CVE-2026-64416 is a vulnerability in the Linux kernel's memory management subsystem related to swap cgroup handling on swapless hosts. The flaw involves a NULL pointer dereference in the lookup_swap_cgroup_id function when it processes swap entries without proper validation, potentially causing a system crash. This issue was observed on swapless hosts running affected kernel versions, leading to a kernel BUG and system instability during process exit. The vulnerability has been fixed in Linux kernel versions 7.0.0 and later.
A softlockup vulnerability in the Linux kernel's memory swap subsystem was addressed by adding periodic cond_resched() calls in the swap_reclaim_full_clusters function. This issue was observed under heavy load on large ARM64 systems with extensive memory and swap usage, causing the kernel worker thread to hang during swap reclaim operations. The vulnerability could lead to system unresponsiveness due to softlockup conditions.
A vulnerability in the Linux kernel's netfilter subsystem was addressed, specifically related to handling unreadable skb fragments when processed by the u32 module. The issue could cause improper handling of unreadable fragments, potentially leading to denial of service by dropping packets incorrectly. The flaw was fixed in Linux kernel versions 7.0.0 and later for the affected Ubuntu hardware enablement edge releases.
A critical vulnerability in the Linux kernel's netfilter flowtable subsystem involves the lack of support for IPIP tunnel hardware offload. The issue arises because no driver currently supports IPIP tunnels for hardware offload, causing the kernel to give up early on setting up this offload. The patch introduces a stub to handle unsupported configurations and prevents repeated attempts to offload unsupported entries. This vulnerability affects multiple Linux kernel versions prior to 7.0.0 releases and has been fixed in versions 7.0.0 and later.
A vulnerability in the Linux kernel's XFS filesystem code related to block reservation limit checks has been fixed. The issue involved incorrect validation of reservation values after overhead calculations, potentially leading to improper resource allocation. This flaw was addressed by correcting the reservation limit check to apply to the computed reservation value actually used in the kernel transaction allocation.
A memory leak vulnerability was identified and fixed in the Linux kernel's XFS filesystem code, specifically in the xfs_dqinode_metadir_create() function. The issue occurs when xfs_metadir_create() fails, causing allocated update and transaction state to leak, and if a subsequent commit fails, an inode reference is leaked. The fix routes failure paths through xfs_metadir_cancel() to properly release resources. This bug was confirmed present in kernel version 7.1.1 and was detected using an experimental kernel memory-management analysis tool. The vulnerability has a medium severity score and affects multiple Linux kernel versions prior to 7.0.0 with specific builds enumerated. Fixed versions starting with 7.0.0 and later are available.
A vulnerability in the Linux kernel's BPF subsystem allows a malformed BPF Type Format (BTF) to bypass validation of repeated field counts, leading to a potential buffer overflow via memcpy. This flaw was fixed by adding checked arithmetic and rejecting impossible counts during BTF parsing. The vulnerability affects multiple Linux kernel versions prior to 7.0.0 and some specific 4.x and 5.x versions. It has a high severity with a CVSS score of 7.8 and could lead to privilege escalation or system compromise if exploited.
CVE-2026-64353 is a vulnerability in the Linux kernel's BPF subsystem involving dynamic inner array lookups in ARRAY_OF_MAPS. The issue arises because the verifier uses the inner map template's max_entries value for nullness checks, which may not match the concrete inner map's max_entries at runtime, potentially leading to incorrect assumptions about key bounds. This flaw has been fixed in Linux kernel versions 7.0.0 and later.
CVE-2026-64339 is a vulnerability in the Linux kernel's USB subsystem where a bulk IN response length is not properly bounded, leading to an out-of-bounds read. A malicious or malfunctioning USB device can cause the kernel to read beyond the allocated buffer, disclosing adjacent kernel memory to user space via the i2c-dev interface. This flaw was identified by code review and confirmed with AddressSanitizer. The issue affects specific Linux kernel versions prior to 7.0.0-1012.12~24.04.1 and similar builds. A fix has been released in Linux kernel versions 7.0.0 and later.
