A deadlock vulnerability was fixed in the Linux kernel's crypto CCP SEV initialization failure path. The issue occurred because a function called with an incorrect lock status could cause a deadlock during cleanup after an RMPUPDATE failure. This was resolved by correctly passing the lock status to honor the parent function's mutex lock.
CVE-2026-98870 is a high severity use-after-free vulnerability in the Linux kernel's ksmbd component. It occurs because stale channels are not properly removed from all sessions on connection teardown, leading to dereferencing freed memory and leaking sessions. This flaw affects multiple specific Linux kernel versions. The vulnerability has a CVSS score of 8.8, indicating critical confidentiality, integrity, and availability impacts. A fix is available that removes the conditional gate so that all stale channels are always removed on teardown.
CVE-2026-98869 is a high-severity vulnerability in the Linux kernel's BPF verifier related to incorrect zero extension logic for 32-bit operations on the s390 architecture. The flaw arises from changes in the verifier's register liveness analysis that can allow the upper half of a 64-bit register to contain arbitrary values, potentially leading to incorrect program behavior or privilege escalation. The issue has been resolved by revising the zero extension inference to be based on static register liveness analysis. Multiple specific Linux kernel versions are affected.
CVE-2026-98719 is a vulnerability in the Linux kernel's KVM SEV implementation involving improper handling of the "have run CPUs" mask pointer during freeing. The flaw can cause a double-free condition if the mask is freed twice, particularly when __sev_guest_init() fails. This issue has been addressed by nullifying the pointer when freeing the mask and adding helper functions to manage allocation and freeing safely.
A vulnerability in the Linux kernel's KVM SEV implementation involves improper cache maintenance timing during intra-host VM migration. The issue arises because cache flushes are performed after clearing the SEV active state on the source VM, creating a small window where memory reclaim operations may incorrectly skip cache flushes. This can lead to stale or incorrect memory data being exposed to the host or other VMs.
A NULL pointer dereference vulnerability in the Linux kernel's Thunderbolt subsystem was fixed in the tb_remove_work() function. The issue arises due to a race condition between tb_remove_work() and tb_domain_remove(), leading to dereferencing a NULL tb->root_switch pointer inside tb_free_unplugged_xdomains(). This can cause kernel instability or crashes. The fix involves ensuring proper locking and checks around tb->root_switch to prevent the NULL dereference.
A vulnerability in the Linux kernel's dm-pcache component allows a crafted kset to overrun its segment, causing a BUG_ON condition. This occurs because the cache_replay(), writeback worker, and GC worker read a kset size that can be manipulated to exceed the segment's remaining space. The issue is mitigated by rejecting any kset whose on-media size exceeds the remaining segment size before use.
A vulnerability in the Linux kernel's dm-pcache component allows an out-of-bounds write during replay due to improper bounding of a logical key offset from persistent memory. The flaw occurs when the offset plus length exceeds the device size, leading to a subtree pointer outside the valid array range. This issue has been resolved by rejecting keys of zero length or those whose offset plus length exceed the device size before use.
A vulnerability in the Linux kernel KVM x86 subsystem could cause stale, unpinned page frame numbers (PFNs) to be reused when nested virtualization pages fail to be retrieved. This occurs if the GET_NESTED_STATE_PAGES request is not properly re-pended before exiting to userspace, potentially leading to stale mappings in nested virtual machine control structures. The issue affects specific Linux kernel versions and has been resolved by ensuring the request is correctly handled on VM exit.
CVE-2026-98862 is a use-after-free vulnerability in the Linux kernel's audit subsystem affecting the kill_rules() function. This flaw occurs when removing audit rules that monitor executable files, leading to a race condition where the executable mark can be freed while still in use. The issue is fixed by changing the removal process to wait for an RCU grace period before freeing executable marks, preventing use-after-free errors.
