CVE-2026-98953 is a vulnerability in the Linux kernel's devlink component involving a reference leak of devlink_rel objects when notify work is pending. The issue arises because the code queues work without checking if it is already pending, causing references to be leaked when the work runs only once but multiple references were taken. This leak can be triggered by repeatedly registering and unregistering nested devlink instances while holding the parent lock, resulting in multiple devlink_rel objects being leaked.
A vulnerability in the Linux kernel's PFCP implementation allows reading beyond the end of packet data when processing certain PFCP packets with the S flag set. This occurs because the code does not ensure the SEID field is fully linearized before reading, potentially leading to use of uninitialized memory in tunnel metadata. The issue is fixed by properly pulling up the SEID data and dropping packets that are too short.
CVE-2026-98951 is a vulnerability in the Linux kernel's riscv ptrace implementation where regset buffers are not zero-initialized before copying user data. This can lead to uninitialized stack buffer data being used in the target's virtual state and shadow stack pointer. The issue has been resolved by zero-initializing these buffers before use.
CVE-2026-98950 is a vulnerability in the Linux kernel's flow_dissector component where the hlen value used in bpf_flow_dissect() can be truncated due to u16 limits. This truncation causes offsets to be incorrectly clamped to zero when hlen exceeds 65535, potentially affecting packet flow dissection by BPF programs. The issue is similar to a previously fixed bug but affects the BPF path specifically. The vulnerability has been resolved by capping hlen to the maximum u16 value before clamping.
A vulnerability in the Linux kernel's drm/imagination driver involving incorrect handling of GEM references and vm_bo linkage in the remap() function has been fixed. The flaw caused reference leaks and mismatched object links during GPU virtual address remapping, leading to resource leaks and warnings. The issue was addressed by correcting the linkage to the appropriate vm_bo object. This affects specific Linux kernel versions listed and is rated medium severity.
A resource leak vulnerability was fixed in the Linux kernel's mlxsw spectrum_flower module. The flaw involved port range registers being acquired but not released during template creation, leading to a leak. The issue was addressed by refactoring resource release code and ensuring proper cleanup during template creation.
A memory leak vulnerability was identified and fixed in the Linux kernel's vsock component, specifically in the vmci_transport_recv_dgram_cb() function. The issue occurs during the closure of a datagram socket, where packets are improperly managed between the socket's backlog and receive queue, leading to unreleased memory. This flaw was detected by syzkaller and reported by InfoTeCS on behalf of the Linux Verification Center. The fix involves adding receive queue cleanup in the socket destructor to prevent the leak.
CVE-2026-98946 is a vulnerability in the Linux kernel's drm/vc4 driver where the V3D interrupt is not properly disabled during runtime suspend on certain ARM platforms. This can cause spurious interrupts after the power domain is off, leading to unexpected behavior such as scheduling of overflow memory work despite cancellation. The issue arises because the ARMCTRL interrupt controller on Raspberry Pi 0-3 does not report active interrupt states, making synchronize_irq() insufficient to quiesce the interrupt handler. The fix involves disabling the interrupt line across the power management transition and adjusting the interrupt request handling to maintain enable/disable balance.
A vulnerability in the Linux kernel's HID steam driver was fixed by rearranging the teardown sequence to prevent callbacks from being scheduled during cleanup, which could lead to dangling pointers. The fix also moves work canceling for rumble and mode switch to steam_unregister to avoid persistence while the client hdev is open.
CVE-2026-98944 addresses a vulnerability in the Linux kernel's HID steam driver related to the registration and unregistration process. The issue involved improper handling of power_supply objects due to missing unregistration steps, which could leave lingering objects after the steam device was torn down. The fix refactors the registration logic to simplify and correct this behavior, removing assumptions about serial numbers and ensuring proper cleanup.
