CVE-2026-99127 is a vulnerability in the Linux kernel's page_pool subsystem where fragment offsets become misaligned for odd-sized memory requests. This misalignment can cause atomic operations on skb shared info data to straddle cache lines, triggering fatal split lock detection panics on x86 systems. The issue affects the per-CPU system_page_pool used by generic XDP and can be reproduced by attaching an XDP program to loopback and sending UDP packets. The vulnerability has been fixed by ensuring fragment sizes are aligned to the required DMA cache alignment, preventing misaligned offsets and subsequent kernel panics.
A null pointer dereference vulnerability was identified and fixed in the s390/ctcm subsystem of the Linux kernel. The issue occurs when the function mpc_validate_xid() attempts to set a flag on a null pointer due to uninitialized grp->saved_xid2 in certain error conditions. This flaw could cause a kernel crash. The vulnerability has been addressed by modifying the code to use a guaranteed valid pointer for setting the validation error flag.
A vulnerability in the Linux kernel's s390/pai subsystem involves improper handling of multiple PMU stop callback invocations. The kernel may call the PMU stop function twice consecutively due to task scheduling and throttling behavior, which was not properly protected against. This flaw has been fixed by checking a status bit to prevent repeated stop calls and prohibiting certain ioctl calls that could trigger unsupported behavior.
A vulnerability in the Linux kernel s390/pci subsystem allowed leakage of uninitialized kernel data in SCLP error reports due to insufficient buffer length validation. This could cause up to around 4KB of kernel memory to be exposed in malformed error reports. The issue affects Linux kernel version 4.7 and has been fixed in later commits. The leak is limited to privileged entities processing the SCLP reports, so it does not expose data beyond their access rights.
A vulnerability in the Linux kernel's vsock/virtio transport allows an attacker to cause a connected socket to accept packets from an unrelated source. This occurs because the fallback socket lookup does not validate the source address, potentially transitioning a socket to TCP_ESTABLISHED state with an incorrect remote address. The flaw was demonstrated with unprivileged processes causing victim sockets to read attacker-chosen data. The issue has been fixed by adding source validation in the receive path.
A vulnerability in the Linux kernel's vsock/vmci subsystem was fixed by validating the packet source for connected sockets. The issue involved improper socket lookup that could select a non-listening socket without verifying the packet's source, potentially causing incorrect socket resets. The fix ensures source validation before processing packets and preserves reset behavior for certain socket states.
A divide-by-zero vulnerability was identified and fixed in the Linux kernel's IPv4 fib_rebalance function. The issue arises when concurrent changes cause the first pass of fib_rebalance to report zero total eligible nexthop weight while the second pass sees an eligible nexthop, leading to division by zero. The fix sets each nexthop upper bound to -1 and skips the division when the total is zero, aligning with a similar IPv6 fix.
A vulnerability in the Linux kernel's KVM x86 memory management unit (MMU) handling causes improper processing of the SS bit in nested page fault (#NPF) exit codes. This leads to out-of-bounds accesses in permission_fault(), resulting in kernel warnings or undefined behavior sanitizer (UBSAN) reports. The issue arises when running Hyper-V on Windows 11 guests under KVM, due to unexpected SS bit settings in nested page fault error codes. The Linux kernel has fixed this by adjusting error code handling to drop unexpected bits while preserving the SS bit when reflecting faults to the L1 hypervisor.
A vulnerability in the Linux kernel's AMDGPU driver related to user queue (userq) buffer object (BO) validation was fixed. The issue involved improper validation of BOs that were created and evicted before a userq was created, causing them to be excluded from eviction fence rearms. Additionally, a missing reference to the BO before locking and referencing it was corrected.
A vulnerability in the Linux kernel's drm/i915 driver related to DMC firmware payload parsing has been fixed. The issue involved improper validation of the DMC firmware size conversion and acceptance of malformed firmware payloads, such as zero-length payloads and zero MMIO counts. The fix includes overflow checks and early rejection of invalid firmware headers to prevent potential errors during firmware processing.
A use-after-free vulnerability in the Linux kernel's bridge multicast code was fixed. The issue occurs because the port group walk during teardown can be prematurely terminated due to improper list handling, leading to dangling pointers and potential kernel memory corruption.
CVE-2026-99116 is a use-after-free vulnerability in the Linux kernel's net: psp component. It occurs because socket cloning improperly inherits the Rx association without taking a reference, leading to multiple timewait sockets sharing a freed pointer. This can cause kernel memory corruption and crashes. The issue is fixed by clearing the association on socket clone to prevent inheritance.
A vulnerability in the Linux kernel's ksmbd component caused the FileSysIdentifier field in FS_POSIX_INFORMATION responses to be uninitialized, potentially leaking residual memory data during compound SMB2 requests. The issue was fixed by properly reporting the file system ID returned by statfs().
A vulnerability in the Linux kernel's ksmbd component involves uninitialized FileSystemControlFlags in the FS_CONTROL_INFORMATION structure. This flaw can cause information leakage in compound SMB2 requests due to leftover data in the response buffer. The issue affects Linux kernel version 5.15 and has been fixed in subsequent commits.
A vulnerability in the Linux kernel's ksmbd component involves improper clearing of the FS_OBJECT_ID_INFORMATION buffer before it is filled. This can cause up to 31 bytes of unintended data from previous responses to be included in the current response, potentially exposing sensitive information. The issue occurs because the buffer is only partially overwritten and not zeroed in compound SMB2 requests. The flaw has been fixed by zeroing the structure before filling it, ensuring the version_string is also properly null-terminated.
A vulnerability in the Linux kernel's net/sched cls_flower component involves improper validation of a mask pointer after advancing it with nla_next(). This can lead to out-of-bounds reads when nested attributes in the mask are not properly validated, potentially causing memory safety issues. The flaw is fixed in Linux kernel version 5.11 and certain commits prior to that.
A vulnerability in the Linux kernel's SMB client was fixed to prevent data corruption caused by concurrent writes combined with file truncation (O_TRUNC). The issue occurred because flush and truncate operations were not properly synchronized, allowing buffered writes to corrupt data silently. The fix ensures atomicity of flush-truncate-resize sequences by acquiring appropriate locks.
A heap overflow vulnerability was identified and fixed in the Linux kernel's SMB client code, specifically in the cifs_do_set_acl() function. The issue arises because the ACL size validation uses a smaller size calculation than the actual CIFS wire format size, potentially causing a heap overflow when converting ACLs. The fix involves validating the CIFS format size against buffer limits and USHRT_MAX to prevent overflow and partial ACL application by the server.
A vulnerability in the Linux kernel's SMB client implementation allows SetEA requests with extended attribute values that exceed the allocated request buffer size. This flaw arises because the CIFSSMBSetEA() function copies the extended attribute value without verifying it fits within the buffer, potentially causing out-of-bounds memory writes. The issue is fixed by applying proper length checks before copying and preventing integer overflow in length calculations.
A vulnerability in the Linux kernel's NTFS filesystem driver (ntfs_trim_fs) caused improper alignment of discard ranges during FITRIM operations. This misalignment could lead to discarding allocated clusters beyond the intended free extent, potentially resulting in data loss or corruption. The issue was fixed by correctly aligning both the start and end of the discard range and skipping extents without full discard units.