A use-after-free vulnerability was fixed in the Linux kernel's EDAC/altera driver. The flaw involved freeing a data structure before unregistering IRQ handlers, which could lead to dereferencing freed memory if an interrupt occurred in that window. This issue affects specific versions of the linux-azure kernel and has been assigned CVE-2026-98932 with a high severity rating.
A vulnerability in the Linux kernel's SPI-NAND driver causes a NULL pointer dereference when the NAND device is configured with no ECC engine. This occurs because the code dereferences a NULL pointer unconditionally, leading to a kernel oops during device probing. The issue has been fixed by adding a helper function that safely checks for a pipelined ECC engine, preventing the NULL dereference.
A vulnerability in the Linux kernel's KVM s390 subsystem related to IRQ injection with SIGP Stop and Store Status has been fixed. The issue involved improper handling of status storage while holding a spinlock, which could cause faults. The fix changes the behavior to defer status storage outside the spinlock to avoid this problem.
A vulnerability in the Linux kernel's macsec driver occurs due to improper initialization order of the SecY component before registering the network device. This can trigger warnings and cause uninitialized SecY attributes to be reported during device registration. The issue has existed since the driver was introduced and affects specific Linux Azure kernel versions.
A vulnerability in the Linux kernel's KVM arm64 implementation involves incorrect handling of the SVE feature bit at EL2. The issue arises because the guest's SVE flag is derived separately from the host's SVE feature bit, leading to a situation where a virtual CPU (vCPU) may have a NULL SVE state. This can cause the world switch to load the guest's SVE state improperly. The vulnerability has been resolved by deriving the guest's SVE flag directly from the feature bit and removing redundant code related to protected VMs.
A vulnerability in the Linux kernel's KVM arm64 module related to the lifecycle management of the nested_mmus array has been fixed. The nested_mmus array holds shadow page tables for nested virtualization contexts. Improper handling could lead to use-after-free conditions when the array is reallocated during VCPU initialization while a vCPU is running. The fix changes the array to an array of pointers allocated at VM creation to avoid reallocation and clarifies object lifecycle management.
A vulnerability in the Linux kernel's AMD display driver related to DPMS (Display Power Management Signaling) was resolved by removing unsafe usage of the optional stream->sink pointer. The fix ensures that stream->sink is checked before dereference and replaces stream->sink->link with stream->link to avoid null pointer dereferences and resource inconsistencies.
CVE-2026-98925 is a vulnerability in the Linux kernel's BPF sockmap implementation where a self-redirect of packets causes double-counting of the copied_seq TCP sequence number. This leads to warnings and potential instability in TCP receive message handling. The issue is fixed by changing the handling of self-redirect verdicts to avoid double advancement of copied_seq.
CVE-2026-98924 is a vulnerability in the Linux kernel's filesystem code that caused repeated scans in the evict_inodes() function during device removal. This issue led to hung tasks when unmounting filesystems after disk removal while still in use. The flaw was due to evict_inodes() restarting inode scans from the head of the list after dropping a lock, causing delays and blocking concurrent unmount attempts. The patch changes the inode eviction logic to avoid repeated scans and prevents the previously reproducible hung task condition.
CVE-2026-98923 is a vulnerability in the Linux kernel's arm64 architecture io subsystem. It involves improper handling of non-user protection flags in the ioremap_prot() function, which causes spurious warnings when mapping certain memory pages with PROT_NONE or execute-only permissions. The issue arises because PROT_NONE mappings are represented by present-invalid page table entries that lack the PTE_USER flag, triggering warnings despite being valid user mappings. The fix ensures ioremap_prot() rejects protection values without PTE_USER without warning, preventing these spurious warnings and enforcing correct user-protection contracts.
CVE-2026-98921 is a use-after-free vulnerability in the Linux kernel's overlay filesystem (ovl) component. It occurs in the ovl_do_mkdir() function's debug print logic when CONFIG_OVERLAY_FS_DEBUG is enabled. The issue arises because the function prints a dentry pointer after a call to vfs_mkdir(), which may free or replace the dentry, leading to use-after-free. The fix involves printing the dentry before the call and only printing the result afterward.
A vulnerability in the Linux kernel's netfs subsystem related to missing allocation tagging of direct mempool allocations has been fixed. The issue caused allocation tags to be unset during certain memory allocations, leading to warnings and missing allocation information in /proc/allocinfo. This was due to direct calls to allocation callbacks bypassing the alloc_hooks wrapper. The fix introduces a new helper to ensure proper tagging without changing allocation failure semantics.
CVE-2026-98919 is a vulnerability in the Linux kernel's drm/xe driver affecting the adjust_idledly() function. It involves multiple corner-case issues including divide-by-zero errors and integer overflows due to improper handling of clock initialization and tick-to-nanosecond conversions. These issues can cause kernel panics and repeated warnings during initialization. The vulnerability has been addressed by adding early returns to avoid divide-by-zero, using 64-bit arithmetic to prevent overflow, and properly clamping delay values to avoid invalid programming of hardware registers.
CVE-2026-98918 is a vulnerability in the Linux kernel's DAMON subsystem where an unaligned address is used in damon_ptep_mkold(), causing out-of-bounds writes during page table walks on arm64 architectures. This can lead to kernel crashes or memory corruption depending on the memory page following the page table. The issue was triggered by kernel self-tests and results from changes in how page table entries are walked and cleared. The fix involves passing a page-aligned address to the affected function to prevent overruns.
A vulnerability in the Linux kernel on the parisc architecture has been addressed by increasing the kernel stack size to 32 KB for 64-bit kernels. This change prevents kernel crashes caused by stack overflows, which were observed during specific workloads such as building the Debian vtk9 package with gcc 17. The issue could lead to kernel panics triggered by low stack detection in interrupt handlers.
A vulnerability in the Linux kernel's wifi nl80211 component was addressed by adding a check to ensure the link is beaconing before performing a color change. This prevents the driver from being called with an invalid link state.
A vulnerability in the Linux kernel's media video-i2c driver was fixed by ensuring the proper use of vb2_video_unregister_device during driver removal. The issue involved incorrect device unregistration that could lead to improper disconnection of the vb2 queue.
A vulnerability in the Linux kernel's AMDGPU driver related to the ATOM command table nesting depth has been addressed. The fix caps the nesting depth at 32 levels and returns an error (-ELOOP) if this limit is exceeded. This prevents potential issues caused by excessive nesting in command tables.
A reference leak vulnerability in the Linux kernel's thunderx network driver was fixed. The issue involved the PTP PCI device reference not being released properly if initialization failed after acquiring the reference in nicvf_probe(). This could lead to resource leaks in affected kernel versions.
A vulnerability in the Linux kernel ALSA sequencer OSS interface causes incorrect handling of read buffer sizes, leading to improper event processing. The flaw is due to an inverted check that mishandles whether the next event fits in the userspace buffer, potentially causing undersized reads to appear as end-of-file while leaving events queued improperly.