A vulnerability in the Linux kernel's virtio_input driver was resolved that involved improper handling of callbacks during input device unregistration. The issue allowed callbacks to continue using freed resources because the input device was unregistered before resetting the virtio device, potentially causing use-after-free conditions. The fix ensures that callbacks are stopped before the input device is unregistered, preventing this unsafe behavior.
A vulnerability in the Linux kernel's net: dsa: bcm_sf2 component allows a user without CAP_NET_ADMIN privileges to trigger a buffer over-read and potential memory corruption by providing a smaller buffer size than the number of installed CFP rules during an ETHTOOL_GRXCLSRLALL ioctl call. This occurs because the bcm_sf2_cfp_rule_get_all() function walks the entire cfp.unique bitmap without checking the caller's buffer size, leading to out-of-bounds memory access.
A vulnerability in the Linux kernel's btrfs filesystem handling was resolved. The issue occurs when creating the first metadata chunk for a sprout filesystem, where a device is added to a transaction update list but not properly detached if subsequent chunk creation fails. This leads to a warning and leaves the transaction list referencing freed memory, potentially causing instability.
A vulnerability in the Linux kernel's ethernet driver oa_tc6 related to error recovery during oversubscribed traffic has been resolved. The issue involved buffer overflow errors causing the driver to fail in locating valid data chunks, leading to assertion failures during skb_put operations. The fix improves error handling by checking buffer tailroom before accepting data and abandoning frames when insufficient space is detected. The rx_buf_overflow flag was renamed to wait_until_start_valid to better reflect its broader use in error recovery.
A vulnerability in the Linux kernel's mt76 wifi driver for the mt7921 device involves improper validation of CLC firmware records. The firmware loader trusts the region count and record lengths without proper bounds checking, which can lead to pointer errors and failure to advance record loops. This flaw has been resolved by validating the table and record bounds before dereferencing or copying.
CVE-2026-98027 is a high-severity vulnerability in the Linux kernel's mv88e6xxx driver related to the handling of policy rule dumps. The flaw allows a user to cause a buffer overrun by specifying fewer slots than existing rules when querying policy rules via ETHTOOL_GRXCLSRLALL, potentially leading to memory corruption. The issue arises because the function mv88e6xxx_get_rxnfc() overwrites the caller's input buffer size before it is checked, resulting in out-of-bounds memory access. This vulnerability affects Linux kernel version 5.4 and has been fixed in several subsequent commits.
CVE-2026-97990 is a high-severity vulnerability in the Linux kernel's vdpa_sim_net component. It involves improper handling of the TX pull result, where a negative error value is incorrectly treated as a large unsigned length during RX processing. This flaw has been fixed by properly checking the TX pull result before using it and handling errors by completing the TX descriptor with zero bytes.
A vulnerability in the Linux kernel's ethernet cortina driver was fixed by correcting the budget accounting in the gmac_rx() function. The function previously returned the remaining NAPI budget, but the caller incorrectly treated this value as the number of packets received, causing idle polls to report a full budget and remain scheduled unnecessarily. The fix returns the actual number of received packets and adjusts the free queue refill accounting accordingly.
A vulnerability in the Linux kernel's Cortina ethernet driver caused the RX loop to consume the receive budget only when frames were successfully delivered. Error paths that dropped frames still consumed descriptors without reducing the budget, allowing a stream of bad frames to exhaust the receive ring in a single poll. This issue has been fixed by moving budget accounting to count each completed frame as NAPI work, whether delivered or dropped, aligning with vendor driver behavior.
A use-after-free (UAF) vulnerability was identified and fixed in the Linux kernel's Bluetooth USB driver (btusb). The issue arises because btusb_close() and btusb_flush() cancel a delayed work item asynchronously, allowing the work to continue running on another CPU after the data structure has been freed. This leads to dereferencing freed memory in btusb_rx_work(). The fix involves using a synchronous cancel function and adjusting the order of operations to prevent race conditions.
A vulnerability in the Linux kernel Bluetooth driver btintel_pcie allows an out-of-bounds read due to improper validation of packet_len before calling skb_put_data. The issue occurs because btintel_pcie_submit_rx_work() reads packet_len from rfh_hdr without verifying it against the RX buffer size, potentially leading to memory access beyond the buffer. The flaw was fixed by validating that packet_len is non-zero and does not exceed the buffer size minus header size, with error logging on invalid values. This vulnerability affects Linux kernel version 6.10 and has been addressed in specific commits.
CVE-2026-97955 is a vulnerability in the Linux kernel's net: mana subsystem where the XDP program pointer is not restored properly when pre-allocation of RX buffers fails. This can lead to the pointer referencing freed memory, causing potential use-after-free conditions. The issue occurs during an 'ip link set dev ethX xdp obj ...' operation when buffer pre-allocation cannot be satisfied. The vulnerability has been fixed by restoring the previous program pointer on the error path.
A vulnerability in the Linux kernel's mana network driver involves insufficient reservation of completion queue (CQ) slots for fence completion CQEs. The RX completion queue is sized to hold exactly one CQE per posted RX WQE, but the hardware posts an additional CQE for fence completion without reserving an extra slot. This can cause the fence completion CQE to be dropped when the CQ is full, leading to the driver waiting while holding the RTNL lock during a timeout. The issue has been fixed by reserving an extra CQE slot and adjusting the CQ size accordingly.
A use-after-free vulnerability exists in the Linux kernel's idpf driver due to improper handling of Tx/Rx DIM work before freeing q_vectors. The driver fails to drain scheduled DIM work before freeing associated memory, leading to potential access of freed memory. This race condition can cause kernel memory corruption under certain load conditions.