A vulnerability in the Linux kernel's nouveau DRM driver was resolved that involved incorrect handling of pin counts when a re-pin operation failed. Specifically, the function nouveau_bo_pin_locked() would increment the pin count even when the re-pin failed due to incompatible memory domains, leading to a mismatch in pin/unpin operations and triggering warnings in the kernel. This issue was discovered through fuzz testing and could cause kernel warnings related to resource management.
A vulnerability in the Linux kernel's KVM arm64 implementation caused a WARN on unknown VM ioctl calls in protected mode, which could lead to a panic on hosts configured with panic_on_warn. This issue occurs because the function kvm_pkvm_ioctl_allowed() triggers a WARN when an ioctl number is not found in vm_ioctl_caps[], and the architecture-specific ioctl handler calls this for unrecognized ioctl numbers. Userspace can trigger this by issuing an ioctl with an arbitrary number, causing the host to become tainted and potentially panic.
A vulnerability in the Linux kernel's XFS filesystem was resolved involving improper handling of the dquot flush lock. The function xfs_qm_flush_one failed to release the dquot flush lock if it could not find the buffer to flush, potentially causing a lock to remain held indefinitely. This issue was identified and fixed by ensuring the lock is dropped even when no buffer is found.
A vulnerability in the Linux kernel's XFS filesystem code could cause an integer underflow in the hidden_space calculation within xfs_metafile_resv_init. This occurs when the reserved fdblocks for a metadata btree file are less than the space already used, leading to a large incorrect subtraction in xfs_dec_fdblocks. The issue has been fixed by correcting the logic to prevent the target from being less than the used space.
A vulnerability in the Linux kernel's XFS filesystem was resolved that involved memory allocation failures during online repair operations. Specifically, a failure in allocating memory for new btree blocks could cause block leaks and potentially crash the filesystem repair process. The underlying issue was that the code could not properly undo partial transactions on error, leading to filesystem instability. The fix involved changing the allocation to a no-fail approach for a small reservation object, preventing the failure scenario.
CVE-2026-98729 is a vulnerability in the Linux kernel affecting x86 memory management on AMD F15h processors. The issue arises because the kernel incorrectly applies virtual address alignment (va_align) to hugetlb mappings, causing address misalignment and triggering a kernel bug during huge page teardown. This affects certain AMD processors such as Carrizo and FX-8370E. The flaw has been resolved by modifying the alignment logic to skip randomization for hugetlbfs mappings.
CVE-2026-98689 is a high-severity vulnerability in the Linux kernel's Thunderbolt driver related to DisplayPort (DP) tunnel handling. The flaw occurs when the kernel accesses a DP tunnel after its DPRX read operation has been canceled, leading to potential use of torn-down resources during system suspend or domain shutdown. This happens due to improper synchronization and flag checking around the cancellation and stopping of DPRX reads. The issue affects specific Linux kernel versions used in various Ubuntu LTS releases.
CVE-2026-98622 is a vulnerability in the Linux kernel's net/sched subsystem where a WARN is triggered on benign failures of flow_offload_alloc(), which occur during normal operation under load. This WARN can cause a kernel panic if panic_on_warn=1 is set, allowing an unprivileged user to crash the system by racing conntrack flushes against a traffic control classifier using the ct commit action. The issue has been fixed by removing the unnecessary WARN without changing behavior.
CVE-2026-98543 is a vulnerability in the Linux kernel related to BPF LSM programs and inode locking assumptions in the path_unlink and path_rmdir hooks. The issue arises because these hooks run before the victim inode's i_rwsem lock is taken, allowing a sleepable BPF LSM program to mutate extended attributes (xattrs) without holding the required lock. The fix involves dropping these hooks from the d_inode_locked_hooks list so that the verifier uses locking variants of BPF functions that take the lock themselves.
A deadlock vulnerability in the Linux kernel scheduler extension (sched_ext) was fixed by ensuring ops.dequeue() is not called while holding a DSQ lock. Previously, invoking ops.dequeue() with the source user DSQ's lock held could cause self-deadlocks in BPF schedulers that lock the source user DSQ during iteration. The fix moves the ops.dequeue() call to after the DSQ unlock, preventing deadlocks and ensuring callbacks are invoked exactly once.
A vulnerability in the Linux kernel's of/overlay subsystem could cause fragment references to leak when the changeset initialization fails. This occurs because the count of initialized fragments is only stored on full success, leading to incomplete cleanup and potential resource leaks when partial initialization fails.
A vulnerability in the Linux kernel Bluetooth subsystem's hci_sync component causes a backlog of synchronous HCI commands to accumulate during device unregister, leading to prolonged blocking and potential system hang. This occurs because queued commands wait for a timeout when the controller does not respond, and the backlog is unbounded. The issue has been fixed by preventing new entries from being processed once unregistering starts and properly cancelling pending requests.