A vulnerability in the Linux kernel's tps6594 regulator driver affects the TPS65224 BUCK2, BUCK3, and BUCK4 voltage regulators. The issue arises because the driver incorrectly specifies the number of linear voltage ranges, causing out-of-bounds array access during voltage selector lookups. This flaw also impacts the TPS652G1 device. The problem has been fixed by adjusting the count of linear ranges to match the actual table size using ARRAY_SIZE().
A vulnerability in the Linux kernel Bluetooth subsystem (hci_sock) allows a race condition during dead-device detachment. This can lead to a NULL pointer dereference or use-after-free, causing kernel crashes. The flaw arises from improper serialization when rebinding an HCI socket after its controller is unregistered, resulting in unsafe access to device pointers.
CVE-2026-99006 is a high-severity vulnerability in the Linux kernel's drm/i915/gem subsystem. It involves improper handling of the exec array boundary in the eb_relocate_parse_slow() function, which can lead to freeing memory outside the intended array. This occurs due to a mismatch between the buffer count used for cleanup and the actual exec object count, potentially causing memory corruption. The issue has been resolved by ensuring relocation cleanup uses the original exec object count, excluding appended VMAs.
CVE-2026-99005 is a vulnerability in the Linux kernel's drm/i915 graphics driver related to unmasking interrupts when the ACTIVE state is false. A race condition can cause interrupts to be unmasked after the graphics technology (GT) has been parked and the runtime power management wakelock dropped, leading to kernel tainting due to hardware access without a held wakelock. The issue arises from a small race window between checking the ACTIVE state and queuing work that handles power management interrupts. The fix ensures interrupts are only unmasked when the ACTIVE state is true, preventing this improper access.
A flaw in the Linux kernel's drm/bridge th1520-dw-hdmi driver caused incorrect pointer handling during device removal, leading to improper teardown operations. The issue was fixed by correctly retrieving and passing the appropriate pointer type in the remove() callback.
CVE-2026-98995 is a high-severity vulnerability in the Linux kernel related to improper resetting of the old parent's ->overmount pointer in the mnt_change_mountpoint() function. This flaw can lead to a use-after-free (UAF) condition when a mount is moved and the old parent's ->overmount pointer incorrectly references a freed mount. This can cause the kernel to follow dangling pointers, potentially leading to privilege escalation or system compromise.
CVE-2026-98985 is a Linux kernel vulnerability in the pivot_root() function related to namespace mount checks. The flaw occurs because path_pivot_root() reads the parents of new_root and the caller's root mounts without verifying that both mounts belong to the caller's mount namespace, potentially causing a use-after-free error. This issue was fixed by ensuring both mounts are checked to be in the caller's namespace before reading their parents. The vulnerability results in an invalid read but returns EINVAL, preventing further damage.
CVE-2026-98975 is a vulnerability in the Linux kernel's XFS filesystem related to improper handling of reflink flags during extent exchanges between files. The flaw occurs when exchanging mappings that cover both files from offset 0 to the disk size, causing incorrect assumptions about shared blocks beyond the file size. This can lead to in-place writes instead of copy-on-write (CoW), resulting in corruption of shared data. The issue affects the XFS_IOC_SWAPEXT operation similarly, where reflink flags were improperly moved between inodes. The fix involves stopping the exchange of reflink flags and ensuring both inodes maintain the flag correctly. The vulnerability has a CVSS score of 7.8 (high severity).
CVE-2026-98965 is a vulnerability in the Linux kernel's ice driver for Intel Ethernet Controller E810-XXV on arm64 architectures. The issue arises from the use of writel_relaxed() for updating hardware transmit doorbells, which does not guarantee proper ordering of memory-mapped I/O writes. This can cause a race condition where the NIC starts transmitting before the driver updates the transmit queue accounting state, leading to a kernel BUG and crash under sustained network load. The problem was introduced by a change from writel() to writel_relaxed() and has been resolved by restoring the original writel() usage.
