CVE-2026-98980 is a high-severity vulnerability in the Linux kernel affecting certain versions of the linux-aws kernel. It involves the namei subsystem where overmounted entries can be revealed during a reference walk (refwalk). This occurs because refwalk does not properly detect unlinked mountpoints, potentially exposing underlying filesystem entries that should be hidden. The issue arises from differences in how lookups and refwalk handle dentries that are unlinked or detached from mounts. The vulnerability has been addressed by adding checks to ensure that entries marked as unlinked and unhashed are not erroneously revealed during refwalk.
CVE-2026-98979 is a vulnerability in the Linux kernel's namespace handling where an automount can be added below a mount that is not in the caller's mount namespace. This flaw allows dereferencing an error pointer leading to a kernel crash (general protection fault) and a null pointer dereference. The issue occurs during mount operations and can block all mount operations system-wide while the namespace semaphore is held. The problem is triggered via fanotify and overlay filesystem interactions. The fix involves using is_mounted() to reject unmounted and internal mounts, causing the open to fail gracefully with EINVAL as before.
CVE-2026-98978 is a vulnerability in the Linux kernel related to the handling of locked mounts within namespaces. Locked mounts are designed to protect underlying files and directories from being revealed. However, due to improper handling in the expiration logic, an unlocked ancestor mount could be unmounted in a way that reveals the contents of a locked mount beneath it. This vulnerability allows unauthorized access to protected directories by exploiting the mount expiration and unmounting sequence. The issue has been resolved by ensuring locked mounts are not expired independently and remain until their parent mounts are removed.
CVE-2026-98977 is a vulnerability in the Linux kernel related to incorrect handling of mount locking for automounts when mounts are propagated across user namespaces. The flaw causes the lock to be applied to the host's mount instead of the child's copy, preventing the host from changing mount flags and potentially leading to permission issues. This occurs because the kernel incorrectly assumes the user namespace of the caller's mount namespace is authoritative, which is not always true for automounts. The issue has been resolved by ensuring the lock is applied based on the namespace where the mount actually occurs.
CVE-2026-98976 is a Linux kernel vulnerability involving improper lock handling on mounts when a propagated copy is moved beneath another mount. This flaw allows a user namespace owner to replace a locked /proc or root mount, potentially exposing sensitive data by unmounting covers that should remain locked. The issue arises from transferring the locked property incorrectly during mount propagation, enabling unauthorized unmount operations and data exposure.
CVE-2026-98975 is a vulnerability in the Linux kernel's XFS filesystem related to improper handling of reflink flags during extent exchanges between files. The flaw occurs when exchanging mappings that cover both files from offset 0 to the disk size, causing incorrect assumptions about shared blocks beyond the file size. This can lead to in-place writes instead of copy-on-write (CoW), resulting in corruption of shared data. The issue affects the XFS_IOC_SWAPEXT operation similarly, where reflink flags were improperly moved between inodes. The fix involves stopping the exchange of reflink flags and ensuring both inodes maintain the flag correctly. The vulnerability has a CVSS score of 7.8 (high severity).
CVE-2026-98974 is a vulnerability in the Linux kernel's XFS filesystem related to the XFS_IOC_EXCHANGE_RANGE ioctl with the TO_EOF flag. The flaw causes incorrect file size handling during range exchanges, allowing files to have shared blocks beyond their end-of-file (EOF), which is invalid. This leads to incorrect clearing of reflink flags and enables writes that overwrite shared blocks past EOF, potentially causing data corruption. The issue arises from swapping on-disk and in-core file sizes incorrectly when nonzero offsets are used. The vulnerability affects multiple Linux kernel versions and has a CVSS score of 7.8 (high severity).
A vulnerability in the Linux kernel's drm_bridge_add() function was fixed to prevent list corruption. The issue involved modifying bridge_lingering_list without holding the required bridge_lock, potentially corrupting internal kernel lists when re-adding a previously removed bridge.
