CVE-2026-99019 is a vulnerability in the Linux kernel's SCSI changer driver (ch) where references to data transfer element devices are improperly retained. This causes scsi_device references to leak when drives are removed, preventing their release and blocking new devices from being recognized at the same address. The issue leads to increased module use counts and prevents unloading of the low-level driver module until a reboot occurs. The flaw affects certain Linux kernel versions and has been resolved by dropping references immediately after use and removing the unused array.
CVE-2026-99018 is a high-severity vulnerability in the Linux kernel's RISC-V architecture support related to the shadow call stack handling on trap entry. The kernel incorrectly decides whether to reload the shadow call stack pointer based on a user-writable register (tp) rather than the hardware-controlled sstatus.SPP bit. This flaw allows an unprivileged user to manipulate the kernel shadow call stack pointer, leading to arbitrary kernel memory writes and control-flow hijacking. The issue affects multiple specific Linux kernel versions and has been resolved by changing the check to rely on the hardware SPP bit, which cannot be forged by user mode. The vulnerability has a CVSS score of 7.8 and no known exploits in the wild.
A vulnerability in the Linux kernel's RISC-V architecture handling involves improper detection and mitigation of the THEAD GHOSTWRITE erratum. The issue arises because the mitigation is only applied if the CPU vulnerability is detected during an early boot stage enabled by a specific configuration flag. If the kernel is built with ERRATA_THEAD_GHOSTWRITE enabled but ERRATA_THEAD_MAE disabled, the vulnerability is not detected, leaving the system unprotected despite being vulnerable. This affects certain Linux kernel versions and can lead to high impact on confidentiality, integrity, and availability.
CVE-2026-99016 is a vulnerability in the Linux kernel's RISC-V futex implementation where the user pointer is not properly untagged before atomic operations. This can allow an unprivileged process to perform atomic read-modify-write operations on arbitrary kernel memory addresses, potentially leading to high impact including confidentiality, integrity, and availability violations. The issue arises due to a mismatch between the pointer checked by access_ok() and the pointer used in atomic operations when tagged address ABI is enabled. The vulnerability affects specific Linux kernel versions listed and has a CVSS score of 7.8 (high severity).
A vulnerability in the Linux kernel Bluetooth subsystem (hci_sock) allows a race condition during dead-device detachment. This can lead to a NULL pointer dereference or use-after-free, causing kernel crashes. The flaw arises from improper serialization when rebinding an HCI socket after its controller is unregistered, resulting in unsafe access to device pointers.
A use-after-free vulnerability in the Linux kernel Bluetooth subsystem was fixed in the hci_sync component during passive scan setup. The flaw involved improper handling of command skb lifetimes, leading to potential memory corruption. The issue was addressed by serializing access with a mutex and copying the address before releasing the lock to prevent use-after-free conditions.
CVE-2026-99013 is a vulnerability in the Linux kernel's Bluetooth ISO subsystem where concurrent BIS listener setups on the same broadcast socket can cause a use-after-free condition. This occurs because the kernel does not properly check if a socket already has a connection before attaching a new one, leading to a stale socket access. The flaw has been fixed by adding checks to reject competing setups and preserve lock ordering.
CVE-2026-99012 is a high-severity vulnerability in the Linux kernel's Bluetooth ISO subsystem. It involves improper serialization of concurrent connect calls in iso_sock_connect(), allowing race conditions that can lead to use-after-free errors and potential memory corruption. The flaw arises because socket state checks and locking are not properly synchronized, enabling multiple callers to interfere with each other's connection setup. This can cause callbacks on freed sockets, leading to kernel memory safety issues. The vulnerability affects multiple Linux kernel versions used in various Ubuntu releases.
CVE-2026-99011 is a high-severity vulnerability in the Linux kernel's Bluetooth SCO subsystem. It involves a race condition where the lifetime of the sco_conn object is not properly serialized against concurrent access in sco_recv_scodata(), leading to a use-after-free condition. This flaw can cause kernel memory corruption and crashes. The issue arises because the pointer to sco_conn is cleared without proper locking, allowing concurrent reads of a freed object. The fix involves adding proper reference counting and locking to ensure the object remains valid during access.
