A vulnerability in the Linux kernel's Rust IRQ handling was fixed by ensuring that the RegistrationInner structure is fully initialized before being passed as a cookie to request_irq. Previously, an uninitialized memory read could occur in the IRQ callback due to premature enabling of the IRQ before RegistrationInner was fully initialized. This issue was resolved by changing the initialization order and storing necessary pointers within RegistrationInner before passing it to request_irq.
A vulnerability in the Linux kernel's perf subsystem allowed unprivileged users to request kernel callchain capture without proper permission checks. The flaw was due to incomplete enforcement of kernel profiling privileges when kernel callchains were requested separately from kernel sampling. This has been fixed by updating permission checks to align with requested data, preventing unauthorized kernel callchain collection.
A vulnerability in the Linux kernel's ath11k WiFi driver caused the 'num_stations' counter to not reset properly on hardware restart. This led to the inability to accept new stations or mesh peers after multiple hardware restarts, resulting in warnings and failures to associate new stations.
A vulnerability in the Linux kernel's RTC driver could leak uninitialized kernel stack data to userspace due to padding holes in the rtc_wkalrm structure. This occurs when the structure is returned via the RTC_WKALRM_RD ioctl call. The issue is resolved by zero-initializing the struct to prevent information leakage.
A vulnerability in the Linux kernel's IPv6 Segment Routing (SR) implementation was resolved by ensuring the use of skb_get_hash_net() in the seg6_make_flowlabel() function. The issue arose because __skb_flow_dissect() requires a network namespace pointer, which was not always correctly provided when skb->dev and skb->sk were unset. This could occur in scenarios such as a TIPC UDP bearer sending discovery messages through an IPv4 route using seg6 encapsulation with seg6_flowlabel enabled. The fix ensures the correct net pointer is used to avoid potential kernel issues.
A vulnerability in the Linux kernel USB hub driver causes an AMD platform issue due to holding a USB3 hub power management runtime reference for 200ms during hub resume. This can lead to crashes on systems using Android adb that frequently wake the USB subsystem. The issue is mitigated by reducing the hold time to 120ms for USB3 root hubs, which is also an optimization. External hubs retain the 200ms hold time. Vendors are working on solutions, and disabling USB runtime PM can prevent the issue.
A use-after-free vulnerability was fixed in the Linux kernel's EDAC/altera driver. The flaw involved freeing a data structure before unregistering IRQ handlers, which could lead to dereferencing freed memory if an interrupt occurred in that window. This issue affects specific versions of the linux-azure kernel and has been assigned CVE-2026-98932 with a high severity rating.
A vulnerability in the Linux kernel's SPI-NAND driver causes a NULL pointer dereference when the NAND device is configured with no ECC engine. This occurs because the code dereferences a NULL pointer unconditionally, leading to a kernel oops during device probing. The issue has been fixed by adding a helper function that safely checks for a pipelined ECC engine, preventing the NULL dereference.
A vulnerability in the Linux kernel's KVM s390 subsystem related to IRQ injection with SIGP Stop and Store Status has been fixed. The issue involved improper handling of status storage while holding a spinlock, which could cause faults. The fix changes the behavior to defer status storage outside the spinlock to avoid this problem.
A vulnerability in the Linux kernel's macsec driver occurs due to improper initialization order of the SecY component before registering the network device. This can trigger warnings and cause uninitialized SecY attributes to be reported during device registration. The issue has existed since the driver was introduced and affects specific Linux Azure kernel versions.
A vulnerability in the Linux kernel's KVM arm64 implementation involves incorrect handling of the SVE feature bit at EL2. The issue arises because the guest's SVE flag is derived separately from the host's SVE feature bit, leading to a situation where a virtual CPU (vCPU) may have a NULL SVE state. This can cause the world switch to load the guest's SVE state improperly. The vulnerability has been resolved by deriving the guest's SVE flag directly from the feature bit and removing redundant code related to protected VMs.
