CVE-2026-99013 is a vulnerability in the Linux kernel's Bluetooth ISO subsystem where concurrent BIS listener setups on the same broadcast socket can cause a use-after-free condition. This occurs because the kernel does not properly check if a socket already has a connection before attaching a new one, leading to a stale socket access. The flaw has been fixed by adding checks to reject competing setups and preserve lock ordering.
CVE-2026-99012 is a high-severity vulnerability in the Linux kernel's Bluetooth ISO subsystem. It involves improper serialization of concurrent connect calls in iso_sock_connect(), allowing race conditions that can lead to use-after-free errors and potential memory corruption. The flaw arises because socket state checks and locking are not properly synchronized, enabling multiple callers to interfere with each other's connection setup. This can cause callbacks on freed sockets, leading to kernel memory safety issues. The vulnerability affects multiple Linux kernel versions used in various Ubuntu releases.
CVE-2026-99011 is a high-severity vulnerability in the Linux kernel's Bluetooth SCO subsystem. It involves a race condition where the lifetime of the sco_conn object is not properly serialized against concurrent access in sco_recv_scodata(), leading to a use-after-free condition. This flaw can cause kernel memory corruption and crashes. The issue arises because the pointer to sco_conn is cleared without proper locking, allowing concurrent reads of a freed object. The fix involves adding proper reference counting and locking to ensure the object remains valid during access.
A memory leak vulnerability exists in the Linux kernel's Bluetooth RFCOMM implementation due to failure to free socket buffers (skb) when a Data Link Connection (DLC) has no owner. This leak occurs because the socket implementation does not free the skb in certain states, causing continuous memory consumption as data frames are received. The issue affects specific Linux kernel versions and has been publicly disclosed.
CVE-2026-99009 is a Linux kernel vulnerability in the Bluetooth RFCOMM subsystem involving improper locking order during session socket connection. The flaw causes a circular locking dependency between rfcomm_mutex and hdev->lock, which can lead to lockdep warnings and potential race conditions. The issue arises when an RFCOMM connect() call is made while a BR/EDR link is authenticating, resulting in inconsistent lock acquisition order. The fix involves changing the connection sequence to connect the session socket before acquiring rfcomm_mutex, eliminating the circular dependency and handling edge cases where sockets or DLCs may be closed during connection.
A null pointer dereference vulnerability in the Linux kernel's Bluetooth RFCOMM subsystem was fixed. The issue occurs in the rfcomm_dev_shutdown function when closing an RFCOMM tty device that was never fully registered, leading to a NULL dereference and kernel crash. The fix adds a check to ensure the tty device pointer is valid before use.
A vulnerability in the Linux kernel's drm/fb-helper subsystem causes improper handling of fbdev_probe() failures. When drm_fb_helper_single_fb_probe() fails with errors other than -EAGAIN, the system does not defer setup properly, leading to stale mode sets being committed and triggering kernel warnings. This issue affects specific linux-azure kernel versions and can cause instability in display mode setting operations.
CVE-2026-99006 is a high-severity vulnerability in the Linux kernel's drm/i915/gem subsystem. It involves improper handling of the exec array boundary in the eb_relocate_parse_slow() function, which can lead to freeing memory outside the intended array. This occurs due to a mismatch between the buffer count used for cleanup and the actual exec object count, potentially causing memory corruption. The issue has been resolved by ensuring relocation cleanup uses the original exec object count, excluding appended VMAs.
CVE-2026-99005 is a vulnerability in the Linux kernel's drm/i915 graphics driver related to unmasking interrupts when the ACTIVE state is false. A race condition can cause interrupts to be unmasked after the graphics technology (GT) has been parked and the runtime power management wakelock dropped, leading to kernel tainting due to hardware access without a held wakelock. The issue arises from a small race window between checking the ACTIVE state and queuing work that handles power management interrupts. The fix ensures interrupts are only unmasked when the ACTIVE state is true, preventing this improper access.
