A vulnerability in the Linux kernel's drm/i915/gem component could cause improper memory cleanup by overstepping the exec array boundary during relocation parsing. This occurs when the function eb_relocate_parse_slow() calls kvfree() on entries beyond the original exec array due to an incremented buffer count that includes appended VMAs. The issue has been resolved by ensuring relocation cleanup uses the original exec object count, excluding appended VMAs.
A race condition vulnerability in the Linux kernel's i915 DRM driver was resolved by ensuring interrupts are only unmasked when the RPS (Render Power State) is active. The flaw involved a timing window where interrupts could be unmasked after the GPU was parked and the runtime power management wakelock was dropped, causing kernel taint due to hardware access without the wakelock held.
A locking order vulnerability in the Linux kernel's Bluetooth RFCOMM implementation (CVE-2026-99009) has been resolved. The issue involves a circular locking dependency between rfcomm_mutex and hdev->lock during RFCOMM socket connection and HCI event handling, which can cause lockdep warnings and potential deadlocks. The fix changes the order of locking by connecting the session socket before acquiring rfcomm_mutex, eliminating the circular dependency. Additional safeguards were added to handle race conditions where sockets or DLCs might be closed during connection setup.
A NULL pointer dereference vulnerability in the Linux kernel Bluetooth RFCOMM subsystem was fixed. The issue occurs in the rfcomm_dev_shutdown() function when closing an RFCOMM tty device. If the tty device registration fails, a NULL pointer dereference can happen because the code does not check if the tty device pointer is NULL before using it. This can lead to a kernel crash (general protection fault). The fix adds a NULL check to prevent this dereference.
A race condition vulnerability in the Linux kernel Bluetooth subsystem (hci_sock) has been resolved. The issue involves rebinding an HCI socket after its controller is unregistered, which can lead to a kernel crash due to a NULL pointer dereference or use-after-free. The root cause is missing serialization when detaching dead devices, allowing concurrent access to freed or nullified device pointers.
A use-after-free vulnerability in the Linux kernel Bluetooth ISO subsystem was resolved. The flaw occurs due to improper handling of concurrent BIS listener setups on the same broadcast socket, leading to a stale socket access and potential memory corruption. The issue was fixed by adding rechecks and rejecting competing setups to prevent connection reference leaks and stale accesses.
A vulnerability in the Linux kernel's XFS filesystem was resolved involving the XFS_IOC_EXCHANGE_RANGE ioctl with the TO_EOF flag. The flaw allowed file size inconsistencies where files could end up with shared blocks beyond EOF, which is invalid. This incorrect file size handling could lead to improper clearing of reflink flags and potential data corruption during writes. The issue was fixed by correcting how file sizes are exchanged and managed during the operation.
A vulnerability in the Linux kernel related to namespace handling has been resolved. The issue involves pseudo dentries, which are special directory entries for pipes, sockets, and other files that are not part of the normal filesystem hierarchy. These pseudo dentries should not become the root of a mount, but bind mounting /proc/self/fd/<fd> can cause this to happen. This leads to a race condition where a dentry can be freed while still being accessed, potentially causing instability. The fix prevents cloning a mount whose root is a pseudo dentry with the DCACHE_NORCU flag.
A vulnerability in the Linux kernel's namespace handling allows the owner of a user namespace to replace its locked /proc or root mount. This occurs due to improper transfer of the locked property when a propagated copy of a mount is moved beneath another mount, potentially exposing files that should remain covered and locked. The issue has been resolved by ensuring the locked property is only transferred to mounts placed by the caller, maintaining proper mount locking behavior.
A vulnerability in the Linux kernel related to the removal of fsnotify marks from a mount namespace in process context has been resolved. The issue involved improper removal of fanotify marks in an invalid context, causing kernel locking bugs and potential system instability. The flaw allowed a root user in a user namespace to leave marks on a mount namespace that could trigger a BUG due to sleeping functions called from invalid contexts during namespace release. The fix ensures marks are removed in process context before the namespace is handed to RCU, preventing the invalid context issue.
