A vulnerability in the Linux kernel's btrfs filesystem involving io_uring encoded data handling has been resolved. The flaw allowed leaking of btrfs_uring_encoded_data if a request returned -EAGAIN and was cancelled or the io_uring ring exited before reissue. This occurred because io_uring did not free driver PDU allocations on cleanup properly. The issue affected multiple specific Linux kernel versions.
CVE-2026-98959 is a critical vulnerability in the Linux kernel's btrfs filesystem related to extended attribute (xattr) replacement when multiple xattrs are packed in the same item. The flaw causes corruption of the btrfs_dir_item structure during xattr replacement if the new value size differs, leading to filesystem transaction aborts and potential data loss. This occurs because certain fields in the btrfs_dir_item are not properly initialized after deletion and insertion operations. The issue was reproducible with specific xattr names that hash to the same value, triggering the bug during setxattr operations.
CVE-2026-98958 is a vulnerability in the Linux kernel's mt76 WiFi driver where non-AQL frames are incorrectly accounted per link instead of per peer. This causes the frame count to drift upwards, potentially blocking the station. The issue arises because increments and decrements of the non-AQL packet counter occur on different link wcids for MLO peers. The fix involves keeping the count on the wcid of the primary link.
A vulnerability in the Linux kernel's mt7915 WiFi driver causes system instability when unloading and reloading the mt7915e module. The issue arises because the driver does not disable the receive NAPI (New API) before removing the device, triggering warnings and instability especially on MT7916 hardware when changing frequency parameters.
This vulnerability in the Linux kernel's ASoC adau1372 driver involves improper handling of sleepy powerdown GPIOs. The issue arises because gpiod_set_value() emits a WARN when the GPIO provider indicates it can sleep, which is typical for I2C controlled GPIO expanders. The fix involves using the _cansleep variant to allow the driver to use sleepy GPIOs to power off the chip without warnings.
CVE-2026-98955 is a vulnerability in the Linux kernel's flow_dissector component where a 16-bit truncation of skb->len causes incorrect computation of the transport header offset (thoff). This truncation can lead to thoff being set to an invalid small value, causing transport header pointers to reference incorrect locations such as inside the Ethernet header. The issue arises with large skbs (socket buffers) exceeding 64KB, which are increasingly common due to features like GSO and BIG TCP. The fix changes the comparison to use 32-bit values and caps thoff to U16_MAX if it cannot be represented in 16 bits, reporting dissection failure rather than returning incorrect offsets.
A vulnerability in the Linux kernel's __virtio_net_hdr_to_skb() function caused improper dissection of Generic Segmentation Offload (GSO) packets. This flaw allowed malformed network headers to bypass validation, potentially leading to out-of-bounds memory reads during TCP header length calculations. The issue was fixed by ensuring proper initialization of skb fields and removing unsafe fallback code to enforce full packet dissection and validation.
CVE-2026-98953 is a vulnerability in the Linux kernel's devlink component involving a reference leak of devlink_rel objects when notify work is pending. The issue arises because the code queues work without checking if it is already pending, causing references to be leaked when the work runs only once but multiple references were taken. This leak can be triggered by repeatedly registering and unregistering nested devlink instances while holding the parent lock, resulting in multiple devlink_rel objects being leaked.
A vulnerability in the Linux kernel's PFCP implementation allows reading beyond the end of packet data when processing certain PFCP packets with the S flag set. This occurs because the code does not ensure the SEID field is fully linearized before reading, potentially leading to use of uninitialized memory in tunnel metadata. The issue is fixed by properly pulling up the SEID data and dropping packets that are too short.
CVE-2026-98951 is a vulnerability in the Linux kernel's riscv ptrace implementation where regset buffers are not zero-initialized before copying user data. This can lead to uninitialized stack buffer data being used in the target's virtual state and shadow stack pointer. The issue has been resolved by zero-initializing these buffers before use.