A vulnerability in the Linux kernel's KVM arm64 module related to the lifecycle management of the nested_mmus array has been fixed. The nested_mmus array holds shadow page tables for nested virtualization contexts. Improper handling could lead to use-after-free conditions when the array is reallocated during VCPU initialization while a vCPU is running. The fix changes the array to an array of pointers allocated at VM creation to avoid reallocation and clarifies object lifecycle management.
A vulnerability in the Linux kernel's AMD display driver related to DPMS (Display Power Management Signaling) was resolved by removing unsafe usage of the optional stream->sink pointer. The fix ensures that stream->sink is checked before dereference and replaces stream->sink->link with stream->link to avoid null pointer dereferences and resource inconsistencies.
CVE-2026-98925 is a vulnerability in the Linux kernel's BPF sockmap implementation where a self-redirect of packets causes double-counting of the copied_seq TCP sequence number. This leads to warnings and potential instability in TCP receive message handling. The issue is fixed by changing the handling of self-redirect verdicts to avoid double advancement of copied_seq.
CVE-2026-98924 is a vulnerability in the Linux kernel's filesystem code that caused repeated scans in the evict_inodes() function during device removal. This issue led to hung tasks when unmounting filesystems after disk removal while still in use. The flaw was due to evict_inodes() restarting inode scans from the head of the list after dropping a lock, causing delays and blocking concurrent unmount attempts. The patch changes the inode eviction logic to avoid repeated scans and prevents the previously reproducible hung task condition.
CVE-2026-98923 is a vulnerability in the Linux kernel's arm64 architecture io subsystem. It involves improper handling of non-user protection flags in the ioremap_prot() function, which causes spurious warnings when mapping certain memory pages with PROT_NONE or execute-only permissions. The issue arises because PROT_NONE mappings are represented by present-invalid page table entries that lack the PTE_USER flag, triggering warnings despite being valid user mappings. The fix ensures ioremap_prot() rejects protection values without PTE_USER without warning, preventing these spurious warnings and enforcing correct user-protection contracts.
CVE-2026-98922 is a vulnerability in the Linux kernel's emac network driver that caused a kernel crash due to a NULL pointer dereference during driver initialization. The issue arose because the network device operations (netdev_ops) were not set before calling of_phy_connect(), leading to a crash on affected PowerPC 44x platforms such as the WD MyBook Live. The fix involved moving the setting of netdev_ops earlier in the initialization sequence to ensure proper assignment before use. This resolves the kernel oops and restores device functionality.
CVE-2026-98921 is a use-after-free vulnerability in the Linux kernel's overlay filesystem (ovl) component. It occurs in the ovl_do_mkdir() function's debug print logic when CONFIG_OVERLAY_FS_DEBUG is enabled. The issue arises because the function prints a dentry pointer after a call to vfs_mkdir(), which may free or replace the dentry, leading to use-after-free. The fix involves printing the dentry before the call and only printing the result afterward.
A vulnerability in the Linux kernel's netfs subsystem related to missing allocation tagging of direct mempool allocations has been fixed. The issue caused allocation tags to be unset during certain memory allocations, leading to warnings and missing allocation information in /proc/allocinfo. This was due to direct calls to allocation callbacks bypassing the alloc_hooks wrapper. The fix introduces a new helper to ensure proper tagging without changing allocation failure semantics.
CVE-2026-98919 is a vulnerability in the Linux kernel's drm/xe driver affecting the adjust_idledly() function. It involves multiple corner-case issues including divide-by-zero errors and integer overflows due to improper handling of clock initialization and tick-to-nanosecond conversions. These issues can cause kernel panics and repeated warnings during initialization. The vulnerability has been addressed by adding early returns to avoid divide-by-zero, using 64-bit arithmetic to prevent overflow, and properly clamping delay values to avoid invalid programming of hardware registers.