A vulnerability in the Linux kernel's mac80211 wireless subsystem allows improper handling of deauthentication frames. The function ieee80211_rx_mgmt_deauth() reads the deauthentication reason code without first verifying that the frame length is sufficient to contain this field. This flaw was addressed by adding validation of the deauth frame length before accessing the reason code.
A vulnerability in the Linux kernel's libertas wifi driver allows short monitor TX frames to be processed without sufficient length checks, potentially causing out-of-bounds reads. The issue arises because the function handling monitor mode frames does not verify that the frame is long enough to contain the expected radiotap TX header and destination address before accessing them.
A vulnerability in the Linux kernel's iwlwifi driver related to scheduled scan Information Element (IE) sizing has been fixed. The issue involved building the probe request before validating IE length, allowing oversized IEs to be copied into a fixed buffer, potentially causing memory corruption. The fix moves the probe request build after the length check and adjusts advertised maximum IE length to account for driver-inserted bytes.
CVE-2026-98888 is a vulnerability in the Linux kernel's arm64 kprobes implementation that mishandles reentry during single-stepping. The flaw occurs when a kprobe is hit while another kprobe is in the single-step state (KPROBE_HIT_SS), which was previously treated as unrecoverable. This could lead to incorrect interrupt state handling, potentially leaving interrupts permanently disabled. The issue has been resolved by allowing reentry in this state and properly saving and restoring interrupt flags.
A vulnerability in the Linux kernel's mac80211_hwsim component allows undersized HWSIM_ATTR_TX_INFO attributes to be accepted, leading to out-of-bounds reads. The issue arises because the handler unconditionally reads a fixed number of entries from a payload without verifying its exact length, potentially causing memory access beyond the intended buffer.
A vulnerability in the Linux kernel's drm/gma500 driver for Oaktrail HDMI I2C reads causes the system to ignore timeout and signal returns during I2C transactions, potentially leading to indefinite waits. This occurs because the wait_for_completion_interruptible_timeout() function's timeout and interrupt signals are not properly handled, causing the loop to wait forever if the transaction state does not advance. The issue has been addressed by returning -ETIMEDOUT on timeout, propagating interrupted waits, and ensuring the I2C master_xfer callback returns the first transfer error instead of a successful message count.
A vulnerability in the Linux kernel's Integrity Measurement Architecture (IMA) component causes improper handling of file extended attributes (xattr) during early boot when the filesystem is read-only. Attempts to change xattr on ext4 filesystems trigger a failing ext4 transaction, leading to system warnings and potential instability. The issue is addressed by returning an error early if the file xattr cannot be changed.
A vulnerability in the Linux kernel MMC core involves improper validation of the host-provided max_segs field. If a host driver sets an excessively large max_segs value, it may be truncated to zero, causing a zero-size memory allocation. This leads to undefined behavior and a kernel crash due to invalid memory access. The issue is addressed by adding validation to detect zero-length scatter-gather lists and returning an error to prevent crashes.
A vulnerability in the Linux kernel's 8250 serial driver was addressed by recognizing the UPIO_AU UART type to prevent warnings during driver probe on MIPS Alchemy systems. The fix involves acknowledging this UART type without further action, as parameters are already configured elsewhere. This resolves a warning related to unsupported UART type 4 during initialization.
A vulnerability in the Linux kernel's chips-media wave5 driver could allow invalid memory writes due to lack of range checks on dec_output_info data. This issue was fixed by adding appropriate range checks to prevent buffer overflow conditions.
CVE-2026-98881 is a vulnerability in the Linux kernel's network bridge component where a stale rcu_barrier() call remains in the br_multicast_dev_del() function. This call is obsolete due to the replacement of call_rcu() with kfree_rcu(), and its presence causes extreme RTNL (runtime network link) pressure, leading to potential task blocking and performance degradation.
A vulnerability in the Linux kernel's ntfs3 driver related to improper handling of set_blocksize failures has been resolved. The issue arises because ntfs3 uses buffer_heads, which do not handle block sizes larger than PAGE_SIZE correctly. This can cause a kernel BUG_ON condition during mounting, specifically at the folio_set_bh function on the first __bread_gfp call.
A vulnerability in the Linux kernel's isofs filesystem handling has been resolved. The issue involves improper handling of set_blocksize failures due to isofs using buffer_heads, which do not support block sizes larger than PAGE_SIZE. This can cause a kernel BUG_ON error during mounting, specifically triggered by an offset check in folio_set_bh on the first __bread_gfp call.
A vulnerability in the Linux kernel's irqchip/gic-v5 driver causes a delay in priority dropping after interrupt activation, potentially blocking new interrupts and causing a denial of service. This occurs because the priority drop was previously done during interrupt deactivation rather than immediately after acknowledgment. The issue affects certain Linux kernel versions and has been resolved by moving the priority drop to occur immediately after interrupt acknowledgment.
A vulnerability in the Linux kernel's irqchip/gic-v4 component causes a kernel panic due to a NULL pointer dereference when the system is configured with kvm-arm.vgic_v4_enable=1 but lacks an MSI controller device tree node and GICv4. The issue arises because the kernel attempts to access a NULL gic_domain pointer. The fix involves disabling vLPI support at initialization if no ITS is present, preventing the kernel panic.
A vulnerability in the Linux kernel's host1x bus driver was fixed by adding a missing null check for client operations during error teardown. Without this check, a NULL pointer dereference could occur if client->ops is NULL, potentially causing a kernel crash. The issue affects specific Linux kernel versions and has been addressed by adding the necessary null checks in the error teardown paths.
A vulnerability in the Linux kernel's nouveau DRM driver related to the GA100 chip's SEC2 falcon was fixed by adding the SEC2 entry to the chip table. Without this fix, a NULL pointer dereference occurs during the GSP-RM boot process, causing a crash.
This vulnerability in the Linux kernel's iwlwifi driver relates to handling WoWLAN suspend operations without netdetect configured. The issue caused a WARN_ON() warning when suspending WoWLAN without network detection, which is now resolved by removing the warning and properly handling the suspend call.
A vulnerability in the Linux kernel's netfilter subsystem (nf_conntrack_expect) involves uninitialized data potentially leaking to userspace via ctnetlink. The issue arises from not zeroing memory at allocation time. This vulnerability affects specific Linux kernel versions and has been addressed by ensuring zero initialization during allocation.
A vulnerability in the Linux kernel's freevxfs filesystem code causes a kernel crash (BUG) when encountering an unknown typed-extent type during ioctl(FIBMAP) operations on regular files. The issue arises because vxfs_bmap_typed() calls BUG() for unrecognized extent types, leading to a kernel panic. The fix replaces BUG() with WARN_ON_ONCE() and returns 0 to fail cleanly without crashing the kernel.