CVE-2026-98950 is a vulnerability in the Linux kernel's flow_dissector component where the hlen value used in bpf_flow_dissect() can be truncated due to u16 limits. This truncation causes offsets to be incorrectly clamped to zero when hlen exceeds 65535, potentially affecting packet flow dissection by BPF programs. The issue is similar to a previously fixed bug but affects the BPF path specifically. The vulnerability has been resolved by capping hlen to the maximum u16 value before clamping.
A vulnerability in the Linux kernel's drm/imagination driver involving incorrect handling of GEM references and vm_bo linkage in the remap() function has been fixed. The flaw caused reference leaks and mismatched object links during GPU virtual address remapping, leading to resource leaks and warnings. The issue was addressed by correcting the linkage to the appropriate vm_bo object. This affects specific Linux kernel versions listed and is rated medium severity.
A resource leak vulnerability was fixed in the Linux kernel's mlxsw spectrum_flower module. The flaw involved port range registers being acquired but not released during template creation, leading to a leak. The issue was addressed by refactoring resource release code and ensuring proper cleanup during template creation.
A memory leak vulnerability was identified and fixed in the Linux kernel's vsock component, specifically in the vmci_transport_recv_dgram_cb() function. The issue occurs during the closure of a datagram socket, where packets are improperly managed between the socket's backlog and receive queue, leading to unreleased memory. This flaw was detected by syzkaller and reported by InfoTeCS on behalf of the Linux Verification Center. The fix involves adding receive queue cleanup in the socket destructor to prevent the leak.
CVE-2026-98946 is a vulnerability in the Linux kernel's drm/vc4 driver where the V3D interrupt is not properly disabled during runtime suspend on certain ARM platforms. This can cause spurious interrupts after the power domain is off, leading to unexpected behavior such as scheduling of overflow memory work despite cancellation. The issue arises because the ARMCTRL interrupt controller on Raspberry Pi 0-3 does not report active interrupt states, making synchronize_irq() insufficient to quiesce the interrupt handler. The fix involves disabling the interrupt line across the power management transition and adjusting the interrupt request handling to maintain enable/disable balance.
A vulnerability in the Linux kernel's HID steam driver was fixed by rearranging the teardown sequence to prevent callbacks from being scheduled during cleanup, which could lead to dangling pointers. The fix also moves work canceling for rumble and mode switch to steam_unregister to avoid persistence while the client hdev is open.
CVE-2026-98944 addresses a vulnerability in the Linux kernel's HID steam driver related to the registration and unregistration process. The issue involved improper handling of power_supply objects due to missing unregistration steps, which could leave lingering objects after the steam device was torn down. The fix refactors the registration logic to simplify and correct this behavior, removing assumptions about serial numbers and ensuring proper cleanup.
CVE-2026-98942 is a vulnerability in the Linux kernel's scheduler extension (sched_ext) related to how cid tables are built and published. The issue arises because the cid tables are visible to kernel functions while being modified, allowing a racing tracing or syscall program to read uninitialized or inconsistent memory. The fix involves building cid tables privately and publishing them only when fully constructed, ensuring readers see only fully built tables. This prevents reading uninitialized memory or torn updates during concurrent access.
A vulnerability in the Linux kernel ext4 filesystem driver allows a kernel crash due to a NULL pointer dereference when large folios are enabled on encrypted inodes. This occurs because enabling the encrypt feature on a mounted filesystem bypasses checks that disable large folios, leading to a crash during encrypted data writes. The issue affects kernel versions from 6.19 through 7.2 and was fixed by disabling large folios on encrypted inodes in version 7.3, where the code was refactored.
A flaw in the Linux kernel ASoC qcom lpass-cpu driver caused incorrect indexing of the DAI driver table when configuring playback constraints. This could lead to out-of-bounds memory writes on platforms where DAI IDs are sparse, such as IPQ806x. The issue was fixed by using the loop index instead of the DAI ID for indexing the driver table during playback constraint updates.