CVE-2026-98918 is a vulnerability in the Linux kernel's DAMON subsystem where an unaligned address is used in damon_ptep_mkold(), causing out-of-bounds writes during page table walks on arm64 architectures. This can lead to kernel crashes or memory corruption depending on the memory page following the page table. The issue was triggered by kernel self-tests and results from changes in how page table entries are walked and cleared. The fix involves passing a page-aligned address to the affected function to prevent overruns.
A vulnerability in the Linux kernel on the parisc architecture has been addressed by increasing the kernel stack size to 32 KB for 64-bit kernels. This change prevents kernel crashes caused by stack overflows, which were observed during specific workloads such as building the Debian vtk9 package with gcc 17. The issue could lead to kernel panics triggered by low stack detection in interrupt handlers.
A vulnerability in the Linux kernel's wifi nl80211 component was addressed by adding a check to ensure the link is beaconing before performing a color change. This prevents the driver from being called with an invalid link state.
A vulnerability in the Linux kernel's media video-i2c driver was fixed by ensuring the proper use of vb2_video_unregister_device during driver removal. The issue involved incorrect device unregistration that could lead to improper disconnection of the vb2 queue.
A vulnerability in the Linux kernel's AMDGPU driver related to the ATOM command table nesting depth has been addressed. The fix caps the nesting depth at 32 levels and returns an error (-ELOOP) if this limit is exceeded. This prevents potential issues caused by excessive nesting in command tables.
A reference leak vulnerability in the Linux kernel's thunderx network driver was fixed. The issue involved the PTP PCI device reference not being released properly if initialization failed after acquiring the reference in nicvf_probe(). This could lead to resource leaks in affected kernel versions.
A vulnerability in the Linux kernel ALSA sequencer OSS interface causes incorrect handling of read buffer sizes, leading to improper event processing. The flaw is due to an inverted check that mishandles whether the next event fits in the userspace buffer, potentially causing undersized reads to appear as end-of-file while leaving events queued improperly.
A vulnerability in the Linux kernel's dpaa2-switch component was fixed by correcting the error handling in the dpaa2_switch_rx() function. The issue involved improper freeing of frame descriptors on error paths, which could lead to incorrect memory management. The fix involves adjusting the freeing mechanism to properly handle DMA unmapping and page freeing before SKB creation and SKB freeing afterwards.
A vulnerability in the Linux kernel's drm/amdkfd component causes inconsistent trap state and reference count imbalance when kfd_dbg_trap_enable() fails during copy_to_user operation. This occurs because the trap is activated and resources are allocated before the failure, but not properly unwound, potentially breaking later disable/enable operations.
A vulnerability in the Linux kernel's CPSW driver causes the devlink instance to remain registered if port registration fails during the probe process. This occurs because the error handling path does not unregister devlink after a failure in cpsw_register_ports(), potentially leaving stale devlink registrations.
CVE-2026-98908 is a vulnerability in the Linux kernel's Microchip Sparx5 network driver where PSFP (Per-Stream Filtering and Policing) resources are not properly cleaned up on flower setup failure. This can lead to resource leaks due to failure to release allocated stream gate, flow meter, and stream filter resources if a later step in the setup process fails. The flaw also involves incorrect handling of flow meter IDs, potentially leaving reference counts incremented improperly.
A race condition vulnerability in the Linux kernel's btrfs filesystem was addressed by protecting the sb_write_pointer() function with the mapping invalidate lock. This prevents concurrent block size changes from causing inconsistent reads of the super block from the block device page cache.
CVE-2026-98906 is a vulnerability in the Linux kernel's lan966x network driver where the RX state is not fully restored after a reload failure. This can cause inconsistencies between the advertised frame size and the actual RX pages, potentially leading to incorrect behavior in the XDP path. The flaw arises because certain RX state fields and page pool registrations are not restored if resource reallocation fails during MTU changes.
A vulnerability in the Linux kernel's drm/amdkfd component was fixed by properly acquiring queue buffers during CRIU restore. The issue was caused by missing a call to kfd_queue_acquire_buffers() in set_queue_properties_from_criu(), leading to uninitialized buffer fields that subsequent code expected to be non-null.
CVE-2026-98904 is a vulnerability in the Linux kernel's mailbox imx driver related to improper power management runtime handling during device probe and removal. The issue involves early usage of the device before probe completion, which can cause improper device shutdown sequences. The fix involves using devm_pm_runtime_enable() to delay enabling runtime power management until after the device is fully registered, ensuring proper ordering of device removal and power management disablement.
A race condition vulnerability in the Linux kernel's imx mailbox driver was addressed by adding a channel shutdown field. The issue involved a timing window where the RX event could be re-enabled after being disabled during shutdown, potentially causing interrupts on a removed channel and triggering an irq-core shutdown with a 'nobody cared' message.
A vulnerability in the Linux kernel's md/raid5 component related to the handling of stripe batch bm_seq comparisons has been resolved. The issue arises when the 32-bit sequence number wraps around, causing newer bm_seq values to appear smaller than older ones, potentially leading to incorrect behavior. The fix involves converting the comparison to a wrap-safe calculation method.
A vulnerability in the Linux kernel's ksmbd component related to lease break and acknowledgment state handling has been fixed. The issue involved improper handling of valid lease states containing WRITE_CACHING during lease breaks for writes and truncates, and incorrect processing of lease break acknowledgments against SMB2 protocol rules.
CVE-2026-98900 is a vulnerability in the Linux kernel's xen/gntalloc component where the grant count is not validated before allocation. This flaw allows the allocation function to proceed with user-controlled counts that exceed the global grant limit, potentially leading to improper memory allocation behavior. The issue is fixed by validating the grant count before allocation and using a subtraction-based check under a mutex to prevent integer wraparound.
A high-severity vulnerability in the Linux kernel's netfilter ipset subsystem involves improper marking of RCU locked areas. The issue relates to the handling of reference counters and locking mechanisms, which could impact confidentiality, integrity, and availability of affected systems. Multiple specific Linux kernel versions are affected.