A vulnerability in the Linux kernel's skb_copy_and_csum_bits() function could cause stale bytes to be left in network buffers. This occurs when unreadable fragments cause the function to copy only the linear part of a buffer, leaving the remainder uninitialized. The uninitialized memory may be sent out in network packets such as ICMP errors or driver transmit buffers, potentially leaking sensitive data. The issue is addressed by zeroing the unused portion of the buffer before transmission.
A memory leak vulnerability in the Linux kernel's power sequencing code for pcie-m2 was fixed. The function of_regulator_bulk_get_all() allocates an array that was not properly freed in the pwrseq-pcie-m2.c code, causing a leak. The fix adds an explicit kfree() call to release the allocated consumers array.
A vulnerability in the Linux kernel regulator driver for the LTC3676 chip allows reading from write-only registers HRST and CLIRQ. Reading these registers triggers unintended hardware actions, such as a hard reset or clearing interrupts, causing the board to reboot unexpectedly during register dumps.
A vulnerability in the Linux kernel's tps6594 regulator driver affects the TPS65224 BUCK2, BUCK3, and BUCK4 voltage regulators. The issue arises because the driver incorrectly specifies the number of linear voltage ranges, causing out-of-bounds array access during voltage selector lookups. This flaw also impacts the TPS652G1 device. The problem has been fixed by adjusting the count of linear ranges to match the actual table size using ARRAY_SIZE().
CVE-2026-99013 is a vulnerability in the Linux kernel's Bluetooth ISO subsystem where concurrent BIS listener setups on the same broadcast socket can cause a use-after-free condition. This occurs because the kernel does not properly check if a socket already has a connection before attaching a new one, leading to a stale socket access. The flaw has been fixed by adding checks to reject competing setups and preserve lock ordering.
A vulnerability in the Linux kernel's panthor driver allows unprivileged userspace to request more queues than the firmware has initialized, potentially causing a crash due to dereferencing uninitialized memory. The flaw arises because the queue count validation checks against a hardcoded maximum rather than the actual number of firmware-initialized slots.
CVE-2026-98993 is a Linux kernel vulnerability involving improper handling of the MNT_UMOUNT flag during mount namespace cloning. The flaw causes mounts that have been lazily unmounted but are still referenced to incorrectly inherit the MNT_UMOUNT flag, leading to various mount namespace inconsistencies, including leaked mounts, unmounting errors, and potential use-after-free conditions. This issue affects specific linux-aws kernel versions and has a high severity rating with a CVSS score of 7.8.
A vulnerability in the Linux kernel's unshare system call can cause active namespace references to be dropped incorrectly when set_cred_ucounts() fails. This leads to the caller's namespaces losing references and not being listed by listns(), potentially causing inconsistent namespace state.
A vulnerability in the Linux kernel's drm_bridge_add() function was fixed to prevent list corruption. The issue involved modifying bridge_lingering_list without holding the required bridge_lock, potentially corrupting internal kernel lists when re-adding a previously removed bridge.
A vulnerability in the Linux kernel's btrfs filesystem code related to the handling of I/O completion status has been resolved. The issue involved improper return values after the btrfs_uring_read_extent_endio function, which could cause double unlocking and freeing of resources. This was fixed by always returning -EIOCBQUEUED to ensure only the deferred cleanup path executes.
This vulnerability in the Linux kernel's ASoC adau1372 driver involves improper handling of sleepy powerdown GPIOs. The issue arises because gpiod_set_value() emits a WARN when the GPIO provider indicates it can sleep, which is typical for I2C controlled GPIO expanders. The fix involves using the _cansleep variant to allow the driver to use sleepy GPIOs to power off the chip without warnings.
CVE-2026-98955 is a vulnerability in the Linux kernel's flow_dissector component where a 16-bit truncation of skb->len causes incorrect computation of the transport header offset (thoff). This truncation can lead to thoff being set to an invalid small value, causing transport header pointers to reference incorrect locations such as inside the Ethernet header. The issue arises with large skbs (socket buffers) exceeding 64KB, which are increasingly common due to features like GSO and BIG TCP. The fix changes the comparison to use 32-bit values and caps thoff to U16_MAX if it cannot be represented in 16 bits, reporting dissection failure rather than returning incorrect offsets.
CVE-2026-98953 is a vulnerability in the Linux kernel's devlink component involving a reference leak of devlink_rel objects when notify work is pending. The issue arises because the code queues work without checking if it is already pending, causing references to be leaked when the work runs only once but multiple references were taken. This leak can be triggered by repeatedly registering and unregistering nested devlink instances while holding the parent lock, resulting in multiple devlink_rel objects being leaked.
CVE-2026-98950 is a vulnerability in the Linux kernel's flow_dissector component where the hlen value used in bpf_flow_dissect() can be truncated due to u16 limits. This truncation causes offsets to be incorrectly clamped to zero when hlen exceeds 65535, potentially affecting packet flow dissection by BPF programs. The issue is similar to a previously fixed bug but affects the BPF path specifically. The vulnerability has been resolved by capping hlen to the maximum u16 value before clamping.
CVE-2026-98946 is a vulnerability in the Linux kernel's drm/vc4 driver where the V3D interrupt is not properly disabled during runtime suspend on certain ARM platforms. This can cause spurious interrupts after the power domain is off, leading to unexpected behavior such as scheduling of overflow memory work despite cancellation. The issue arises because the ARMCTRL interrupt controller on Raspberry Pi 0-3 does not report active interrupt states, making synchronize_irq() insufficient to quiesce the interrupt handler. The fix involves disabling the interrupt line across the power management transition and adjusting the interrupt request handling to maintain enable/disable balance.
A vulnerability in the Linux kernel ext4 filesystem driver allows a kernel crash due to a NULL pointer dereference when large folios are enabled on encrypted inodes. This occurs because enabling the encrypt feature on a mounted filesystem bypasses checks that disable large folios, leading to a crash during encrypted data writes. The issue affects kernel versions from 6.19 through 7.2 and was fixed by disabling large folios on encrypted inodes in version 7.3, where the code was refactored.
CVE-2026-98939 is a vulnerability in the Linux kernel related to the x86 memory management subsystem. It involves an unnecessary PMD page copy operation during page freeing, which causes a potential deadlock due to circular locking dependencies involving the mmap_lock and pool_shrink_rwsem locks. The issue arises when the kernel attempts to avoid hardware setting Accessed=1 bits in unreachable page table entries, which is unnecessary. The fix removes the PMD copy, detaches the PMD page at the PUD level, flushes mid-level caches, and frees PTE tables directly, eliminating the problematic allocation and locking cycle.
A vulnerability in the Linux kernel's Rust IRQ handling was fixed by ensuring that the RegistrationInner structure is fully initialized before being passed as a cookie to request_irq. Previously, an uninitialized memory read could occur in the IRQ callback due to premature enabling of the IRQ before RegistrationInner was fully initialized. This issue was resolved by changing the initialization order and storing necessary pointers within RegistrationInner before passing it to request_irq.
A vulnerability in the Linux kernel's perf subsystem allowed unprivileged users to request kernel callchain capture without proper permission checks. The flaw was due to incomplete enforcement of kernel profiling privileges when kernel callchains were requested separately from kernel sampling. This has been fixed by updating permission checks to align with requested data, preventing unauthorized kernel callchain collection.
A vulnerability in the Linux kernel's ath11k WiFi driver caused the 'num_stations' counter to not reset properly on hardware restart. This led to the inability to accept new stations or mesh peers after multiple hardware restarts, resulting in warnings and failures to associate new stations.