A vulnerability in the Linux kernel's rtw89 wifi driver causes improper handling of malformed AMPDU frames. The flaw leads to unexpected packet drops, particularly during busy traffic and rekey processes, which can cause disconnection from the access point.
A vulnerability in the Linux kernel's iio: adc: ad_sigma_delta driver caused the chip select (CS) line to remain asserted after SPI transfers, leading to potential state leaks and concurrent SPI access issues. This was due to improper handling of CS assertion and device mode transitions during conversion and error paths. The issue has been fixed by adjusting the order of calls to clear CS assertion and revert device mode. The flaw affects certain Linux kernel versions prior to 7.0.0-1012.12~24.04.1 and similar builds and has been patched in the 7.0.0 series.
A vulnerability in the Linux kernel's iio adc ti-ads1119 driver caused a power management (PM) reference leak during buffer preenable. If an I2C write operation fails, the runtime PM usage counter remains elevated, potentially leaving the device runtime-active indefinitely. This issue has been fixed in Linux kernel versions 7.0.0 and later.
A memory management vulnerability in the Linux kernel's Industrial I/O (iio) subsystem was fixed by ensuring the scan_mask bitmap is properly freed on buffer release. The flaw originated from a code change that moved scan_mask to a separate allocation but did not update the release function accordingly, potentially causing a memory leak.
A vulnerability in the Linux kernel's iio temperature driver (tmp006) was identified where the driver improperly registers a trigger, leading to a dangling pointer on module unload. This occurs because the trigger is allocated with devm_iio_trigger_alloc() but registered with iio_trigger_register(), and the driver lacks a .remove() callback to unregister it. The issue has been fixed by switching to devm_iio_trigger_register(), ensuring proper cleanup within the device-managed scope.
A use-after-free (UAF) vulnerability was identified and fixed in the ALSA usx2y us144mkii driver in the Linux kernel. The flaw occurs during device disconnect when USB Request Blocks (URBs) self-resubmit and reschedule work after cancellation, leading to a work handler running on freed memory. This issue has been resolved by changing the order of cancelling URBs and work to prevent re-arming after cancellation.
A vulnerability in the ALSA compress subsystem of the Linux kernel was fixed. The issue involved improper handling of task creation errors in snd_compr_task_new(), leading to resource leaks and incorrect success reporting when file descriptor allocation failed. This flaw could cause driver resources to be leaked due to missing cleanup calls. The vulnerability affects multiple Linux kernel versions prior to 7.0.0-1012.12~24.04.1 and related builds. A patch is available that corrects this behavior.
CVE-2026-64477 is a vulnerability in the Linux kernel's x86 resctrl filesystem that could cause out-of-bounds memory access when offlining a CPU with SNC enabled. The issue arises because the kernel attempts to query a NUMA node ID using an invalid CPU identifier when the monitoring domain's CPU mask is empty during offline processing. This flaw has been fixed by refactoring the handler to avoid reading RMID state unnecessarily and adding safety checks to prevent out-of-bounds access.
A vulnerability in the Linux kernel's rust_binder component was fixed by ensuring that freeze listeners are cleared when a node is removed. Previously, freeze listeners could remain registered even after the reference count to the node dropped to zero, potentially causing a memory leak due to a reference count cycle. This issue has been addressed in Linux kernel versions 7.0.0 and later.
CVE-2026-64464 is a vulnerability in the Linux kernel's xHCI sideband code where a temporary pages array used during scatter-gather table construction is leaked on successful allocation. This leak occurs because the temporary pages array is not freed after the sg_table is successfully created, causing a memory leak each time a sideband client obtains an endpoint or event ring buffer. The issue has been fixed by freeing the temporary pages array after successful sg_table construction.
A vulnerability in the Linux kernel's PCI/IOV subsystem was fixed that prevented out-of-bounds array access when restoring VF Resizable BAR state after a read error. The flaw occurs because the code uses values from a device register to index an array with only 6 entries, but the register fields can have values up to 7, causing an out-of-bounds access. This was observed on an NVIDIA GPU that stopped responding during a power state exit. The fix ensures that if a config read returns an error response, the restoration process bails out safely without accessing invalid memory.
