A vulnerability in the Linux kernel's xen/netfront driver causes memory leaks when the function xennet_fill_frags() fails due to response chains having more slots than fit in the skb's fragments. The skb buffer is dequeued but not freed, leading to resource leakage.
CVE-2026-99056 is a high-severity vulnerability in the Linux kernel's strparser component. It involves a race condition where the __strp_recv function may still be running when the parser is being torn down, potentially leading to use-after-free (UAF) conditions. This flaw affects certain Linux kernel versions and has been addressed by adding locking mechanisms to ensure no in-flight __strp_recv calls are active during teardown. A reproducer exists that can turn the UAF into an exploit. The vulnerability primarily affects the espintcp user but the patch prevents future users from encountering this bug.
A vulnerability in the Linux kernel TCP zerocopy receive path could cause a kernel panic due to a null pointer dereference when processing net_iov fragments. This occurs because the code incorrectly dereferences a NULL page pointer for net_iov fragments, leading to a KASAN-detected panic. The issue has been resolved by rejecting all net_iov fragments before accessing page-backed data, preventing the fault.
CVE-2026-99054 is a high-severity vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) component. It involves improper teardown of topology server workqueues before closing subscriber connections, leading to race conditions that can cause use-after-free, reference count errors, and RCU stalls. This flaw allows potential corruption of kernel memory and impacts confidentiality, integrity, and availability of the affected system. The issue affects specific Linux kernel versions listed and has been resolved by changing the order of teardown operations and adding safeguards to prevent workqueue misuse.
CVE-2026-99053 is a use-after-free vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem. The flaw arises because tipc_node_find_by_name() returns a node pointer after releasing its RCU read lock without taking a reference, allowing concurrent cleanup of the node to free it while still in use. This can lead to accessing freed memory, causing potential kernel crashes or other impacts. The issue affects multiple Linux kernel versions and has been assigned a high severity rating with a CVSS score of 7.8.
This vulnerability in the Linux kernel SELinux subsystem involves improper preservation of native security labels on an already-initialized superblock when mounting an NFSv4 filesystem with security_label a second time. The issue causes SELinux to skip setting a critical flag, leading to silent disabling of per-file labeling on both the new and original mounts.
CVE-2026-99051 is a use-after-free vulnerability in the Linux kernel's fsverity subsystem. The issue arises because __fsverity_get_info() uses rcu_read_lock() without proper synchronization with fsverity_remove_info(), leading to potential use-after-free when accessing fsverity_info structures for different inodes concurrently. The vulnerability has a high severity with a CVSS score of 7.8.
A race condition in the Linux kernel gpio mpsse driver was fixed that could cause a use-after-free condition. The issue occurs when the IRQ poll worker is armed before it is properly published, allowing a disconnect operation to miss the worker and leading to access of freed memory. The fix involves synchronizing the publishing and arming of the worker within a critical section and adding a flag to prevent late arming during teardown.
A vulnerability in the Linux kernel's ibmveth driver was resolved involving improper cleanup of logical LAN resources on failure during the open operation. Specifically, if buffer pool allocation fails after registering the logical LAN, the cleanup function h_free_logical_lan() was not called, leaving the buffer-list page owned by PHYP when unmapped. This could lead to resource management issues.
A use-after-free vulnerability in the Linux kernel's mmc mtk-sd driver was fixed by ensuring that the request timeout work is properly canceled during device removal. The issue involved a delayed work callback accessing freed resources after the driver unbinds and frees the mmc_host, causing kernel memory safety violations detected by KASAN.
A memory leak vulnerability was identified and fixed in the Linux kernel's sparx5 network driver. The issue involved the sparx5_tc_matchall_destroy() function failing to free allocated memory for matchall filter entries, causing a leak when deleting mirror and goto matchall filters. The leak was confirmed using kmemleak on specific hardware and resolved by freeing the entries after unlinking them.
