A high-severity vulnerability in the Linux kernel's netfilter ipset subsystem involves improper marking of RCU locked areas. The issue relates to the handling of reference counters and locking mechanisms, which could impact confidentiality, integrity, and availability of affected systems. Multiple specific Linux kernel versions are affected.
A vulnerability in the Linux kernel's AMD GPU driver (drm/amd/pm/si) was fixed to prevent scheduling thermal work when the work queue is not initialized. This issue occurs when Dynamic Power Management (DPM) is disabled using the amdgpu.dpm=0 module parameter, causing the thermal work queue to remain uninitialized. Scheduling work on an uninitialized queue could lead to unexpected behavior or system instability.
A vulnerability in the Linux kernel's ksmbd component causes a deadlock by holding a read lock while waiting for a lease break acknowledgment, leading to a 35-second timeout delay. This issue affects certain Linux kernel versions and results in significantly increased wait times during lease break handling.
A use-after-free vulnerability in the Linux kernel's Thunderbolt hotplug processing was fixed by ensuring the domain reference is kept while handling hotplug events. This prevents potential memory corruption when the domain is removed concurrently with device hotplug events.
A high-severity vulnerability in the Linux kernel's net/mlx5 subsystem involves improper handling when destroying a table that has an associated miss table created by the mlx5hws_table_set_default_miss API. Failure to remove the deleted table from the miss_tbl list results in a list node containing invalid data.
A vulnerability in the Linux kernel's AMD RAS driver allows corrupt CPER ring data to cause a recovery loop hang by not advancing the read pointer. This issue is resolved by resetting the CPER ring to an empty state when no progress is detected, preventing the worker from hanging.
A vulnerability in the Linux kernel's arm_scmi firmware component was addressed by validating the SENSOR_UPDATE payload size. The flaw involved the parser not verifying that the payload contained the expected number of sensor readings before parsing, potentially allowing truncated update notifications to be processed incorrectly. This issue has been resolved by rejecting truncated notifications prior to parsing the variable array.
A vulnerability in the Linux kernel's arm_scmi firmware component involves improper validation of the BASE_ERROR_EVENT payload size. The notification parser used the count of message reports without verifying that the payload contained all reported entries, potentially allowing truncated payloads to be processed.
A vulnerability in the Linux kernel's mac80211 wireless subsystem allows improper handling of deauthentication frames. The function ieee80211_rx_mgmt_deauth() reads the deauthentication reason code without first verifying that the frame length is sufficient to contain this field. This flaw was addressed by adding validation of the deauth frame length before accessing the reason code.
A vulnerability in the Linux kernel's libertas wifi driver allows short monitor TX frames to be processed without sufficient length checks, potentially causing out-of-bounds reads. The issue arises because the function handling monitor mode frames does not verify that the frame is long enough to contain the expected radiotap TX header and destination address before accessing them.
A vulnerability in the Linux kernel's iwlwifi driver related to scheduled scan Information Element (IE) sizing has been fixed. The issue involved building the probe request before validating IE length, allowing oversized IEs to be copied into a fixed buffer, potentially causing memory corruption. The fix moves the probe request build after the length check and adjusts advertised maximum IE length to account for driver-inserted bytes.
CVE-2026-98888 is a vulnerability in the Linux kernel's arm64 kprobes implementation that mishandles reentry during single-stepping. The flaw occurs when a kprobe is hit while another kprobe is in the single-step state (KPROBE_HIT_SS), which was previously treated as unrecoverable. This could lead to incorrect interrupt state handling, potentially leaving interrupts permanently disabled. The issue has been resolved by allowing reentry in this state and properly saving and restoring interrupt flags.
A vulnerability in the Linux kernel's mac80211_hwsim component allows undersized HWSIM_ATTR_TX_INFO attributes to be accepted, leading to out-of-bounds reads. The issue arises because the handler unconditionally reads a fixed number of entries from a payload without verifying its exact length, potentially causing memory access beyond the intended buffer.
A vulnerability in the Linux kernel's drm/gma500 driver for Oaktrail HDMI I2C reads causes the system to ignore timeout and signal returns during I2C transactions, potentially leading to indefinite waits. This occurs because the wait_for_completion_interruptible_timeout() function's timeout and interrupt signals are not properly handled, causing the loop to wait forever if the transaction state does not advance. The issue has been addressed by returning -ETIMEDOUT on timeout, propagating interrupted waits, and ensuring the I2C master_xfer callback returns the first transfer error instead of a successful message count.
A vulnerability in the Linux kernel's Integrity Measurement Architecture (IMA) component causes improper handling of file extended attributes (xattr) during early boot when the filesystem is read-only. Attempts to change xattr on ext4 filesystems trigger a failing ext4 transaction, leading to system warnings and potential instability. The issue is addressed by returning an error early if the file xattr cannot be changed.
A vulnerability in the Linux kernel MMC core involves improper validation of the host-provided max_segs field. If a host driver sets an excessively large max_segs value, it may be truncated to zero, causing a zero-size memory allocation. This leads to undefined behavior and a kernel crash due to invalid memory access. The issue is addressed by adding validation to detect zero-length scatter-gather lists and returning an error to prevent crashes.
A vulnerability in the Linux kernel's 8250 serial driver was addressed by recognizing the UPIO_AU UART type to prevent warnings during driver probe on MIPS Alchemy systems. The fix involves acknowledging this UART type without further action, as parameters are already configured elsewhere. This resolves a warning related to unsupported UART type 4 during initialization.
A vulnerability in the Linux kernel's chips-media wave5 driver could allow invalid memory writes due to lack of range checks on dec_output_info data. This issue was fixed by adding appropriate range checks to prevent buffer overflow conditions.
CVE-2026-98881 is a vulnerability in the Linux kernel's network bridge component where a stale rcu_barrier() call remains in the br_multicast_dev_del() function. This call is obsolete due to the replacement of call_rcu() with kfree_rcu(), and its presence causes extreme RTNL (runtime network link) pressure, leading to potential task blocking and performance degradation.
A vulnerability in the Linux kernel's ntfs3 driver related to improper handling of set_blocksize failures has been resolved. The issue arises because ntfs3 uses buffer_heads, which do not handle block sizes larger than PAGE_SIZE correctly. This can cause a kernel BUG_ON condition during mounting, specifically at the folio_set_bh function on the first __bread_gfp call.