CVE-2026-99033 is a vulnerability in the Linux kernel's net/packet subsystem where the function packet_rcv_spkt() improperly handles the link layer header push operation. This can cause a kernel panic when processing CAN (Controller Area Network) packets on certain socket types due to an uninitialized mac_header pointer. The issue arises because packet_rcv_spkt() does not guard the skb_push() operation with a check for the presence of a link layer header, unlike similar functions. This flaw can lead to a fatal kernel panic from softirq context, causing a system crash.
CVE-2026-99032 is a use-after-free and potential NULL dereference vulnerability in the Linux kernel's SMC (Shared Memory Communications) subsystem. The flaw occurs in the smc_getname() function, which accesses the clcsock pointer without proper locking, allowing asynchronous release of the associated CLC socket. This can lead to memory corruption or kernel crashes when getsockname() is called concurrently with link-group termination.
A vulnerability in the Linux kernel's network bridge code could cause recursive multicast port cleanup to consume excessive kernel stack frames, potentially hitting the stack guard page. This issue arises from the function br_multicast_sg_del_exclude_ports() calling br_multicast_del_pg(), which in turn calls back into br_multicast_sg_del_exclude_ports() for certain entries. The fix suppresses the recursive cleanup while the helper is already processing the same entry.
A vulnerability in the Linux kernel's skb_copy_and_csum_bits() function could cause stale bytes to be left in network buffers. This occurs when unreadable fragments cause the function to copy only the linear part of a buffer, leaving the remainder uninitialized. The uninitialized memory may be sent out in network packets such as ICMP errors or driver transmit buffers, potentially leaking sensitive data. The issue is addressed by zeroing the unused portion of the buffer before transmission.
A memory leak vulnerability was identified and fixed in the Linux kernel's sparx5 network driver. The issue involved the sparx5_tc_matchall_destroy() function failing to free allocated memory for matchall filter entries, causing a leak when deleting mirror and goto matchall filters. The leak was confirmed using kmemleak on specific hardware and resolved by freeing the entries after unlinking them.
A vulnerability in the Linux kernel's Xilinx axienet driver causes a memory leak of DMA buffers when the network device is stopped. This occurs because the driver aborts DMA descriptors without running their completion callbacks, leading to unreleased SKBs and DMA mappings. The leak can exhaust IOMMU resources. The fix involves proper synchronization and freeing of DMA buffers during device stop.
CVE-2026-99027 is a vulnerability in the Linux kernel's network team driver where the reuse of socket buffers (skb) after queue override can lead to a use-after-free condition. This occurs because a nonzero dev_queue_xmit() result does not return ownership of the skb, causing the queue override helper to improperly reuse freed skb memory. The flaw can trigger kernel memory corruption and a kernel panic due to use-after-free errors detected by KASAN.
A vulnerability in the Linux kernel's team network driver causes the original socket buffer (skb) not to be freed when a broadcast packet has no transmitable port. This leads to retained memory charge on the socket, potentially causing resource leakage. The issue occurs because the transmit function returns success without consuming the skb when no port is available, but the skb is not freed. The flaw has been fixed by ensuring the skb is freed in this no-port scenario.
A vulnerability in the Linux kernel's openvswitch component caused a soft lockup during netlink flow dumps on production compute nodes with thousands of datapath flows. The issue arises because the softirq backlog refills as fast as it drains, causing the dumping thread to monopolize CPU time without rescheduling, leading to a soft lockup. The fix involves holding bottom halves (BH) off across the entire callback to prevent draining softirqs prematurely, thus avoiding the lockup. This fix trades off preemption under CONFIG_PREEMPT but keeps the BH-off region short and bounded by the flow count.
CVE-2026-99024 is a vulnerability in the Linux kernel's optee driver where TEE devices were registered before full initialization, allowing access to uninitialized structures. This could lead to dereferencing NULL pointers and using uninitialized mutexes during a race window. The issue is fixed by delaying device registration until full initialization of the optee structure is complete.
