CVE-2026-99207 is a Linux kernel vulnerability in the SCSI target subsystem related to improper interrupt handling while holding the delayed_cmd_lock spinlock. The issue arises because target_do_delayed_work() uses a plain spin_lock() without disabling interrupts, whereas other code paths use spin_lock_irqsave(). This inconsistency can cause a deadlock when certain ordered SCSI commands complete in interrupt context, leading to a spinlock being held with interrupts enabled. The vulnerability requires specific conditions including complete_type=1 and a backend completing I/O from interrupt context. It was found by code inspection and has no known exploitation in the wild.
CVE-2026-99205 is a Linux kernel vulnerability involving the scheduler core. It occurs due to a race condition during a task's scheduling class change, where the wakeup_preempt() function is not called for queued tasks. This causes the CPU to idle despite runnable real-time tasks being present, leading to potential scheduling inefficiencies.
CVE-2026-99202 is a vulnerability in the Linux kernel's libsas SCSI subsystem that causes a deadlock during high availability (HA) resume operations involving SMP IO commands. The deadlock occurs when a synchronous runtime power management resume is triggered from the HA resume path, causing a circular wait between the resume process and SMP IO completion. This issue specifically affects expander-attached SATA disks and is resolved by changing the runtime PM calls to avoid synchronous resume during SMP IO. The vulnerability impacts certain Linux kernel versions used in Ubuntu distributions.
CVE-2026-99201 is a vulnerability in the Linux kernel's netlink subsystem where the network namespace pointer was hashed in a way that could leak kernel address information. An unprivileged user could exploit this to recover parts of the kernel memory layout. The issue is fixed by replacing the raw pointer with a unique, non-address net_cookie value in the hash key, preventing address leakage. The fix is backported to stable kernels from version 5.15 onward.
A vulnerability in the Linux kernel's hisi_femac driver causes a crash due to a NULL pointer dereference. The issue arises because the PHY is connected before the network device operations (netdev_ops) are assigned, leading to a kernel panic when CONFIG_NET_SHAPER is enabled. The fix involves assigning netdev_ops before attaching the PHY, preventing the crash.
A vulnerability in the Linux kernel's Hisilicon hip04_eth driver causes a crash due to a NULL pointer dereference when CONFIG_NET_SHAPER is enabled. The issue arises because the network device operations (netdev_ops) are accessed before being assigned during PHY attachment, leading to a crash in hip04_mac_probe(). This has been fixed by moving the assignment of netdev_ops before the PHY attach, similar to a previous fix for the emac driver.
A vulnerability in the Linux kernel's ethernet actions subsystem causes a crash due to a NULL pointer dereference when CONFIG_NET_SHAPER is enabled. The issue arises because the netdev_ops pointer is accessed before it is assigned, leading to a crash during PHY attachment. This has been fixed by moving the assignment of netdev_ops before the PHY attach call.
A vulnerability in the Linux kernel's mv643xx network driver causes a crash due to a NULL pointer dereference. The issue arises because the network device operations (netdev_ops) are assigned after the PHY is connected, leading to a crash when CONFIG_NET_SHAPER is enabled. This has been fixed by assigning netdev_ops before attaching the PHY.
A vulnerability in the Linux kernel's au1000 network driver causes a crash due to a NULL pointer dereference when CONFIG_NET_SHAPER is enabled. The issue arises because the network device operations (netdev_ops) are not assigned before the PHY attach process, leading to a crash during probing. This has been fixed by moving the assignment of netdev_ops before the PHY attach, similar to a previous fix in the emac driver.
A vulnerability in the Linux kernel's ethoc network driver causes a crash due to a NULL pointer dereference during device probing when CONFIG_NET_SHAPER is enabled. The issue arises because netdev->netdev_ops is accessed before it is assigned, leading to a crash in ethoc_probe(). This has been fixed by assigning netdev_ops before PHY attachment, following a similar fix applied to the emac driver.
A vulnerability in the Linux kernel's Aeroflex Ethernet driver causes a crash due to a NULL pointer dereference during device probing when CONFIG_NET_SHAPER is enabled. The issue arises because the network device operations pointer (netdev_ops) is accessed before it is assigned, leading to a crash. This has been fixed by moving the assignment of netdev_ops before the PHY attach process.
A vulnerability in the Linux kernel's ti icssm-prueth driver caused a crash due to a NULL pointer dereference when CONFIG_NET_SHAPER is enabled. The issue arises because the netdev_ops field is accessed before it is assigned, leading to a crash during PHY attachment. This has been fixed by moving the assignment of netdev_ops before the PHY attach call.
A vulnerability in the Linux kernel's bcmgenet network driver involves improper handling of shared socket buffers (skb). The driver writes to the skb control block without unsharing it first, causing the byte queue limits (BQL) to stall the transmit queue. This issue can be reproduced using pktgen in clone_skb mode, where the same skb is reused before earlier copies complete transmission.
CVE-2026-99191 is a vulnerability in the Linux kernel's calipso module affecting the handling of large TCP payload lengths in IPv6 packets. The issue arises from incorrect adjustment of the IPv6 payload length field when processing packets larger than the maximum IPv6 payload length (IPV6_MAXPLEN), causing potential misinterpretation of packet sizes by network subsystems relying on this value. This flaw was fixed by correctly setting the payload length based on the actual socket buffer length, ensuring accurate length representation for large TCP packets with CALIPSO options.
A memory leak vulnerability exists in the Linux kernel's gpiolib subsystem within the function gpiod_set_array_value_complex(). The issue occurs on error paths when a call to gpiochip_set_multiple() fails, causing an early return that bypasses freeing allocated bitmaps. This flaw can lead to memory being leaked during these error conditions. The vulnerability affects specific versions of the Linux kernel and has been addressed by deferring the return code check until after the bitmap free operation.
A race condition vulnerability in the Linux kernel's gpio mxc driver was fixed. The issue involved installing a chained IRQ handler before necessary data structures were fully initialized, leading to potential use of NULL pointers or dangling handlers if interrupts occurred early or if probe steps failed. The fix moves handler installation to after all dependencies are ready, preventing the handler from being live while data structures are incomplete or from being installed if probe fails.
A vulnerability in the Linux kernel's stmmac driver for dwmac1000 causes a soft lockup and system hang during resume from low power state due to an unhandled RGMII status interrupt. The issue arises because the driver stopped reading the GMAC_RGSMIIIS interrupt status, causing it to remain pending and generate an interrupt storm. This leads to CPU starvation and watchdog resets or hangs on affected systems.
A vulnerability in the Linux kernel's perf subsystem was fixed to address an issue where perf_pmu_migrate_context() left some events behind during CPU hotplug operations. This caused events to continue running on a CPU that was being torn down, while the PMU's interrupt and migrated events were moved to a new CPU, violating driver assumptions.
A vulnerability in the Linux kernel's x86 instruction evaluation code caused by a variable shadowing issue in get_seg_reg_override_idx() leads to incorrect handling of segment register overrides. This results in the function always returning a default segment register value, ignoring FS and GS overrides, and causing an infinite loop when a CS override is present. The flaw can cause the kernel to spin indefinitely, preventing user space from regaining control and leaving CPUs tied up until reboot. Additionally, FS or GS prefix usage can cause emulated results to be written to incorrect memory addresses.
A race condition vulnerability in the Linux kernel's FireWire core handling of split transactions could lead to a use-after-free condition. This occurs because both the response handler and the timeout callback may manipulate the same transaction entry concurrently due to improper synchronization after a code refactoring. The issue has been fixed by ensuring the response handler does not process the transaction if the timeout callback is already running.