A vulnerability in the Linux kernel's drm_bridge_add() function was fixed to prevent list corruption. The issue involved modifying bridge_lingering_list without holding the required bridge_lock, potentially corrupting internal kernel lists when re-adding a previously removed bridge.
A vulnerability in the Linux kernel's cgroup cpuset subsystem was addressed by modifying the is_in_v2_mode() function to avoid accessing a potentially stale pointer, which could lead to use-after-free conditions. The fix introduces a new cpuset_v2_mode flag to safely determine the mode without dereferencing the root pointer directly.
A vulnerability in the Linux kernel's gpio exar driver involves improper initialization of an ID before registering its cleanup action. This flaw can cause incorrect ID release during failure handling, potentially leading to resource leaks or freeing an ID belonging to another device.
A memory leak vulnerability exists in the Linux kernel's drm/vc4 driver where the BO cache size list is not freed during teardown, causing a resource leak on every unbind operation.
CVE-2026-98969 is a vulnerability in the Linux kernel's net/sched subsystem, specifically in the em_text module. It involves improper validation of a 16-byte algorithm name array that lacks a NUL terminator, leading to an out-of-bounds read and kernel memory disclosure. The flaw occurs when the kernel attempts to autoload a module using this unterminated string, potentially leaking kernel memory contents. The issue was addressed by rejecting attributes without a NUL terminator within the expected size.
CVE-2026-98968 is a use-after-free vulnerability in the Linux kernel's amt network driver. It occurs because a socket buffer (skb) queued in a queuing discipline (qdisc) can outlive the network tunnel it references, leading to a use-after-free condition when the tunnel is freed but the skb is later dequeued and accessed. The vulnerability has been addressed by changing the relay's General Query sending mechanism to avoid queuing the query in the qdisc and instead send it directly from the receive path, eliminating the unsafe reference to the tunnel after it is freed.
A concurrency issue in the Linux kernel's cxgb4/ch_ktls component was resolved by disabling softirqs around tid_list erases. The vulnerability involved improper locking when erasing entries from a shared XArray, which could cause a spinlock deadlock due to softirq interruptions. The fix uses xa_erase_bh() to match the insertion path and prevent this condition.
A vulnerability in the Linux kernel bonding driver caused a program leak when the eXpress Data Path (XDP) program was replaced. The issue involved failing to release the reference on the old BPF program when switching to no program or replacing it with another, leading to accumulation of leaked programs. This flaw has been fixed in specific Linux kernel versions.
CVE-2026-98965 is a vulnerability in the Linux kernel's ice driver for Intel Ethernet Controller E810-XXV on arm64 architectures. The issue arises from the use of writel_relaxed() for updating hardware transmit doorbells, which does not guarantee proper ordering of memory-mapped I/O writes. This can cause a race condition where the NIC starts transmitting before the driver updates the transmit queue accounting state, leading to a kernel BUG and crash under sustained network load. The problem was introduced by a change from writel() to writel_relaxed() and has been resolved by restoring the original writel() usage.
A high-severity vulnerability in the Linux kernel's nvmet subsystem involves improper handling of peer-to-peer (P2P) device references during metadata allocation failures. Specifically, if data allocation succeeds but metadata allocation fails, the cleanup function uses an uninitialized device pointer, potentially causing a use-after-free or similar memory corruption. This issue has been resolved by ensuring the local P2P device is used consistently during cleanup.
A vulnerability in the Linux kernel's btrfs filesystem code related to the handling of I/O completion status has been resolved. The issue involved improper return values after the btrfs_uring_read_extent_endio function, which could cause double unlocking and freeing of resources. This was fixed by always returning -EIOCBQUEUED to ensure only the deferred cleanup path executes.
A vulnerability in the Linux kernel's btrfs filesystem code was fixed involving improper freeing of iov structures when the function btrfs_uring_read_extent() fails. The issue caused a memory free operation to be skipped incorrectly except in a specific error case, potentially leading to resource leaks.
A vulnerability in the Linux kernel's btrfs filesystem code related to improper unlocking of inode and extent locks during io_uring read extent failures has been resolved. The issue involved inconsistent unlocking behavior on failure paths, potentially leading to resource locking issues. The fix ensures that inode and extent locks are properly released on all failure returns in the btrfs_uring_read_extent() function.
A vulnerability in the Linux kernel's btrfs filesystem involving io_uring encoded data handling has been resolved. The flaw allowed leaking of btrfs_uring_encoded_data if a request returned -EAGAIN and was cancelled or the io_uring ring exited before reissue. This occurred because io_uring did not free driver PDU allocations on cleanup properly. The issue affected multiple specific Linux kernel versions.
CVE-2026-98959 is a critical vulnerability in the Linux kernel's btrfs filesystem related to extended attribute (xattr) replacement when multiple xattrs are packed in the same item. The flaw causes corruption of the btrfs_dir_item structure during xattr replacement if the new value size differs, leading to filesystem transaction aborts and potential data loss. This occurs because certain fields in the btrfs_dir_item are not properly initialized after deletion and insertion operations. The issue was reproducible with specific xattr names that hash to the same value, triggering the bug during setxattr operations.
CVE-2026-98958 is a vulnerability in the Linux kernel's mt76 WiFi driver where non-AQL frames are incorrectly accounted per link instead of per peer. This causes the frame count to drift upwards, potentially blocking the station. The issue arises because increments and decrements of the non-AQL packet counter occur on different link wcids for MLO peers. The fix involves keeping the count on the wcid of the primary link.
A vulnerability in the Linux kernel's mt7915 WiFi driver causes system instability when unloading and reloading the mt7915e module. The issue arises because the driver does not disable the receive NAPI (New API) before removing the device, triggering warnings and instability especially on MT7916 hardware when changing frequency parameters.
This vulnerability in the Linux kernel's ASoC adau1372 driver involves improper handling of sleepy powerdown GPIOs. The issue arises because gpiod_set_value() emits a WARN when the GPIO provider indicates it can sleep, which is typical for I2C controlled GPIO expanders. The fix involves using the _cansleep variant to allow the driver to use sleepy GPIOs to power off the chip without warnings.
CVE-2026-98955 is a vulnerability in the Linux kernel's flow_dissector component where a 16-bit truncation of skb->len causes incorrect computation of the transport header offset (thoff). This truncation can lead to thoff being set to an invalid small value, causing transport header pointers to reference incorrect locations such as inside the Ethernet header. The issue arises with large skbs (socket buffers) exceeding 64KB, which are increasingly common due to features like GSO and BIG TCP. The fix changes the comparison to use 32-bit values and caps thoff to U16_MAX if it cannot be represented in 16 bits, reporting dissection failure rather than returning incorrect offsets.
A vulnerability in the Linux kernel's __virtio_net_hdr_to_skb() function caused improper dissection of Generic Segmentation Offload (GSO) packets. This flaw allowed malformed network headers to bypass validation, potentially leading to out-of-bounds memory reads during TCP header length calculations. The issue was fixed by ensuring proper initialization of skb fields and removing unsafe fallback code to enforce full packet dissection and validation.