A memory leak vulnerability in the Linux kernel's power sequencing code for pcie-m2 was fixed. The function of_regulator_bulk_get_all() allocates an array that was not properly freed in the pwrseq-pcie-m2.c code, causing a leak. The fix adds an explicit kfree() call to release the allocated consumers array.
A vulnerability in the Linux kernel regulator driver for the LTC3676 chip allows reading from write-only registers HRST and CLIRQ. Reading these registers triggers unintended hardware actions, such as a hard reset or clearing interrupts, causing the board to reboot unexpectedly during register dumps.
A vulnerability in the Linux kernel's regulator subsystem was fixed where the function of_regulator_bulk_get_all() did not properly initialize supply names in the returned array. This could lead to uninitialized memory dereferences when the array is used, such as during error logging in regulator_bulk_enable(). The fix involves copying supply names into the array's own allocation to ensure proper lifetime management and prevent memory issues.
A vulnerability in the Linux kernel's tps6594 regulator driver affects the TPS65224 BUCK2, BUCK3, and BUCK4 voltage regulators. The issue arises because the driver incorrectly specifies the number of linear voltage ranges, causing out-of-bounds array access during voltage selector lookups. This flaw also impacts the TPS652G1 device. The problem has been fixed by adjusting the count of linear ranges to match the actual table size using ARRAY_SIZE().
CVE-2026-99019 is a vulnerability in the Linux kernel's SCSI changer driver (ch) where references to data transfer element devices are improperly retained. This causes scsi_device references to leak when drives are removed, preventing their release and blocking new devices from being recognized at the same address. The issue leads to increased module use counts and prevents unloading of the low-level driver module until a reboot occurs. The flaw affects certain Linux kernel versions and has been resolved by dropping references immediately after use and removing the unused array.
CVE-2026-99018 is a high-severity vulnerability in the Linux kernel's RISC-V architecture support related to the shadow call stack handling on trap entry. The kernel incorrectly decides whether to reload the shadow call stack pointer based on a user-writable register (tp) rather than the hardware-controlled sstatus.SPP bit. This flaw allows an unprivileged user to manipulate the kernel shadow call stack pointer, leading to arbitrary kernel memory writes and control-flow hijacking. The issue affects multiple specific Linux kernel versions and has been resolved by changing the check to rely on the hardware SPP bit, which cannot be forged by user mode. The vulnerability has a CVSS score of 7.8 and no known exploits in the wild.
A vulnerability in the Linux kernel's RISC-V architecture handling involves improper detection and mitigation of the THEAD GHOSTWRITE erratum. The issue arises because the mitigation is only applied if the CPU vulnerability is detected during an early boot stage enabled by a specific configuration flag. If the kernel is built with ERRATA_THEAD_GHOSTWRITE enabled but ERRATA_THEAD_MAE disabled, the vulnerability is not detected, leaving the system unprotected despite being vulnerable. This affects certain Linux kernel versions and can lead to high impact on confidentiality, integrity, and availability.
CVE-2026-99016 is a vulnerability in the Linux kernel's RISC-V futex implementation where the user pointer is not properly untagged before atomic operations. This can allow an unprivileged process to perform atomic read-modify-write operations on arbitrary kernel memory addresses, potentially leading to high impact including confidentiality, integrity, and availability violations. The issue arises due to a mismatch between the pointer checked by access_ok() and the pointer used in atomic operations when tagged address ABI is enabled. The vulnerability affects specific Linux kernel versions listed and has a CVSS score of 7.8 (high severity).
A vulnerability in the Linux kernel Bluetooth subsystem (hci_sock) allows a race condition during dead-device detachment. This can lead to a NULL pointer dereference or use-after-free, causing kernel crashes. The flaw arises from improper serialization when rebinding an HCI socket after its controller is unregistered, resulting in unsafe access to device pointers.
A use-after-free vulnerability in the Linux kernel Bluetooth subsystem was fixed in the hci_sync component during passive scan setup. The flaw involved improper handling of command skb lifetimes, leading to potential memory corruption. The issue was addressed by serializing access with a mutex and copying the address before releasing the lock to prevent use-after-free conditions.