A vulnerability in the Linux kernel's cgroup cpuset subsystem was addressed by modifying the is_in_v2_mode() function to avoid accessing a potentially stale pointer, which could lead to use-after-free conditions. The fix introduces a new cpuset_v2_mode flag to safely determine the mode without dereferencing the root pointer directly.
A vulnerability in the Linux kernel's gpio exar driver involves improper initialization of an ID before registering its cleanup action. This flaw can cause incorrect ID release during failure handling, potentially leading to resource leaks or freeing an ID belonging to another device.
A memory leak vulnerability exists in the Linux kernel's drm/vc4 driver where the BO cache size list is not freed during teardown, causing a resource leak on every unbind operation.
CVE-2026-98969 is a vulnerability in the Linux kernel's net/sched subsystem, specifically in the em_text module. It involves improper validation of a 16-byte algorithm name array that lacks a NUL terminator, leading to an out-of-bounds read and kernel memory disclosure. The flaw occurs when the kernel attempts to autoload a module using this unterminated string, potentially leaking kernel memory contents. The issue was addressed by rejecting attributes without a NUL terminator within the expected size.
CVE-2026-98968 is a use-after-free vulnerability in the Linux kernel's amt network driver. It occurs because a socket buffer (skb) queued in a queuing discipline (qdisc) can outlive the network tunnel it references, leading to a use-after-free condition when the tunnel is freed but the skb is later dequeued and accessed. The vulnerability has been addressed by changing the relay's General Query sending mechanism to avoid queuing the query in the qdisc and instead send it directly from the receive path, eliminating the unsafe reference to the tunnel after it is freed.
A concurrency issue in the Linux kernel's cxgb4/ch_ktls component was resolved by disabling softirqs around tid_list erases. The vulnerability involved improper locking when erasing entries from a shared XArray, which could cause a spinlock deadlock due to softirq interruptions. The fix uses xa_erase_bh() to match the insertion path and prevent this condition.
A vulnerability in the Linux kernel bonding driver caused a program leak when the eXpress Data Path (XDP) program was replaced. The issue involved failing to release the reference on the old BPF program when switching to no program or replacing it with another, leading to accumulation of leaked programs. This flaw has been fixed in specific Linux kernel versions.
CVE-2026-98965 is a vulnerability in the Linux kernel's ice driver for Intel Ethernet Controller E810-XXV on arm64 architectures. The issue arises from the use of writel_relaxed() for updating hardware transmit doorbells, which does not guarantee proper ordering of memory-mapped I/O writes. This can cause a race condition where the NIC starts transmitting before the driver updates the transmit queue accounting state, leading to a kernel BUG and crash under sustained network load. The problem was introduced by a change from writel() to writel_relaxed() and has been resolved by restoring the original writel() usage.
A high-severity vulnerability in the Linux kernel's nvmet subsystem involves improper handling of peer-to-peer (P2P) device references during metadata allocation failures. Specifically, if data allocation succeeds but metadata allocation fails, the cleanup function uses an uninitialized device pointer, potentially causing a use-after-free or similar memory corruption. This issue has been resolved by ensuring the local P2P device is used consistently during cleanup.
A vulnerability in the Linux kernel's btrfs filesystem code related to the handling of I/O completion status has been resolved. The issue involved improper return values after the btrfs_uring_read_extent_endio function, which could cause double unlocking and freeing of resources. This was fixed by always returning -EIOCBQUEUED to ensure only the deferred cleanup path executes.
A vulnerability in the Linux kernel's btrfs filesystem code was fixed involving improper freeing of iov structures when the function btrfs_uring_read_extent() fails. The issue caused a memory free operation to be skipped incorrectly except in a specific error case, potentially leading to resource leaks.
A vulnerability in the Linux kernel's btrfs filesystem code related to improper unlocking of inode and extent locks during io_uring read extent failures has been resolved. The issue involved inconsistent unlocking behavior on failure paths, potentially leading to resource locking issues. The fix ensures that inode and extent locks are properly released on all failure returns in the btrfs_uring_read_extent() function.