CVE-2026-98942 is a vulnerability in the Linux kernel's scheduler extension (sched_ext) related to how cid tables are built and published. The issue arises because the cid tables are visible to kernel functions while being modified, allowing a racing tracing or syscall program to read uninitialized or inconsistent memory. The fix involves building cid tables privately and publishing them only when fully constructed, ensuring readers see only fully built tables. This prevents reading uninitialized memory or torn updates during concurrent access.
A vulnerability in the Linux kernel ext4 filesystem driver allows a kernel crash due to a NULL pointer dereference when large folios are enabled on encrypted inodes. This occurs because enabling the encrypt feature on a mounted filesystem bypasses checks that disable large folios, leading to a crash during encrypted data writes. The issue affects kernel versions from 6.19 through 7.2 and was fixed by disabling large folios on encrypted inodes in version 7.3, where the code was refactored.
A flaw in the Linux kernel ASoC qcom lpass-cpu driver caused incorrect indexing of the DAI driver table when configuring playback constraints. This could lead to out-of-bounds memory writes on platforms where DAI IDs are sparse, such as IPQ806x. The issue was fixed by using the loop index instead of the DAI ID for indexing the driver table during playback constraint updates.
CVE-2026-98939 is a vulnerability in the Linux kernel related to the x86 memory management subsystem. It involves an unnecessary PMD page copy operation during page freeing, which causes a potential deadlock due to circular locking dependencies involving the mmap_lock and pool_shrink_rwsem locks. The issue arises when the kernel attempts to avoid hardware setting Accessed=1 bits in unreachable page table entries, which is unnecessary. The fix removes the PMD copy, detaches the PMD page at the PUD level, flushes mid-level caches, and frees PTE tables directly, eliminating the problematic allocation and locking cycle.
A vulnerability in the Linux kernel's Rust IRQ handling was fixed by ensuring that the RegistrationInner structure is fully initialized before being passed as a cookie to request_irq. Previously, an uninitialized memory read could occur in the IRQ callback due to premature enabling of the IRQ before RegistrationInner was fully initialized. This issue was resolved by changing the initialization order and storing necessary pointers within RegistrationInner before passing it to request_irq.
A vulnerability in the Linux kernel's perf subsystem allowed unprivileged users to request kernel callchain capture without proper permission checks. The flaw was due to incomplete enforcement of kernel profiling privileges when kernel callchains were requested separately from kernel sampling. This has been fixed by updating permission checks to align with requested data, preventing unauthorized kernel callchain collection.
A vulnerability in the Linux kernel's ath11k WiFi driver caused the 'num_stations' counter to not reset properly on hardware restart. This led to the inability to accept new stations or mesh peers after multiple hardware restarts, resulting in warnings and failures to associate new stations.
A vulnerability in the Linux kernel's RTC driver could leak uninitialized kernel stack data to userspace due to padding holes in the rtc_wkalrm structure. This occurs when the structure is returned via the RTC_WKALRM_RD ioctl call. The issue is resolved by zero-initializing the struct to prevent information leakage.
A vulnerability in the Linux kernel's IPv6 Segment Routing (SR) implementation was resolved by ensuring the use of skb_get_hash_net() in the seg6_make_flowlabel() function. The issue arose because __skb_flow_dissect() requires a network namespace pointer, which was not always correctly provided when skb->dev and skb->sk were unset. This could occur in scenarios such as a TIPC UDP bearer sending discovery messages through an IPv4 route using seg6 encapsulation with seg6_flowlabel enabled. The fix ensures the correct net pointer is used to avoid potential kernel issues.
A vulnerability in the Linux kernel USB hub driver causes an AMD platform issue due to holding a USB3 hub power management runtime reference for 200ms during hub resume. This can lead to crashes on systems using Android adb that frequently wake the USB subsystem. The issue is mitigated by reducing the hold time to 120ms for USB3 root hubs, which is also an optimization. External hubs retain the 200ms hold time. Vendors are working on solutions, and disabling USB runtime PM can prevent the issue.