A critical use-after-free vulnerability in the Linux kernel's TCP Authentication Option (TCP-AO) implementation was fixed by restoring the RCU grace period in the tcp_ao_destroy_sock function. The flaw allowed a race condition where a freed pointer could be accessed concurrently by softirq readers, potentially causing memory corruption and kernel crashes. This issue affects multiple Linux kernel versions prior to 7.0.0 and was resolved by re-adding RCU callbacks to ensure safe memory reclamation.
A vulnerability in the Linux kernel's virtio_pci driver causes a NULL pointer dereference when unbinding a virtio balloon device due to an indexing mismatch in virtqueue info pointer storage and lookup. This flaw arises from sparse array holes created by conditional virtqueue features, leading to a crash when accessing a NULL pointer. The issue is fixed by aligning the storage and lookup indices for virtqueue info pointers.
A use-after-free (UAF) vulnerability was identified and fixed in the Linux kernel's usbio client teardown code. The flaw involved unsafe iteration over a list of usbio clients during device disconnect, which could lead to dereferencing freed memory and kernel crashes. This issue has been addressed by changing the iteration method to safely handle client removal. The vulnerability affects multiple Linux kernel versions prior to 7.0.0-xxx releases where the fix is applied. The CVSS score is 7.8, indicating high severity.
A NULL pointer dereference vulnerability exists in the Linux kernel's tracing subsystem in the func_set_flag() function. This occurs because the function dereferences a pointer before verifying that the current tracer is the function tracer, leading to a kernel crash when the tracer is switched to another type. The issue has been fixed by reordering the check to prevent dereferencing a NULL pointer.
A double-free and use-after-free vulnerability was identified and fixed in the Linux kernel's ipu7 media staging driver. The flaw occurs in error handling paths where allocated pdata is freed multiple times, leading to memory corruption. Additionally, an error code was improperly handled, causing a use-after-free when constructing return values. This vulnerability affects certain Linux kernel versions prior to 7.0.0 and specific 4.x and 5.x versions. The issue has been addressed in fixed kernel releases starting with version 7.0.0 and related updates. The CVSS score is 7.8, indicating high severity.
A critical use-after-free vulnerability exists in the Linux kernel's krb5 cryptographic implementation when async AEAD instances are used improperly. The flaw occurs because async AEAD encrypt/decrypt calls return -EINPROGRESS, leading to premature freeing of buffers still in use by backend workers. This can cause kernel memory corruption and potential system compromise. The issue affects multiple kernel versions prior to 7.0.0 and has been fixed in several 7.0.0 releases.
A vulnerability in the Linux kernel's NTFS driver causes out-of-bounds memory access due to improper handling of invalid index_block data during write operations. The function ntfs_icx_ib_sync_write() calls post_write_mst_fixup() even when pre_write_mst_fixup() validation fails, leading to memory corruption. This flaw can be triggered by a crafted malicious NTFS image with manipulated index_block fields. The issue has been resolved by moving the post_write_mst_fixup() call to ntfs_ib_write(), preventing calls on invalid data.
CVE-2026-64427 is a vulnerability in the Linux kernel's HID Logitech DJ driver where an improper validation of the DJ short output report can cause a NULL pointer dereference during device probe. This occurs because the code dereferences a field pointer even when no fields are present, leading to a kernel crash. The issue is triggered by a crafted HID descriptor that creates a report with only padding output items and no valid fields.
CVE-2026-64426 is a vulnerability in the Linux kernel's io_uring subsystem where a file reference leak occurs due to improper handling of IOSQE_FIXED_FILE flag in NOP operations. The flaw causes a file reference to not be released properly, leading to a memory leak. This issue has been fixed in Linux kernel versions 7.0.0 and later.