A vulnerability in the Linux kernel's openvswitch component caused a soft lockup during netlink flow dumps on production compute nodes with thousands of datapath flows. The issue arises because the softirq backlog refills as fast as it drains, causing the dumping thread to monopolize CPU time without rescheduling, leading to a soft lockup. The fix involves holding bottom halves (BH) off across the entire callback to prevent draining softirqs prematurely, thus avoiding the lockup. This fix trades off preemption under CONFIG_PREEMPT but keeps the BH-off region short and bounded by the flow count.
A vulnerability in the Linux kernel's tps6594 regulator driver affects the TPS65224 BUCK2, BUCK3, and BUCK4 voltage regulators. The issue arises because the driver incorrectly specifies the number of linear voltage ranges, causing out-of-bounds array access during voltage selector lookups. This flaw also impacts the TPS652G1 device. The problem has been fixed by adjusting the count of linear ranges to match the actual table size using ARRAY_SIZE().
A vulnerability in the Linux kernel Bluetooth subsystem (hci_sock) allows a race condition during dead-device detachment. This can lead to a NULL pointer dereference or use-after-free, causing kernel crashes. The flaw arises from improper serialization when rebinding an HCI socket after its controller is unregistered, resulting in unsafe access to device pointers.
CVE-2026-99006 is a high-severity vulnerability in the Linux kernel's drm/i915/gem subsystem. It involves improper handling of the exec array boundary in the eb_relocate_parse_slow() function, which can lead to freeing memory outside the intended array. This occurs due to a mismatch between the buffer count used for cleanup and the actual exec object count, potentially causing memory corruption. The issue has been resolved by ensuring relocation cleanup uses the original exec object count, excluding appended VMAs.
CVE-2026-99005 is a vulnerability in the Linux kernel's drm/i915 graphics driver related to unmasking interrupts when the ACTIVE state is false. A race condition can cause interrupts to be unmasked after the graphics technology (GT) has been parked and the runtime power management wakelock dropped, leading to kernel tainting due to hardware access without a held wakelock. The issue arises from a small race window between checking the ACTIVE state and queuing work that handles power management interrupts. The fix ensures interrupts are only unmasked when the ACTIVE state is true, preventing this improper access.
A flaw in the Linux kernel's drm/bridge th1520-dw-hdmi driver caused incorrect pointer handling during device removal, leading to improper teardown operations. The issue was fixed by correctly retrieving and passing the appropriate pointer type in the remove() callback.
CVE-2026-98995 is a high-severity vulnerability in the Linux kernel related to improper resetting of the old parent's ->overmount pointer in the mnt_change_mountpoint() function. This flaw can lead to a use-after-free (UAF) condition when a mount is moved and the old parent's ->overmount pointer incorrectly references a freed mount. This can cause the kernel to follow dangling pointers, potentially leading to privilege escalation or system compromise.
CVE-2026-98985 is a Linux kernel vulnerability in the pivot_root() function related to namespace mount checks. The flaw occurs because path_pivot_root() reads the parents of new_root and the caller's root mounts without verifying that both mounts belong to the caller's mount namespace, potentially causing a use-after-free error. This issue was fixed by ensuring both mounts are checked to be in the caller's namespace before reading their parents. The vulnerability results in an invalid read but returns EINVAL, preventing further damage.
CVE-2026-98975 is a vulnerability in the Linux kernel's XFS filesystem related to improper handling of reflink flags during extent exchanges between files. The flaw occurs when exchanging mappings that cover both files from offset 0 to the disk size, causing incorrect assumptions about shared blocks beyond the file size. This can lead to in-place writes instead of copy-on-write (CoW), resulting in corruption of shared data. The issue affects the XFS_IOC_SWAPEXT operation similarly, where reflink flags were improperly moved between inodes. The fix involves stopping the exchange of reflink flags and ensuring both inodes maintain the flag correctly. The vulnerability has a CVSS score of 7.8 (high severity).