A vulnerability in the Linux kernel's drm/exec component involves improper handling of prelocked objects in the array of locked objects. This flaw can lead to a situation where a prelocked object, potentially about to be destroyed, is held with the last reference by drm_exec but never explicitly locked or reserved for dma_fence objects. This can cause warnings or kernel BUG_ON() triggers, potentially leading to memory corruption. The issue is fixed by deferring the addition of the prelocked object to the locked objects array until explicitly referenced again by the driver.
A vulnerability in the Linux kernel's drm/i915 driver related to the DMC firmware load address was fixed by adding a sanity check to validate the load address range. The flaw involved the lack of validation for the firmware load address stored in dmc_info->start_mmioaddr for DMC firmware header version 3, which could potentially lead to improper memory access.
A vulnerability in the Linux kernel's drm/xe component involves incorrect accounting of shrinker pages for pinned buffer objects (bos) when their purgeable state changes. This can cause underflow and permanent inflation of internal page counts, potentially leading to resource mismanagement.
CVE-2026-99144 is a use-after-free vulnerability in the Linux kernel's sched_ext subsystem involving a destroyed user Deferred Scheduling Queue (DSQ). The flaw arises because a deferred reenqueue operation can access a freed DSQ due to improper synchronization between the grace period and deferred request processing. This issue has been fixed by ensuring pending requests are canceled before the grace period, with proper locking to prevent access to invalid DSQ entries.
A vulnerability in the Linux kernel tracing subsystem was fixed by separating the predicate limit from the program allocation capacity. The issue involved the function predicate_parse() incorrectly using an increased predicate count as a limit, allowing the program to exceed its allocated space during parsing. This could lead to out-of-bounds access. The fix introduced a separate allocation size to ensure space for terminal entries and prevent overruns.
A vulnerability in the Linux kernel tracing subsystem was fixed by adding a check on the operator stack capacity before pushing new entries. The flaw allowed a write beyond the allocated operator stack when the stack pointer was at its last entry, potentially causing memory corruption.
A null pointer dereference vulnerability in the Linux kernel's tracing subsystem was fixed. The issue occurs when switching tracers that have no static or default flags, leading to a NULL current_trace_flags pointer. This causes a kernel crash when printing function graph events from a stale ring buffer. The fix ensures current_trace_flags never becomes NULL by falling back to an empty static flag set.
A vulnerability in the Linux kernel tracing subsystem related to hist trigger timestamps for buffered events has been fixed. The issue caused a WARN_ON_ONCE warning due to incorrect handling of event timestamps when hist triggers race with buffered events. This was triggered by specific filter and trigger commands on sched_switch events. The root cause was that events with filters but without attached hist triggers were buffered differently, causing a zero committing count and a warning when timestamps were recorded. The fix uses the tracing_event_time_stamp() API to correctly timestamp buffered events during hist trigger processing.
A use-after-free vulnerability exists in the Linux kernel's TCP implementation in the do_tcp_getsockopt function when handling TCP_CONGESTION. This flaw occurs because the code reads a pointer to congestion control operations without proper synchronization, potentially accessing freed memory. The issue was introduced after a commit that allowed dynamic allocation of BPF struct_ops, which can be freed concurrently. The vulnerability has been fixed by adding appropriate locking and memory access annotations.
A use-after-free vulnerability in the Linux kernel's TCP implementation (do_tcp_getsockopt with TCP_CC_INFO) has been fixed. The flaw occurs because the function dereferences a function pointer without proper synchronization, which can lead to accessing freed memory when using BPF struct_ops congestion control. This issue was resolved by adding appropriate locking and safe pointer loading mechanisms.
A vulnerability in the Linux kernel's CIFS implementation caused incorrect inode size updates during file truncation when no cached handle was present. This could lead to the inode size being set to zero locally while the server file remained unchanged, causing inconsistency between client and server file sizes. The issue was fixed by ensuring size updates occur only after successful file size setting and by evicting stale cache pages before truncation.
A race condition in the dm-crypt component of the Linux kernel was fixed. The issue involved the crypt_dec_pending function reading io->error before an atomic decrement operation, which could lead to reporting failed reads or writes as successful. This was due to a timing window where io->error could be changed and the reference dropped by another context, causing stale status to be used. The fix reorders the read to occur after the atomic decrement, ensuring correct error reporting.
A vulnerability in the Linux kernel's dm-integrity module causes an infinite loop during discard operations when the tag size is larger than the maximum hash digest size. This occurs because the loop control variable is never decremented due to a zero max_blocks value, resulting in a non-terminating loop. The issue is fixed by adjusting the max_size calculation to ensure max_blocks is at least one.
CVE-2026-99134 is a vulnerability in the Linux kernel's mac802154 subsystem involving a data race and NULL pointer dereference on the local->assoc_dev pointer. This pointer is shared without proper synchronization between association and response handling paths, leading to potential use-after-free or NULL dereference conditions. The flaw was addressed by replacing the pointer with a cached address protected by a dedicated spinlock to ensure atomic access and proper synchronization.
A vulnerability in the Linux kernel's net/iucv subsystem was fixed to correct improper handling of recvmsg window updates. The flaw allowed unprivileged processes to cause spurious socket disconnects and could lead to incorrect credit accounting between peers due to race conditions and improper locking. The issue was addressed by validating transport types, adjusting credit handling atomically, and ensuring sending occurs outside of atomic lock sections.
A deadlock vulnerability in the Linux kernel's XFS filesystem was fixed by changing how buffer locks are handled during synchronous transaction commits in xfs_sync_sb_buf. The issue involved holding buffer locks across a sync commit, which could cause deadlocks during shutdown when the CIL push workqueue is flushed and buffers need to be locked again to fail them. The fix removes calls that held these locks during commit and reacquires buffers afterward.
A vulnerability in the Linux kernel's XFS filesystem allowed users to bypass group quota enforcement by changing a file's group ID to another group the user belonged to, even when quotas were enforced and the file size exceeded the quota limit. This was due to an incorrect capability check that used has_capability_noaudit() instead of ns_capable_noaudit(), causing quota accounting to be bypassed in certain scenarios such as NFS clients. The issue has been fixed by correcting the capability check calls.
A vulnerability in the Linux kernel's io_uring subsystem causes a task to spin indefinitely when exiting if it has local work pending on a disabled ring that it cannot run. This occurs because the exiting task assumes it can run the work to completion, but if the ring was disabled and enabled by another task, the exiting task spins instead of sleeping, potentially burning CPU cycles or causing a kernel panic if panic_on_warn is set.
A vulnerability in the Linux kernel's SELinux implementation related to BPF token permission checks has been fixed. The issue involved multiple lookups of the bpffs creator SID using the token's file descriptor, which could lead to potential time-of-check to time-of-use (TOCTOU) issues if the token file descriptor was changed by the user. The fix simplifies the code by using resolved path/dentry or the token itself to avoid these multiple lookups and the associated risks.
A vulnerability in the Linux kernel SCTP implementation allows a remote SCTP peer to cause a receive softirq lockup by sending zero-length ASCONF chunks. This occurs because the inqueue parser accepts chunks shorter than the required four-byte generic header, leading to repeated processing of malformed chunks and potential kernel soft-lockup. The issue affects kernels built with CONFIG_IP_SCTP and specific SCTP configurations. The vulnerability has been fixed by rejecting chunks shorter than the generic SCTP header.