A memory leak vulnerability exists in the Linux kernel's Bluetooth RFCOMM implementation due to failure to free socket buffers (skb) when a Data Link Connection (DLC) has no owner. This leak occurs because the socket implementation does not free the skb in certain states, causing continuous memory consumption as data frames are received. The issue affects specific Linux kernel versions and has been publicly disclosed.
CVE-2026-99009 is a Linux kernel vulnerability in the Bluetooth RFCOMM subsystem involving improper locking order during session socket connection. The flaw causes a circular locking dependency between rfcomm_mutex and hdev->lock, which can lead to lockdep warnings and potential race conditions. The issue arises when an RFCOMM connect() call is made while a BR/EDR link is authenticating, resulting in inconsistent lock acquisition order. The fix involves changing the connection sequence to connect the session socket before acquiring rfcomm_mutex, eliminating the circular dependency and handling edge cases where sockets or DLCs may be closed during connection.
A null pointer dereference vulnerability in the Linux kernel's Bluetooth RFCOMM subsystem was fixed. The issue occurs in the rfcomm_dev_shutdown function when closing an RFCOMM tty device that was never fully registered, leading to a NULL dereference and kernel crash. The fix adds a check to ensure the tty device pointer is valid before use.
A vulnerability in the Linux kernel's drm/fb-helper subsystem causes improper handling of fbdev_probe() failures. When drm_fb_helper_single_fb_probe() fails with errors other than -EAGAIN, the system does not defer setup properly, leading to stale mode sets being committed and triggering kernel warnings. This issue affects specific linux-azure kernel versions and can cause instability in display mode setting operations.
CVE-2026-99006 is a high-severity vulnerability in the Linux kernel's drm/i915/gem subsystem. It involves improper handling of the exec array boundary in the eb_relocate_parse_slow() function, which can lead to freeing memory outside the intended array. This occurs due to a mismatch between the buffer count used for cleanup and the actual exec object count, potentially causing memory corruption. The issue has been resolved by ensuring relocation cleanup uses the original exec object count, excluding appended VMAs.
CVE-2026-99005 is a vulnerability in the Linux kernel's drm/i915 graphics driver related to unmasking interrupts when the ACTIVE state is false. A race condition can cause interrupts to be unmasked after the graphics technology (GT) has been parked and the runtime power management wakelock dropped, leading to kernel tainting due to hardware access without a held wakelock. The issue arises from a small race window between checking the ACTIVE state and queuing work that handles power management interrupts. The fix ensures interrupts are only unmasked when the ACTIVE state is true, preventing this improper access.
A vulnerability in the Linux kernel's drm/imagination driver caused incorrect sizing of page table preallocation by device address. The flaw led to over-allocation of MMU pages when a mapping crossed a page table boundary, potentially exhausting system memory and causing an out of memory panic. This issue has been fixed by correcting the calculation of the page table size to avoid underflow and excessive allocation.
A vulnerability in the Linux kernel's panthor driver allows unprivileged userspace to request more queues than the firmware has initialized, potentially causing a crash due to dereferencing uninitialized memory. The flaw arises because the queue count validation checks against a hardcoded maximum rather than the actual number of firmware-initialized slots.
A vulnerability in the Linux kernel's drm/vmwgfx component allows improper validation of the pitch value received from userspace. This flaw could lead to out-of-bounds reads when copying data from the underlying surface, potentially exposing sensitive information through cursor snooping. The issue affects specific Linux kernel versions and has a high severity rating with a CVSS score of 7.8.
A use-after-free vulnerability in the Linux kernel's drm/xe/i2c driver was resolved by ensuring proper cancellation of client work during device removal. The flaw involved a work item accessing freed memory after the I2C adapter was unregistered, potentially causing memory corruption or instability. The fix moves the bus notifier unregistration earlier and cancels queued work to prevent use-after-free conditions.
A vulnerability in the Linux kernel's drm/xe subsystem causes incorrect shrinker accounting due to double-subtraction on nested external pins. This leads to underflow in the shrinker's page and object counts, potentially causing excessive invocation of the shrinker under memory pressure. The issue arises because nested pins subtract pages multiple times and nested unpins add them back prematurely. The fix ensures accounting updates only occur on the outermost pin and final unpin, and excludes imported dma-bufs from accounting to prevent underflows.