A vulnerability in the Linux kernel's drm/imagination driver caused incorrect sizing of page table preallocation by device address. The flaw led to over-allocation of MMU pages when a mapping crossed a page table boundary, potentially exhausting system memory and causing an out of memory panic. This issue has been fixed by correcting the calculation of the page table size to avoid underflow and excessive allocation.
A vulnerability in the Linux kernel's panthor driver allows unprivileged userspace to request more queues than the firmware has initialized, potentially causing a crash due to dereferencing uninitialized memory. The flaw arises because the queue count validation checks against a hardcoded maximum rather than the actual number of firmware-initialized slots.
A vulnerability in the Linux kernel's drm/vmwgfx component allows improper validation of the pitch value received from userspace. This flaw could lead to out-of-bounds reads when copying data from the underlying surface, potentially exposing sensitive information through cursor snooping. The issue affects specific Linux kernel versions and has a high severity rating with a CVSS score of 7.8.
A use-after-free vulnerability in the Linux kernel's drm/xe/i2c driver was resolved by ensuring proper cancellation of client work during device removal. The flaw involved a work item accessing freed memory after the I2C adapter was unregistered, potentially causing memory corruption or instability. The fix moves the bus notifier unregistration earlier and cancels queued work to prevent use-after-free conditions.
A vulnerability in the Linux kernel's drm/xe subsystem causes incorrect shrinker accounting due to double-subtraction on nested external pins. This leads to underflow in the shrinker's page and object counts, potentially causing excessive invocation of the shrinker under memory pressure. The issue arises because nested pins subtract pages multiple times and nested unpins add them back prematurely. The fix ensures accounting updates only occur on the outermost pin and final unpin, and excludes imported dma-bufs from accounting to prevent underflows.
CVE-2026-98999 is a high-severity vulnerability in the Linux kernel's drm/xe graphics subsystem. It involves a stale pinned_link list entry caused by improper handling of buffer object (bo) pin and unpin operations, leading to a use-after-free condition when the bo is freed but the list still references it. This flaw arises because framebuffer pin/unpin operations bypass the pinned_link management used by external pin/unpin calls, leaving stale references that corrupt kernel memory. The issue has been fixed by consolidating pinned_link removal into a common unpin function that is called on all unpin paths, preventing stale list entries and memory corruption.
A flaw in the Linux kernel's drm/bridge th1520-dw-hdmi driver caused incorrect pointer handling during device removal, leading to improper teardown operations. The issue was fixed by correctly retrieving and passing the appropriate pointer type in the remove() callback.
A vulnerability in the Linux kernel's AMDGPU driver allowed improper acceptance of buffer objects (BOs) as doorbell BOs. This could lead to loss of buffer contents when a regular BO is incorrectly treated as a doorbell BO. The issue was fixed by restricting acceptance to only BOs created in the doorbell domain.
CVE-2026-98996 is a vulnerability in the Linux kernel's mount propagation logic where busy mounts can be silently unmounted. This occurs because the propagate_mount_busy() helper function does not properly check references for certain mount copies with children, allowing a synchronous unmount to succeed even when the mount is still in use. This can lead to mounts being detached unexpectedly, particularly affecting container environments sharing mount trees with the host.
CVE-2026-98995 is a high-severity vulnerability in the Linux kernel related to improper resetting of the old parent's ->overmount pointer in the mnt_change_mountpoint() function. This flaw can lead to a use-after-free (UAF) condition when a mount is moved and the old parent's ->overmount pointer incorrectly references a freed mount. This can cause the kernel to follow dangling pointers, potentially leading to privilege escalation or system compromise.
CVE-2026-98994 is a Linux kernel vulnerability involving the statmount functionality where the parent of an unmounted mount is read under mount_lock. This can lead to dereferencing a mount that has already been freed due to a race condition between statmount_mnt_basic() reading the parent mount and the final mntput() unmounting the children and freeing the parent. The issue arises because the parent mount is not properly pinned when the child mount is unmounted but kept alive by a file descriptor.