A vulnerability in the Linux kernel's drm_bridge_add() function was resolved. The issue involved modifying linked lists without holding the required bridge_lock, potentially causing list corruption when re-adding a previously removed bridge. This could affect the stability of the drm bridge subsystem.
A vulnerability in the Linux kernel related to namespace handling and locked mounts has been resolved. Locked mounts are designed to protect underlying files and directories from being revealed. The flaw allowed an unlocked ancestor mount to expire a locked mount beneath it, potentially exposing protected directories. The fix ensures that locked mounts are not expired independently but only as part of their parent mount, preventing the exposure of hidden files. Lazy unmounts still remove the entire mount tree including locked mounts. This vulnerability is addressed by changes to the expiry logic and mount locking behavior.
A vulnerability in the Linux kernel's mount namespace handling has been resolved. The flaw involves attach_recursive_mnt() not properly considering the topmost mount in a mount namespace file chain, leading to incorrect mountpoint attachment. This can cause mounts to become inaccessible and prevent synchronous unmounting due to lingering child mounts.
A vulnerability in the Linux kernel namespace handling was resolved involving the order of unhashing a dentry before detaching mounts on it. The issue allowed a race condition during unlink(), rmdir(), and rename() operations where the dentry remained hashed and visible between detach_mounts() and d_delete(), potentially exposing mount points that should have been hidden. This race window could be exploited by concurrent lookups to observe mounts that were supposed to be detached. The fix changes the order to unhash the dentry before detaching mounts, preventing lookups from seeing stale mount information.
A vulnerability in the Linux kernel's net/sched subsystem was resolved that involved improper handling of unterminated algorithm names in the em_text module. The flaw allowed an out-of-bounds read and potential kernel memory disclosure when a 16-byte algorithm name without a NUL terminator was passed, causing the kernel to read adjacent memory and invoke a usermode helper with unintended data. The issue was fixed by rejecting attributes lacking a NUL terminator within the expected byte size.
A vulnerability in the Linux kernel's pivot_root() function involves improper checks of mount points before reading their parent mounts. The issue arises when new_root or the caller's root is a file descriptor to a mount that has been unmounted but still kept alive by the file descriptor, potentially leading to a use-after-free condition. The vulnerability causes a read operation on freed memory, resulting in a kernel bug detected by KASAN. The fix involves verifying that both mounts are in the caller's mount namespace before accessing their parents, preventing the unsafe read. All error paths return EINVAL, so no other side effects occur.
A vulnerability in the Linux kernel's drm/vc4 component involved a memory leak where the BO cache size list was not freed during teardown, leading to resource leakage on every unbind operation. This issue has been resolved by ensuring the size list is freed properly in vc4_bo_cache_destroy().
A vulnerability in the Linux kernel's cxgb4 driver related to ch_ktls handling has been resolved. The issue involves improper locking when erasing entries from a shared tid_list array, which can lead to a spinlock deadlock due to softirqs not being disabled during xa_erase operations. The fix involves using xa_erase_bh() to properly disable softirqs and prevent lock contention.
A vulnerability in the Linux kernel's dcache handling has been resolved. The issue involves improper handling of mountpoints on dentries that are being removed, allowing a bind mount of a directory being removed to be moved beneath an existing mount. This causes the mount to remain on the removed directory indefinitely, preventing its detachment. The flaw arises due to a race condition between detach_mounts() and d_delete(), where the victim dentry is still hashed and not properly locked during mount operations.
A use-after-free vulnerability in the Linux kernel's AMT relay component was resolved. The issue involved queuing a packet buffer (skb) referencing a tunnel that could be freed before the packet was processed, leading to a use-after-free in amt_dev_xmit(). The fix changes the relay's General Query sending method to avoid queuing and referencing freed tunnels, removing unsafe skb control block usage. This eliminates the use-after-free condition and related kernel warnings.