A vulnerability in the Linux kernel's RTC driver could leak uninitialized kernel stack data to userspace due to padding holes in the rtc_wkalrm structure. This occurs when the structure is returned via the RTC_WKALRM_RD ioctl call. The issue is resolved by zero-initializing the struct to prevent information leakage.
CVE-2026-98925 is a vulnerability in the Linux kernel's BPF sockmap implementation where a self-redirect of packets causes double-counting of the copied_seq TCP sequence number. This leads to warnings and potential instability in TCP receive message handling. The issue is fixed by changing the handling of self-redirect verdicts to avoid double advancement of copied_seq.
A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session. ZCS 10.1.17 blocks that XSS chain by changing the document renderer, but retains the request attribute override.
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-50053, an attacker with an ordinary Zimbra account can supply their own authentication token and document identifiers in a URL and execute JavaScript in another signed-in user's Zimbra browser session when that user opens the URL. This permits reading mailbox data and performing authenticated actions as the victim. The issue affects ZCS 10.1.16 and was remediated in 10.1.17.
CVE-2026-112859 is a critical deserialization of untrusted data vulnerability in ThemeREX Group's Little Birdies product, affecting versions up to 1.3.16. The flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability.
CVE-2026-99083 is a high-severity vulnerability in the Linux kernel's ksmbd component affecting versions from 5.15.145 up to but not including 5.16, 6.1.40 up to but not including 6.2, 6.4.5 up to but not including 6.5, and version 6.5. The flaw is a heap out-of-bounds write in the krb5_authenticate() function caused by an incorrect calculation of buffer headroom when processing compounded SMB2_SESSION_SETUP requests. This miscalculation allows memcpy() to overwrite adjacent kernel heap memory. The issue has been fixed in Linux kernel versions 5.16, 6.2, and 6.5.
A vulnerability in the Linux kernel's net/sched subsystem (em_text) allows a kernel memory disclosure due to an out-of-bounds read. The flaw occurs because the algo field, a 16-byte array without enforced NUL termination, is passed to textsearch_prepare(), which expects a NUL-terminated string. This can cause reading beyond the array boundary into adjacent memory, leaking kernel memory contents. The issue is fixed by rejecting attributes lacking a NUL byte within the expected length.
A vulnerability in the Linux kernel's flow_dissector component caused incorrect computation of the transport header offset (thoff) due to 16-bit truncation of skb->len. This truncation led to thoff being set to an incorrect small value for packets larger than 64KB, potentially causing callers to misinterpret packet headers. The issue affects multiple Linux kernel versions and has been fixed in later releases.
CVE-2026-98950 is a vulnerability in the Linux kernel's flow_dissector component where a 16-bit truncation error occurs in the bpf_flow_dissect() function when handling the hlen value. This truncation can cause offsets to be incorrectly set to zero even if the BPF program returns valid values. The issue was fixed by capping hlen to the maximum value of a 16-bit unsigned integer before clamping. The vulnerability affects Linux kernel version 4.20 and has been resolved in subsequent commits.
A vulnerability in the Linux kernel's media video-i2c driver was fixed by ensuring the proper use of vb2_video_unregister_device during driver removal. The issue involved incorrect device unregistration that could lead to improper disconnection of the vb2 queue.
CVE-2026-98908 is a vulnerability in the Linux kernel's Microchip Sparx5 network driver where PSFP (Per-Stream Filtering and Policing) resources are not properly cleaned up on flower setup failure. This can lead to resource leaks due to failure to release allocated stream gate, flow meter, and stream filter resources if a later step in the setup process fails. The flaw also involves incorrect handling of flow meter IDs, potentially leaving reference counts incremented improperly.
A vulnerability in the Linux kernel's drm/amdkfd component was fixed by properly acquiring queue buffers during CRIU restore. The issue was caused by missing a call to kfd_queue_acquire_buffers() in set_queue_properties_from_criu(), leading to uninitialized buffer fields that subsequent code expected to be non-null.
A vulnerability in the Linux kernel's md/raid5 component related to the handling of stripe batch bm_seq comparisons has been resolved. The issue arises when the 32-bit sequence number wraps around, causing newer bm_seq values to appear smaller than older ones, potentially leading to incorrect behavior. The fix involves converting the comparison to a wrap-safe calculation method.
A vulnerability in the Linux kernel's ksmbd component causes a deadlock by holding a read lock while waiting for a lease break acknowledgment, leading to a 35-second timeout delay. This issue affects certain Linux kernel versions and results in significantly increased wait times during lease break handling.
A high-severity vulnerability in the Linux kernel's net/mlx5 subsystem involves improper handling when destroying a table that has an associated miss table created by the mlx5hws_table_set_default_miss API. Failure to remove the deleted table from the miss_tbl list results in a list node containing invalid data.
A vulnerability in the Linux kernel's drm/gma500 driver for Oaktrail HDMI I2C reads causes the system to ignore timeout and signal returns during I2C transactions, potentially leading to indefinite waits. This occurs because the wait_for_completion_interruptible_timeout() function's timeout and interrupt signals are not properly handled, causing the loop to wait forever if the transaction state does not advance. The issue has been addressed by returning -ETIMEDOUT on timeout, propagating interrupted waits, and ensuring the I2C master_xfer callback returns the first transfer error instead of a successful message count.
A vulnerability in the Linux kernel's Integrity Measurement Architecture (IMA) component causes improper handling of file extended attributes (xattr) during early boot when the filesystem is read-only. Attempts to change xattr on ext4 filesystems trigger a failing ext4 transaction, leading to system warnings and potential instability. The issue is addressed by returning an error early if the file xattr cannot be changed.
A vulnerability in the Linux kernel's 8250 serial driver was addressed by recognizing the UPIO_AU UART type to prevent warnings during driver probe on MIPS Alchemy systems. The fix involves acknowledging this UART type without further action, as parameters are already configured elsewhere. This resolves a warning related to unsupported UART type 4 during initialization.