interrupt storm that starves the CPU handling the MAC interrupt. This was fixed by restoring the read of GMAC_RGSMIIIS in the interrupt status handler to clear the pending interrupt.
A vulnerability in the Linux kernel's perf subsystem was fixed where the function perf_pmu_migrate_context() could leave some performance monitoring events behind during CPU hotplug operations. This caused events to continue running on a CPU that was being torn down, while migrated events and interrupts were active on a new CPU, violating driver assumptions.
A vulnerability in the Linux kernel's x86 instruction evaluation code caused incorrect handling of segment register overrides due to a variable shadowing issue. This flaw led to the function get_seg_reg_override_idx() always returning a default segment register, ignoring FS and GS overrides, and causing infinite loops with CS overrides. The issue could cause the kernel to spin indefinitely when handling certain user-space instructions, effectively tying up CPUs and preventing SIGKILL delivery. The flaw was fixed by renaming an internal macro iterator variable to avoid shadowing.
A race condition vulnerability in the Linux kernel's FireWire core split transaction handling was fixed. The flaw allowed both the response handler and the timeout callback to process the same transaction entry, potentially causing a use-after-free condition on the transaction initiator side. This issue was introduced by a code refactoring that broke the intended synchronization behavior. The fix ensures the response handler does not process the transaction if the timeout callback is already running, preventing double processing.
A vulnerability in the Linux kernel's accel/rocket driver causes an out-of-bounds write when cores are removed and rebound. The issue arises because the code decrements the core count prematurely, leading to an incorrect search range and a stale device reference. This results in writing past the allocated core array, which can cause undefined behavior. The flaw was identified during testing on an Orange Pi 5 Plus and has been fixed in specific commits.
A vulnerability in the Linux kernel's accel/rocket scheduler lookup logic causes a null pointer dereference when unbinding a core that is not the last one. The function sched_to_core() fails to search all core slots, leading to NULL returns for cores that are still bound and running jobs. This results in kernel address sanitizer (KASAN) null pointer dereferences during job execution and timeout handling. The issue is fixed by searching all allocated core slots, but unbinding a core out of several remains unsafe due to clients holding references to schedulers of removed cores.
A vulnerability in the Linux kernel's ASoC SOF ipc4-topology component caused a shift-out-of-bounds error when handling aggregated ALH capture streams with fewer channels than devices. This occurs due to an underflow in a bitmask calculation leading to an invalid shift operation. The issue has been fixed in Linux kernel version 6.3 by adjusting channel mask handling for such cases.
CVE-2026-99181 is a vulnerability in the Linux kernel's autofs component where notification errors from a replaced pipe were not properly handled. This flaw could cause a denial of service of the shared autofs service during a legitimate daemon restart. The issue does not lead to memory corruption, information leaks, privilege escalation, or code execution.
CVE-2026-99180 is a use-after-free vulnerability in the Linux kernel's unicode map handling. It occurs when filesystems like ext4, f2fs, and tmpfs access a unicode map after it has been freed following the last reference to a mount going away. This can happen during pathwalk operations in RCU mode, leading to a potential kernel bug detected by KASAN. The issue arises because the unicode map is freed without waiting for a grace period, allowing concurrent lookups to access freed memory. The fix delays freeing the map until after a grace period, ensuring safe access during pathwalks.
A race condition in the Linux kernel's watch_queue_set_size() function could lead to a NULL pointer dereference and kernel panic. This occurs due to unsynchronized publication of note pool data, allowing an unprivileged user to trigger a kernel crash by racing specific ioctl and key permission operations. The issue has been fixed by enforcing proper memory ordering with smp_store_release() and smp_load_acquire() operations.
CVE-2026-99178 is a vulnerability in the Linux kernel's x86 KVM subsystem involving improper handling of asynchronous page fault (async #PF) flags during nested page faults in non-maskable interrupt (NMI) context. This flaw can cause a kernel panic when an async page fault is consumed incorrectly in NMI context, leading to system instability. The issue was resolved by ensuring the async #PF flags are not consumed on a kernel page fault in NMI context, preserving the flags for the interrupted handler. The fix is included in Linux kernel versions 6.18.59 and 7.2.13 and later.
A vulnerability in the Linux kernel's KVM SEV component related to improper page dirtying in the sev_gmem_post_populate() function has been fixed. The issue involved the use of set_page_dirty() without holding the required lock, which could lead to race conditions with page mappings. The fix replaces set_page_dirty() with set_page_dirty_lock() to ensure proper locking.
A vulnerability in the Linux kernel's KVM nVMX component causes a NULL pointer dereference when the MMU pointer is not reset to the root MMU after failing to load L2 state for non-VM-Entry cases. This can lead to kernel crashes due to improper handling of nested virtualization state.
CVE-2026-99175 is a vulnerability in the Linux kernel's fsnotify subsystem where mark additions during connector teardown were not properly prevented. This could lead to a null pointer dereference (KASAN BUG) when an unprivileged file descriptor info read races with the final detach of a connector. The issue was fixed by setting a DESTROYING flag to reject new marks during teardown, closing the insertion race condition without changing reference or lifetime rules.
A use-after-free vulnerability exists in the ext4 filesystem implementation of the Linux kernel version 5.19. The issue arises because ext4_put_super() frees the superblock info (sbi) and associated counters without waiting for a grace period, potentially leading to dereferencing freed memory during concurrent pathwalk operations. This can cause kernel null pointer dereferences and crashes.
CVE-2026-99173 is a use-after-free vulnerability in the Linux kernel's eventfs subsystem. It occurs because the eventfs_inode is freed after an SRCU grace period, which does not wait for rcu_read_lock() sections, allowing a pathwalk to access a freed eventfs_inode. This can lead to a kernel slab-use-after-free error detected by KASAN.
A vulnerability in the Linux kernel's IPC subsystem related to the mqueue mount handling was fixed. The issue involved improper cleanup of the mqueue mount on setup failure, causing a resource leak of the mount and superblock. The fix involves using kern_unmount() to properly drop the mqueue mount in failure scenarios.