A vulnerability in the Linux kernel's RTC driver could leak uninitialized kernel stack data to userspace due to padding holes in the rtc_wkalrm structure. This occurs when the structure is returned via the RTC_WKALRM_RD ioctl call. The issue is resolved by zero-initializing the struct to prevent information leakage.
A vulnerability in the Linux kernel's IPv6 Segment Routing (SR) implementation was resolved by ensuring the use of skb_get_hash_net() in the seg6_make_flowlabel() function. The issue arose because __skb_flow_dissect() requires a network namespace pointer, which was not always correctly provided when skb->dev and skb->sk were unset. This could occur in scenarios such as a TIPC UDP bearer sending discovery messages through an IPv4 route using seg6 encapsulation with seg6_flowlabel enabled. The fix ensures the correct net pointer is used to avoid potential kernel issues.
A vulnerability in the Linux kernel USB hub driver causes an AMD platform issue due to holding a USB3 hub power management runtime reference for 200ms during hub resume. This can lead to crashes on systems using Android adb that frequently wake the USB subsystem. The issue is mitigated by reducing the hold time to 120ms for USB3 root hubs, which is also an optimization. External hubs retain the 200ms hold time. Vendors are working on solutions, and disabling USB runtime PM can prevent the issue.
A use-after-free vulnerability was fixed in the Linux kernel's EDAC/altera driver. The flaw involved freeing a data structure before unregistering IRQ handlers, which could lead to dereferencing freed memory if an interrupt occurred in that window. This issue affects specific versions of the linux-azure kernel and has been assigned CVE-2026-98932 with a high severity rating.
A vulnerability in the Linux kernel's SPI-NAND driver causes a NULL pointer dereference when the NAND device is configured with no ECC engine. This occurs because the code dereferences a NULL pointer unconditionally, leading to a kernel oops during device probing. The issue has been fixed by adding a helper function that safely checks for a pipelined ECC engine, preventing the NULL dereference.
A vulnerability in the Linux kernel's KVM s390 subsystem related to IRQ injection with SIGP Stop and Store Status has been fixed. The issue involved improper handling of status storage while holding a spinlock, which could cause faults. The fix changes the behavior to defer status storage outside the spinlock to avoid this problem.
CVE-2026-98923 is a vulnerability in the Linux kernel's arm64 architecture io subsystem. It involves improper handling of non-user protection flags in the ioremap_prot() function, which causes spurious warnings when mapping certain memory pages with PROT_NONE or execute-only permissions. The issue arises because PROT_NONE mappings are represented by present-invalid page table entries that lack the PTE_USER flag, triggering warnings despite being valid user mappings. The fix ensures ioremap_prot() rejects protection values without PTE_USER without warning, preventing these spurious warnings and enforcing correct user-protection contracts.
A vulnerability in the Linux kernel on the parisc architecture has been addressed by increasing the kernel stack size to 32 KB for 64-bit kernels. This change prevents kernel crashes caused by stack overflows, which were observed during specific workloads such as building the Debian vtk9 package with gcc 17. The issue could lead to kernel panics triggered by low stack detection in interrupt handlers.
A vulnerability in the Linux kernel's AMDGPU driver related to the ATOM command table nesting depth has been addressed. The fix caps the nesting depth at 32 levels and returns an error (-ELOOP) if this limit is exceeded. This prevents potential issues caused by excessive nesting in command tables.
A reference leak vulnerability in the Linux kernel's thunderx network driver was fixed. The issue involved the PTP PCI device reference not being released properly if initialization failed after acquiring the reference in nicvf_probe(). This could lead to resource leaks in affected kernel versions.
A race condition vulnerability in the Linux kernel's imx mailbox driver was addressed by adding a channel shutdown field. The issue involved a timing window where the RX event could be re-enabled after being disabled during shutdown, potentially causing interrupts on a removed channel and triggering an irq-core shutdown with a 'nobody cared' message.
A vulnerability in the Linux kernel's md/raid5 component related to the handling of stripe batch bm_seq comparisons has been resolved. The issue arises when the 32-bit sequence number wraps around, causing newer bm_seq values to appear smaller than older ones, potentially leading to incorrect behavior. The fix involves converting the comparison to a wrap-safe calculation method.
A vulnerability in the Linux kernel's ksmbd component causes a deadlock by holding a read lock while waiting for a lease break acknowledgment, leading to a 35-second timeout delay. This issue affects certain Linux kernel versions and results in significantly increased wait times during lease break handling.
A vulnerability in the Linux kernel's arm_scmi firmware component was addressed by validating the SENSOR_UPDATE payload size. The flaw involved the parser not verifying that the payload contained the expected number of sensor readings before parsing, potentially allowing truncated update notifications to be processed incorrectly. This issue has been resolved by rejecting truncated notifications prior to parsing the variable array.
A vulnerability in the Linux kernel's 8250 serial driver was addressed by recognizing the UPIO_AU UART type to prevent warnings during driver probe on MIPS Alchemy systems. The fix involves acknowledging this UART type without further action, as parameters are already configured elsewhere. This resolves a warning related to unsupported UART type 4 during initialization.
A vulnerability in the Linux kernel's ntfs3 driver related to improper handling of set_blocksize failures has been resolved. The issue arises because ntfs3 uses buffer_heads, which do not handle block sizes larger than PAGE_SIZE correctly. This can cause a kernel BUG_ON condition during mounting, specifically at the folio_set_bh function on the first __bread_gfp call.
A vulnerability in the Linux kernel's netfilter subsystem (nf_conntrack_expect) involves uninitialized data potentially leaking to userspace via ctnetlink. The issue arises from not zeroing memory at allocation time. This vulnerability affects specific Linux kernel versions and has been addressed by ensuring zero initialization during allocation.
A vulnerability in the Linux kernel version 6.18 involves uninitialized memory access in the IRQ handling code written in Rust. The issue arises because the IRQ registration structure (RegistrationInner) is passed as a cookie to request_irq before its fields are fully initialized, leading to potential reads of uninitialized memory in the IRQ callback. This flaw has been fixed in a later commit by ensuring the IRQ registration fields are initialized before passing the structure to request_irq.
A critical SQL injection vulnerability (CVE-2026-114625) in Arista Networks' VeloCloud Orchestrator (VCO) allows remote attackers with authenticated access to escalate privileges to operator level and access internal functionality not intended for remote use. The flaw affects on-premises VCO versions prior to 5.2.3.18, 6.1.3.10, and 6.4.2.12. Arista has patched the vulnerability and already mitigated hosted deployments. Attackers have actively exploited this zero-day, and administrators are urged to update immediately and monitor for suspicious activity.
CVE-2026-113721 is a vulnerability in virtualenv where generated activation files and pyvenv.cfg can follow existing symbolic links and write outside the intended environment. This occurs because the code checks for file existence without handling dangling symlinks properly, allowing writes to unintended targets if an attacker can prepare links in the destination. The vulnerability requires attacker-controlled links and write permissions on the linked targets. It was fixed in versions 1.6.2 and 1.18.1_2.