CVE-2026-64328 is a vulnerability in the Linux kernel's USB gadget function (f_fs) that causes a memory leak due to improper reference counting of DMA fence objects. Specifically, the first reference to a dma_fence object is never released, leading to slow memory leakage as more objects are created. This issue has been fixed by transferring ownership of the fence to the DMA reservation object and properly releasing the reference. The vulnerability affects multiple Linux kernel versions prior to 7.0.0-1012.12~24.04.1 and similar builds. A patch is available and has been released in fixed versions starting with 7.0.0-1012.12~24.04.1 and later.
CVE-2026-64327 is a vulnerability in the Linux kernel's USB gadget functionfs subsystem where the endpoint file's direction flag (epfile->in) was not initialized early enough. This caused incorrect DMA direction handling for early userspace ioctls before USB host connection, potentially leading to improper DMA operations. The issue was fixed by initializing epfile->in earlier during endpoint file creation.
A NULL pointer dereference vulnerability was identified and fixed in the Linux kernel's mt76 wireless driver for the mt7921 and mt7925 chipsets. The flaw occurs when a channel-switch announcement (CSA) beacon is processed after the station disconnects or the channel context is torn down, causing the driver to dereference a cleared pointer. This leads to a kernel crash (NULL pointer dereference). The issue was resolved by adding a NULL check before dereferencing the pointer in the affected functions.
A vulnerability in the Linux kernel's crypto subsystem related to the chacha20poly1305 algorithm was fixed. The function chachapoly_create() improperly assumes the presence of a second template argument and passes it directly to strcmp() without validating it, leading to a potential dereference of an error pointer. This flaw could cause kernel instability or denial of service. The issue has been addressed by validating the template arguments properly before use.
A vulnerability in the Linux kernel's crypto CCP subsystem related to SEV ioctls was fixed. The issue involved improper initialization of SNP for SEV ioctls, which could cause the host to crash due to a general protection fault triggered by zeroing out a critical register. The fix ensures SNP is not initialized unnecessarily, preventing this unsafe state. This vulnerability affects certain Linux kernel versions prior to 7.0.0-1012.12~24.04.1 and similar builds and has been addressed in those fixed versions.
A vulnerability in the Linux kernel's crypto CCP subsystem involves improper initialization of the SNP_COMMIT ioctl command. The issue arises because the SNP_COMMIT command is allowed in the UNINIT state contrary to earlier documentation, and the kernel did not skip initialization when SNP was previously uninitialized. This could lead to a general protection fault and crash the host system. The flaw has been fixed in Linux kernel versions 7.0.0 and later.
A vulnerability in the Linux kernel's cryptographic CCP subsystem involves improper initialization handling for the SNP_VLEK_LOAD ioctl call. The issue concerns refusing to initialize SNP if it has not been previously initialized, correcting a prior behavior that could lead to unintended side effects. This flaw was addressed in Linux kernel versions 7.0.0 and later. The vulnerability has a medium severity rating with a CVSS score of 5.5 and does not impact confidentiality or integrity but can cause denial of service by crashing the host.
A vulnerability in the Linux kernel's crypto CCP subsystem involves improper handling of SNP initialization during ioctl(SNP_CONFIG) calls. If SEV initialization fails and KVM is running virtual machines, a userspace process could trigger a code path that zeroes out a critical MSR register, potentially causing a general protection fault and crashing the host. The fix prevents retrying initialization if SNP is not already initialized, addressing this corner case.
A vulnerability in the Linux kernel's x86 memory management subsystem was fixed involving improper freeing of PMD-sized vmemmap pages. The flaw caused only the first page of a PMD-sized vmemmap page to be freed, leaking the remaining pages. This was due to misuse of the pagetable_free() function, which is intended for page tables but was incorrectly applied to vmemmap pages. The issue has been corrected by properly separating the freeing logic for pagetable and vmemmap pages.
A vulnerability in the Linux kernel's memory management subsystem (page_ext iteration API) could cause a NULL pointer dereference during memory hotplug operations. The flaw occurs because the iterator does not properly limit its count, allowing access beyond valid page frame numbers (PFNs). This issue has been fixed by enforcing iteration boundaries within the iterator functions to prevent invalid PFN access.
A vulnerability in the Linux kernel's iommufd component involves incorrect use of sizeof on a pointer instead of the pointed-to structure in a boundary check during veventq read operations. This causes an underestimation of the header size on 32-bit systems, potentially allowing a local attacker to write beyond the user buffer. The issue is fixed in Linux kernel versions 7.0.0 and later.