A vulnerability in the Linux kernel's dpaa2-switch component was fixed by correcting the error handling in the dpaa2_switch_rx() function. The issue involved improper freeing of frame descriptors on error paths, which could lead to incorrect memory management. The fix involves adjusting the freeing mechanism to properly handle DMA unmapping and page freeing before SKB creation and SKB freeing afterwards.
A vulnerability in the Linux kernel's drm/amdkfd component causes inconsistent trap state and reference count imbalance when kfd_dbg_trap_enable() fails during copy_to_user operation. This occurs because the trap is activated and resources are allocated before the failure, but not properly unwound, potentially breaking later disable/enable operations.
A vulnerability in the Linux kernel's CPSW driver causes the devlink instance to remain registered if port registration fails during the probe process. This occurs because the error handling path does not unregister devlink after a failure in cpsw_register_ports(), potentially leaving stale devlink registrations.
CVE-2026-98908 is a vulnerability in the Linux kernel's Microchip Sparx5 network driver where PSFP (Per-Stream Filtering and Policing) resources are not properly cleaned up on flower setup failure. This can lead to resource leaks due to failure to release allocated stream gate, flow meter, and stream filter resources if a later step in the setup process fails. The flaw also involves incorrect handling of flow meter IDs, potentially leaving reference counts incremented improperly.
A race condition vulnerability in the Linux kernel's btrfs filesystem was addressed by protecting the sb_write_pointer() function with the mapping invalidate lock. This prevents concurrent block size changes from causing inconsistent reads of the super block from the block device page cache.
CVE-2026-98906 is a vulnerability in the Linux kernel's lan966x network driver where the RX state is not fully restored after a reload failure. This can cause inconsistencies between the advertised frame size and the actual RX pages, potentially leading to incorrect behavior in the XDP path. The flaw arises because certain RX state fields and page pool registrations are not restored if resource reallocation fails during MTU changes.
A vulnerability in the Linux kernel's drm/amdkfd component was fixed by properly acquiring queue buffers during CRIU restore. The issue was caused by missing a call to kfd_queue_acquire_buffers() in set_queue_properties_from_criu(), leading to uninitialized buffer fields that subsequent code expected to be non-null.
CVE-2026-98904 is a vulnerability in the Linux kernel's mailbox imx driver related to improper power management runtime handling during device probe and removal. The issue involves early usage of the device before probe completion, which can cause improper device shutdown sequences. The fix involves using devm_pm_runtime_enable() to delay enabling runtime power management until after the device is fully registered, ensuring proper ordering of device removal and power management disablement.
A race condition vulnerability in the Linux kernel's imx mailbox driver was addressed by adding a channel shutdown field. The issue involved a timing window where the RX event could be re-enabled after being disabled during shutdown, potentially causing interrupts on a removed channel and triggering an irq-core shutdown with a 'nobody cared' message.
A vulnerability in the Linux kernel's md/raid5 component related to the handling of stripe batch bm_seq comparisons has been resolved. The issue arises when the 32-bit sequence number wraps around, causing newer bm_seq values to appear smaller than older ones, potentially leading to incorrect behavior. The fix involves converting the comparison to a wrap-safe calculation method.
A vulnerability in the Linux kernel's ksmbd component related to lease break and acknowledgment state handling has been fixed. The issue involved improper handling of valid lease states containing WRITE_CACHING during lease breaks for writes and truncates, and incorrect processing of lease break acknowledgments against SMB2 protocol rules.
CVE-2026-98900 is a vulnerability in the Linux kernel's xen/gntalloc component where the grant count is not validated before allocation. This flaw allows the allocation function to proceed with user-controlled counts that exceed the global grant limit, potentially leading to improper memory allocation behavior. The issue is fixed by validating the grant count before allocation and using a subtraction-based check under a mutex to prevent integer wraparound.
A high-severity vulnerability in the Linux kernel's netfilter ipset subsystem involves improper marking of RCU locked areas. The issue relates to the handling of reference counters and locking mechanisms, which could impact confidentiality, integrity, and availability of affected systems. Multiple specific Linux kernel versions are affected.
A vulnerability in the Linux kernel's AMD GPU driver (drm/amd/pm/si) was fixed to prevent scheduling thermal work when the work queue is not initialized. This issue occurs when Dynamic Power Management (DPM) is disabled using the amdgpu.dpm=0 module parameter, causing the thermal work queue to remain uninitialized. Scheduling work on an uninitialized queue could lead to unexpected behavior or system instability.
A vulnerability in the Linux kernel's ksmbd component causes a deadlock by holding a read lock while waiting for a lease break acknowledgment, leading to a 35-second timeout delay. This issue affects certain Linux kernel versions and results in significantly increased wait times during lease break handling.
A use-after-free vulnerability in the Linux kernel's Thunderbolt hotplug processing was fixed by ensuring the domain reference is kept while handling hotplug events. This prevents potential memory corruption when the domain is removed concurrently with device hotplug events.
A high-severity vulnerability in the Linux kernel's net/mlx5 subsystem involves improper handling when destroying a table that has an associated miss table created by the mlx5hws_table_set_default_miss API. Failure to remove the deleted table from the miss_tbl list results in a list node containing invalid data.
A vulnerability in the Linux kernel's AMD RAS driver allows corrupt CPER ring data to cause a recovery loop hang by not advancing the read pointer. This issue is resolved by resetting the CPER ring to an empty state when no progress is detected, preventing the worker from hanging.
A vulnerability in the Linux kernel's arm_scmi firmware component was addressed by validating the SENSOR_UPDATE payload size. The flaw involved the parser not verifying that the payload contained the expected number of sensor readings before parsing, potentially allowing truncated update notifications to be processed incorrectly. This issue has been resolved by rejecting truncated notifications prior to parsing the variable array.
A vulnerability in the Linux kernel's arm_scmi firmware component involves improper validation of the BASE_ERROR_EVENT payload size. The notification parser used the count of message reports without verifying that the payload contained all reported entries, potentially allowing truncated payloads to be processed.