A Linux kernel vulnerability in the SCSI target subsystem involves improper interrupt handling while holding the delayed_cmd_lock spinlock. This can lead to a deadlock scenario when completing certain ordered commands from interrupt context. The issue arises because target_do_delayed_work() uses spin_lock() without disabling interrupts, whereas other code paths use spin_lock_irqsave(). This flaw was introduced after a commit enabling command completion from backend interrupt context. It affects Linux kernel version 7.1 and has been fixed in later commits.
A race condition vulnerability in the Linux kernel's SCSI target iSCSI discovery authentication updates could cause a double-free memory error. This occurs when separate configfs opens concurrently update the discovery AuthMethod parameter without proper synchronization. The issue has been fixed by protecting the parameter update with the discovery TPG access lock.
CVE-2026-99205 is a Linux kernel vulnerability involving the scheduler core where a race condition during task class changes can cause the CPU to idle despite having runnable tasks. This occurs because the scheduler's next_class indicator does not update correctly when a queued task changes scheduling class, leading to lost rescheduling signals and CPU idle loops. The issue has been fixed by ensuring wakeup_preempt() is called during class changes to properly update scheduling state and rescheduling needs.
A use-after-free vulnerability in the Linux kernel's OCFS2 Distributed Lock Manager (DLM) debugfs interface was fixed. The issue involved improper locking when reading recovery participant records during debugfs reads, which could lead to reading freed memory. The fix involved protecting the recovery list traversal with the appropriate lock to prevent concurrent access issues.
A use-after-free vulnerability in the Linux kernel's pipe implementation was fixed. The issue occurs when setting up asynchronous notification (fasync) for pipe writers fails, causing existing reader registrations to be incorrectly removed. This leads to a scenario where a later pipe notification can dereference freed memory, triggering a kernel slab use-after-free error. The flaw affects Linux kernel version 2.6.30 and was resolved by ensuring reader registrations are preserved on writer setup failure.
A deadlock vulnerability in the Linux kernel's SCSI libsas subsystem during High Availability (HA) resume has been fixed. The issue occurs when smp_execute_task_sg() calls pm_runtime_get_sync() on the host during HA resume, causing a deadlock due to waiting on the device resume state. This affects expander-attached SATA disks during the resume process. The fix replaces the problematic runtime PM calls to avoid deadlock and ensures proper host resume handling.
CVE-2026-99201 is a vulnerability in the Linux kernel's netlink subsystem where the network namespace pointer was hashed directly, allowing an unprivileged user to infer kernel memory layout information. This could enable recovery of the address of init_net by analyzing hash collisions and offline searching. The issue is fixed by replacing the namespace pointer with a unique, non-address net_cookie in the hash key, preserving namespace separation and safe operation under RCU. The fix is backported to Linux kernel versions 5.15 and later.
A vulnerability in the Linux kernel's hisilicon femac driver causes a crash due to a NULL pointer dereference during device probing when CONFIG_NET_SHAPER is enabled. The issue arises because the network operations pointer (netdev_ops) is not assigned before the PHY connection is established, leading to a kernel panic. This has been fixed by assigning netdev_ops before PHY attachment.
A vulnerability in the Linux kernel's hisilicon hip04_eth driver caused a crash due to a NULL pointer dereference. The issue occurred because netdev_ops was not assigned before calling of_phy_connect(), leading to a crash when CONFIG_NET_SHAPER was enabled. This has been fixed by moving the assignment of netdev_ops before the PHY attach, preventing the crash.
A vulnerability in the Linux kernel's ethernet actions code caused a crash due to a NULL pointer dereference. The issue arises because the netdev_ops pointer was not assigned before PHY attachment, leading to a crash when CONFIG_NET_SHAPER is enabled. This has been fixed by assigning netdev_ops before the PHY attach.
A vulnerability in the Linux kernel's mv643xx network driver caused a crash due to a NULL pointer dereference when CONFIG_NET_SHAPER is enabled. The issue arose because the netdev_ops structure was not assigned before the PHY was connected, leading to a crash during probing. This has been fixed by assigning netdev_ops prior to PHY attachment.
A null pointer dereference vulnerability in the Linux kernel's au1000 network driver caused a crash during device probing when CONFIG_NET_SHAPER is enabled. The issue arises because netdev_ops was assigned after PHY attachment, leading to a crash. This has been fixed by assigning netdev_ops before PHY attachment.
A vulnerability in the Linux kernel's ethoc network driver caused a crash due to a NULL pointer dereference. This occurred because netdev->netdev_ops was not assigned before the PHY attach process, leading to a crash when CONFIG_NET_SHAPER was enabled. The issue has been fixed by assigning netdev_ops prior to PHY attachment, similar to a previous fix in the emac driver.
A vulnerability in the Linux kernel's Aeroflex Ethernet driver causes a crash due to a NULL pointer dereference during device probing when CONFIG_NET_SHAPER is enabled. The issue arises because netdev_ops is accessed before being assigned, leading to a crash. This has been fixed by assigning netdev_ops before PHY attachment, similar to a prior fix in the emac driver.
A vulnerability in the Linux kernel's ti icssm-prueth driver caused a crash due to a NULL pointer dereference. The issue arose because the netdev_ops field was not assigned before a PHY attach operation that accessed it, leading to a crash when CONFIG_NET_SHAPER was enabled. This has been fixed by assigning netdev_ops prior to the PHY attach, following a similar fix applied to the emac driver.
A vulnerability in the Linux kernel's bcmgenet network driver involves improper handling of shared socket buffers (skb) before writing to the control block. This flaw can cause the byte queue limits (BQL) to stall the transmit queue, leading to potential network transmission delays or stalls. The issue arises because the driver does not unshare the skb before modifying the control block, causing data corruption when the same skb is reused. The vulnerability affects specific Linux kernel versions and has been fixed in version 3.17.
A vulnerability in the Linux kernel's calipso_skbuff_setattr() function mishandles the payload length for large TCP packets using IPv6. This causes incorrect payload_len values when packets exceed IPV6_MAXPLEN, potentially affecting network functions relying on this field. The issue has been fixed in specific kernel commits.
A memory leak vulnerability was identified and fixed in the Linux kernel's gpiolib subsystem within the function gpiod_set_array_value_complex(). The issue occurs on error paths where allocated bitmaps may not be freed if gpiochip_set_multiple() fails, leading to potential memory leakage. This is considered an unlikely error path but is possible. The fix defers the return code check until after the bitmap_free() call to ensure proper cleanup.
A race condition vulnerability in the Linux kernel's mxc GPIO driver was fixed. The issue involved installing a chained IRQ handler before the IRQ domain and related data structures were fully initialized, which could lead to the handler accessing incomplete or freed memory. This could cause system instability or crashes. The fix moves the handler installation to after all dependencies are ready and ensures it is not installed if probe fails.
A vulnerability in the Linux kernel's stmmac driver for the dwmac1000 Ethernet controller causes a soft lockup and system hang during resume from low-power states. The issue arises because the RGMII status interrupt (GMAC_RGSMIIIS) is not cleared properly, leading to an interrupt storm that starves the CPU handling the MAC interrupt. This was fixed by restoring the read of GMAC_RGSMIIIS in the interrupt status handler to clear the pending interrupt.