CVE-2026-98861 is a high-severity vulnerability in the Linux kernel's fprobe subsystem. It arises because unregister_fprobe() and unregister_fprobe_async() rely on standard RCU grace periods that do not account for fprobe handlers executing when RCU is not watching, such as in idle or nohz_full states. This can lead to a use-after-free condition if the fprobe is freed immediately after unregistration. The issue is addressed by adding checks for rcu_is_watching() and using guard(rcu_sched_notrace) to avoid lockdep overhead and ensure safe synchronization.
A vulnerability in the Linux kernel's HID subsystem involving BPF programs was fixed by properly casting size to ssize_t when checking hid_bpf_hw_request. Without this fix, negative hardware error codes returned by transport drivers could be misinterpreted as large positive numbers, causing the kernel to treat hardware errors as successes and potentially allowing BPF programs to operate on uninitialized or stale data.
CVE-2026-98859 is a vulnerability in the Linux kernel's HID multitouch driver where the release timer can be rearmed after it has been deleted during device removal. This leads to a use-after-free condition when the timer callback dereferences freed memory. The issue arises because timer_delete_sync() does not prevent the timer from being rearmed by incoming reports, causing a timer callback to access freed data. The fix involves using timer_shutdown_sync() to ensure the timer cannot be rearmed after deletion, preventing the use-after-free.
A use-after-free vulnerability in the Linux kernel's io_uring subsystem with SQPOLL mode has been fixed. The issue occurs when the sqpoll thread frees the ring context while another function still accesses it, leading to a kernel slab use-after-free error detected by KASAN. The fix involves holding an RCU read lock during the add operation and waiting for a grace period before freeing the context.
A vulnerability in the Linux kernel's IP Virtual Server (ipvs) component related to unbounded growth of LBLCR and LBLC cache entries has been resolved. The functions ip_vs_lblcr_new() and ip_vs_lblc_new() previously created cache entries for every new destination address without effectively limiting cache size, allowing potential resource exhaustion. The fix introduces a rejection of new cache entries once the cache size reaches 1.5 times the configured max_size, preventing uncontrolled growth while maintaining serviceability.
A vulnerability in the Linux kernel kprobes subsystem involves improper handling of disarmed probes when checking for optimized probe overlaps. This flaw can cause execution to jump to an incorrect address due to an INT3 instruction overwriting part of a jump displacement in optimized probes. The issue affects specific Linux kernel versions and has been resolved by skipping disarmed probes during overlap checks.
A use-after-free vulnerability in the Linux kernel's device tree overlay handling was fixed. The issue occurs when a property is linked into a node's dead property list before a changeset add operation succeeds. If the add operation fails, the property is freed but remains linked, leading to a double free when the node is released. The fix ensures the property is linked only after the changeset add succeeds, preventing the double free.
A flaw in the Linux kernel's of/overlay subsystem causes improper handling of negative changeset IDs during error conditions. This can lead to a NULL pointer dereference when free_overlay_changeset() is called with a negative ID, potentially causing a kernel crash. The issue arises because the function treats any non-zero ID as registered, including negative values returned on allocation failure. The fix ensures only strictly positive IDs are considered registered, preventing the erroneous cleanup path.
CVE-2026-98853 is a vulnerability in the Linux kernel's network generic segmentation offload (GSO) implementation. It involves unbounded recursive IP-in-IP segmentation that can exhaust the kernel stack due to improper tracking of nested IP headers. The flaw affects IPv4 and IPv6 GSO handlers and is mitigated by limiting recursion depth using an existing recursion limit. The vulnerability has a medium severity with a CVSS score of 6.8.
CVE-2026-98852 is a medium severity vulnerability in the Linux kernel related to the handling of IPv6 extension headers in tunneled packets. The issue involves incorrect detection and processing of outer and inner IPv6 headers in certain tunneling scenarios, which can cause checksum offload processing errors and packet drops. The vulnerability affects specific Linux kernel versions and has been addressed by improving the detection logic for encapsulated IPv6 packets.