CVE-2026-98959 is a critical vulnerability in the Linux kernel's btrfs filesystem related to extended attribute (xattr) replacement when multiple xattrs are packed in the same item. The flaw causes corruption of the btrfs_dir_item structure during xattr replacement if the new value size differs, leading to filesystem transaction aborts and potential data loss. This occurs because certain fields in the btrfs_dir_item are not properly initialized after deletion and insertion operations. The issue was reproducible with specific xattr names that hash to the same value, triggering the bug during setxattr operations.
CVE-2026-98958 is a vulnerability in the Linux kernel's mt76 WiFi driver where non-AQL frames are incorrectly accounted per link instead of per peer. This causes the frame count to drift upwards, potentially blocking the station. The issue arises because increments and decrements of the non-AQL packet counter occur on different link wcids for MLO peers. The fix involves keeping the count on the wcid of the primary link.
A vulnerability in the Linux kernel's mt7915 WiFi driver causes system instability when unloading and reloading the mt7915e module. The issue arises because the driver does not disable the receive NAPI (New API) before removing the device, triggering warnings and instability especially on MT7916 hardware when changing frequency parameters.
This vulnerability in the Linux kernel's ASoC adau1372 driver involves improper handling of sleepy powerdown GPIOs. The issue arises because gpiod_set_value() emits a WARN when the GPIO provider indicates it can sleep, which is typical for I2C controlled GPIO expanders. The fix involves using the _cansleep variant to allow the driver to use sleepy GPIOs to power off the chip without warnings.
CVE-2026-98955 is a vulnerability in the Linux kernel's flow_dissector component where a 16-bit truncation of skb->len causes incorrect computation of the transport header offset (thoff). This truncation can lead to thoff being set to an invalid small value, causing transport header pointers to reference incorrect locations such as inside the Ethernet header. The issue arises with large skbs (socket buffers) exceeding 64KB, which are increasingly common due to features like GSO and BIG TCP. The fix changes the comparison to use 32-bit values and caps thoff to U16_MAX if it cannot be represented in 16 bits, reporting dissection failure rather than returning incorrect offsets.
A vulnerability in the Linux kernel's __virtio_net_hdr_to_skb() function caused improper dissection of Generic Segmentation Offload (GSO) packets. This flaw allowed malformed network headers to bypass validation, potentially leading to out-of-bounds memory reads during TCP header length calculations. The issue was fixed by ensuring proper initialization of skb fields and removing unsafe fallback code to enforce full packet dissection and validation.
CVE-2026-98953 is a vulnerability in the Linux kernel's devlink component involving a reference leak of devlink_rel objects when notify work is pending. The issue arises because the code queues work without checking if it is already pending, causing references to be leaked when the work runs only once but multiple references were taken. This leak can be triggered by repeatedly registering and unregistering nested devlink instances while holding the parent lock, resulting in multiple devlink_rel objects being leaked.
A vulnerability in the Linux kernel's PFCP implementation allows reading beyond the end of packet data when processing certain PFCP packets with the S flag set. This occurs because the code does not ensure the SEID field is fully linearized before reading, potentially leading to use of uninitialized memory in tunnel metadata. The issue is fixed by properly pulling up the SEID data and dropping packets that are too short.
CVE-2026-98951 is a vulnerability in the Linux kernel's riscv ptrace implementation where regset buffers are not zero-initialized before copying user data. This can lead to uninitialized stack buffer data being used in the target's virtual state and shadow stack pointer. The issue has been resolved by zero-initializing these buffers before use.
CVE-2026-98950 is a vulnerability in the Linux kernel's flow_dissector component where the hlen value used in bpf_flow_dissect() can be truncated due to u16 limits. This truncation causes offsets to be incorrectly clamped to zero when hlen exceeds 65535, potentially affecting packet flow dissection by BPF programs. The issue is similar to a previously fixed bug but affects the BPF path specifically. The vulnerability has been resolved by capping hlen to the maximum u16 value before clamping.
A vulnerability in the Linux kernel's HID steam driver was fixed by rearranging the teardown sequence to prevent callbacks from being scheduled during cleanup, which could lead to dangling pointers. The fix also moves work canceling for rumble and mode switch to steam_unregister to avoid persistence while the client hdev is open.