A vulnerability in the Linux kernel's perf subsystem was fixed where the function perf_pmu_migrate_context() could leave some performance monitoring events behind during CPU hotplug operations. This caused events to continue running on a CPU that was being torn down, while migrated events and interrupts were active on a new CPU, violating driver assumptions.
A vulnerability in the Linux kernel's x86 instruction evaluation code caused incorrect handling of segment register overrides due to a variable shadowing issue. This flaw led to the function get_seg_reg_override_idx() always returning a default segment register, ignoring FS and GS overrides, and causing infinite loops with CS overrides. The issue could cause the kernel to spin indefinitely when handling certain user-space instructions, effectively tying up CPUs and preventing SIGKILL delivery. The flaw was fixed by renaming an internal macro iterator variable to avoid shadowing.
A race condition vulnerability in the Linux kernel's FireWire core split transaction handling was fixed. The flaw allowed both the response handler and the timeout callback to process the same transaction entry, potentially causing a use-after-free condition on the transaction initiator side. This issue was introduced by a code refactoring that broke the intended synchronization behavior. The fix ensures the response handler does not process the transaction if the timeout callback is already running, preventing double processing.
A vulnerability in the Linux kernel's accel/rocket driver causes an out-of-bounds write when cores are removed and rebound. The issue arises because the code decrements the core count prematurely, leading to an incorrect search range and a stale device reference. This results in writing past the allocated core array, which can cause undefined behavior. The flaw was identified during testing on an Orange Pi 5 Plus and has been fixed in specific commits.
A vulnerability in the Linux kernel's accel/rocket scheduler lookup logic causes a null pointer dereference when unbinding a core that is not the last one. The function sched_to_core() fails to search all core slots, leading to NULL returns for cores that are still bound and running jobs. This results in kernel address sanitizer (KASAN) null pointer dereferences during job execution and timeout handling. The issue is fixed by searching all allocated core slots, but unbinding a core out of several remains unsafe due to clients holding references to schedulers of removed cores.
A vulnerability in the Linux kernel's ASoC SOF ipc4-topology component caused a shift-out-of-bounds error when handling aggregated ALH capture streams with fewer channels than devices. This occurs due to an underflow in a bitmask calculation leading to an invalid shift operation. The issue has been fixed in Linux kernel version 6.3 by adjusting channel mask handling for such cases.
CVE-2026-99181 is a vulnerability in the Linux kernel's autofs component where notification errors from a replaced pipe were not properly handled. This flaw could cause a denial of service of the shared autofs service during a legitimate daemon restart. The issue does not lead to memory corruption, information leaks, privilege escalation, or code execution.
CVE-2026-99180 is a use-after-free vulnerability in the Linux kernel's unicode map handling. It occurs when filesystems like ext4, f2fs, and tmpfs access a unicode map after it has been freed following the last reference to a mount going away. This can happen during pathwalk operations in RCU mode, leading to a potential kernel bug detected by KASAN. The issue arises because the unicode map is freed without waiting for a grace period, allowing concurrent lookups to access freed memory. The fix delays freeing the map until after a grace period, ensuring safe access during pathwalks.
A race condition in the Linux kernel's watch_queue_set_size() function could lead to a NULL pointer dereference and kernel panic. This occurs due to unsynchronized publication of note pool data, allowing an unprivileged user to trigger a kernel crash by racing specific ioctl and key permission operations. The issue has been fixed by enforcing proper memory ordering with smp_store_release() and smp_load_acquire() operations.
CVE-2026-99178 is a vulnerability in the Linux kernel's x86 KVM subsystem involving improper handling of asynchronous page fault (async #PF) flags during nested page faults in non-maskable interrupt (NMI) context. This flaw can cause a kernel panic when an async page fault is consumed incorrectly in NMI context, leading to system instability. The issue was resolved by ensuring the async #PF flags are not consumed on a kernel page fault in NMI context, preserving the flags for the interrupted handler. The fix is included in Linux kernel versions 6.18.59 and 7.2.13 and later.
A vulnerability in the Linux kernel's KVM SEV component related to improper page dirtying in the sev_gmem_post_populate() function has been fixed. The issue involved the use of set_page_dirty() without holding the required lock, which could lead to race conditions with page mappings. The fix replaces set_page_dirty() with set_page_dirty_lock() to ensure proper locking.
A vulnerability in the Linux kernel's KVM nVMX component causes a NULL pointer dereference when the MMU pointer is not reset to the root MMU after failing to load L2 state for non-VM-Entry cases. This can lead to kernel crashes due to improper handling of nested virtualization state.
CVE-2026-99175 is a vulnerability in the Linux kernel's fsnotify subsystem where mark additions during connector teardown were not properly prevented. This could lead to a null pointer dereference (KASAN BUG) when an unprivileged file descriptor info read races with the final detach of a connector. The issue was fixed by setting a DESTROYING flag to reject new marks during teardown, closing the insertion race condition without changing reference or lifetime rules.
A use-after-free vulnerability exists in the ext4 filesystem implementation of the Linux kernel version 5.19. The issue arises because ext4_put_super() frees the superblock info (sbi) and associated counters without waiting for a grace period, potentially leading to dereferencing freed memory during concurrent pathwalk operations. This can cause kernel null pointer dereferences and crashes.
CVE-2026-99173 is a use-after-free vulnerability in the Linux kernel's eventfs subsystem. It occurs because the eventfs_inode is freed after an SRCU grace period, which does not wait for rcu_read_lock() sections, allowing a pathwalk to access a freed eventfs_inode. This can lead to a kernel slab-use-after-free error detected by KASAN.
A vulnerability in the Linux kernel's IPC subsystem related to the mqueue mount handling was fixed. The issue involved improper cleanup of the mqueue mount on setup failure, causing a resource leak of the mount and superblock. The fix involves using kern_unmount() to properly drop the mqueue mount in failure scenarios.
A use-after-free vulnerability exists in the Linux kernel's ntfs3 filesystem driver related to improper handling of the superblock private information during unmount. The issue arises because ntfs_put_super() and ntfs3_kill_sb() drop the superblock info without an RCU delay, causing a use-after-free when a lookup is still active. The fix introduces an RCU callback to delay freeing the superblock info, preventing the use-after-free condition.
CVE-2026-99170 is a Linux kernel vulnerability involving mount namespaces where a mount that copy_tree() omits can improperly take over a lock. This allows a root task in its own user namespace to remove a locked cover on a file without a race condition or modifying the underlying filesystem. The issue arises from how locked mounts of mount namespace files are handled during mount tree copying and moving. The vulnerability has been fixed by refusing to leave out or move locked mounts of mount namespace files, preventing unshare() failures and unauthorized mount manipulations.
A vulnerability in the Linux kernel's futex subsystem related to FUT_OFF_MMSHARED futexes has been fixed. The issue allowed processes to wait on shared futexes linked to a freed memory management structure (MM), potentially causing wakeups intended for new MMs to be consumed incorrectly. The fix involves using a unique 64-bit ID per MM to key FUT_OFF_MMSHARED futexes, preventing cross-MM wakeup consumption.
A vulnerability in the Linux kernel's mshv_vtl component involves improper checking of per-CPU register pages before memory mapping. This can lead to a NULL pointer dereference when userspace faults in the mapping for a CPU without a register page. The issue arises because the global flag indicating register page presence is set if any CPU has a register page, but individual CPU pages may be NULL. The flaw has been fixed by adding a check for the selected per-CPU register page before referencing it, returning a VM_FAULT_SIGBUS if absent.