A vulnerability in the Linux kernel's wifi wfx driver allows a firmware response with an excessively large length field to cause a buffer over-read when copying data to a caller buffer. This occurs because the function wfx_hif_read_mib() does not validate that the firmware reply length fits within the caller's buffer size before performing the copy. The issue has been resolved by adding proper validation to prevent buffer overruns.
CVE-2026-98829 is a vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem where oversized fragments can cause an overflow in a 16-bit length field. This overflow leads to insufficient buffer allocation and a subsequent kernel crash when fragment data is appended. The issue arises because fragment lengths are accumulated in a 16-bit field that can wrap around if the total size exceeds 65535 bytes. The vulnerability has been fixed by adding checks to drop frames that would cause this overflow.
A vulnerability in the Linux kernel's ath9k wireless driver allows a device response shorter than expected to be read beyond the allocated buffer, potentially leading to memory corruption. The flaw is addressed by rejecting short WMI command responses and handling them properly to prevent stale data consumption.
CVE-2026-98827 is a vulnerability in the Linux kernel's ath9k_htc wifi driver where TX aggregation was not properly bounded by the maximum buffer size, causing a buffer overflow during USB transmission of aggregated frames. This flaw could lead to memory corruption by writing beyond the allocated buffer size when large frames are aggregated. The issue was fixed by limiting the aggregation to the maximum buffer size and adjusting length calculations to prevent oversized USB requests.
CVE-2026-98826 is a use-after-free vulnerability in the Linux kernel's rtc ac100 driver that occurs on probe failure. The issue arises because clock providers registered during probe are not device-managed and are only released during device removal, which does not happen if probe fails. This leads to a dangling pointer and potential use of freed memory during later clock lookups. The vulnerability also causes clock leaks that can prevent subsequent device probes. The fix involves registering clocks with device-managed functions to ensure proper cleanup on probe failure.
A vulnerability in the Linux kernel's rtc: mpfs driver was fixed where an error pointer returned by devm_clk_get() was not checked before being passed to clk_get_rate(). This could cause a kernel crash during device probe if the clock provider was not yet registered. The issue was resolved by adding proper error checking with IS_ERR() before calling clk_get_rate().
A vulnerability in the Linux kernel's mac80211 wifi subsystem allowed improper validation of TX status rate metadata, potentially leading to out-of-bounds indexing in rate control tables. This flaw was fixed by validating rate metadata earlier in the TX status processing path to prevent corruption of mac80211 state. The issue affects specific Linux kernel versions and has a high severity rating.
CVE-2026-98823 is a high-severity vulnerability in the Linux kernel's wifi cfg80211 component. It involves improper handling of hidden-group beacon Information Elements (IEs) during probe-response processing, which can lead to double-free errors and potential memory corruption. The flaw occurs when beacon IEs borrowed from a group's beacon entry are copied to an associated entry, resulting in two owners for the same allocation. This can cause use-after-free or double-free conditions when the group's beacon entry is released. The vulnerability has been resolved by skipping beacon IE replacement for hidden group entries while preserving normal probe-response processing.
A vulnerability in the Linux kernel's mac80211 wireless subsystem allowed unicast frames sent on one interface to be incorrectly transmitted to stations of a different VLAN within the same BSS. This occurred because the station lookup function matched stations across VLANs rather than restricting to the interface the frame was sent on. The issue has been resolved by ensuring only stations of the sending interface are matched, except for control port frames.
A vulnerability in the Linux kernel's block layer causes a general protection fault when polled direct I/O (DIO) is used with user integrity metadata. The issue arises because the I/O control block (IOCB) metadata pointer is misinterpreted, leading to a null pointer dereference during bio polling. This flaw affects certain Linux kernel versions and can cause system crashes when specific I/O polling operations are performed with integrity metadata.
A vulnerability in the Linux kernel blk-mq subsystem involves improper setting of the RQF_USE_SCHED flag when handling cached requests. This can cause domain token leaks and queue stalls in the kyber scheduler due to incorrect request scheduling and freeing behavior. The issue is addressed by setting RQF_USE_SCHED only after the request is claimed by an operation, using a new helper function blk_mq_rq_late_init().
A vulnerability in the Linux kernel's Bluetooth component (btintel) related to improper validation of DDC record lengths has been resolved. The issue involved parsing DDC record lengths as unsigned values to prevent wrapping and rejecting records that are too small, too large, or exceed remaining firmware bytes before processing. This flaw was reported by Claude Mythos and affects specific linux-aws kernel versions.
CVE-2026-98818 is a Linux kernel vulnerability involving a deadlock risk in the memory management slab allocator. The issue arises because kfree_rcu() can be called while holding pi_lock, a raw spinlock, and it should not allocate memory with __GFP_KSWAPD_RECLAIM since waking up kswapd under pi_lock leads to a circular locking dependency and deadlock. This deadlock was confirmed using a modified kernel with lockdep instrumentation. The vulnerability affects specific Linux kernel versions including several 4.15.x, 5.0.x, and 5.3.x releases.
A vulnerability in the Linux kernel's ASoC SDCA component related to power management runtime error handling in the function probe has been addressed. The fix adds a common error path to properly balance the runtime PM reference during probe operations. This issue affects specific versions of the linux-hwe-edge kernel. The severity is rated low, and there are no known exploits in the wild.
A vulnerability in the Linux kernel's BPF subsystem causes an overflow of the jump offset during constant blinding in the bpf_jit_blind_insn() function. This overflow can cause the kernel to crash when running certain BPF programs with bpf_jit_harden=2 enabled.
A use-after-free vulnerability in the Linux kernel NVMe driver was fixed related to the character device (cdev) lifetime management. The issue occurs in multipath mode when the namespace head is torn down, causing open cdev file operations to reference freed memory, leading to a kernel crash detected by KASAN. This flaw allows referencing a freed nvme_ns_head structure after its reference count drops to zero.
A use-after-free vulnerability was identified and fixed in the Linux kernel's NVMe driver related to multipath namespace heads. The flaw occurred when an I/O passthrough command was sent through a multipath namespace head after the controller path that created the head was removed, causing a KASAN-reported slab-use-after-free error. The fix involved moving the log cache to the subsystem level to maintain valid log pointers until subsystem release, preventing the use-after-free condition.
CVE-2026-98813 is a high-severity vulnerability in the Linux kernel's BPF subsystem related to improper handling of map BTF references in the memory allocator destructor. The flaw allows a use-after-free condition when the BPF memory allocator defers destruction work, potentially causing kernel memory corruption. This occurs because the map BTF reference is released too early while deferred work still accesses it. The issue affects multiple Linux kernel versions used in various Ubuntu releases.
A vulnerability in the Linux kernel's net/mctp subsystem allows a null pointer dereference due to premature publication of the mctp_dev device before it is fully initialized. This can cause kernel address sanitizer (KASAN) null pointer dereference errors during certain socket operations. The issue is fixed by ensuring the mctp_dev object is published only after full initialization.
CVE-2026-98811 is a medium-severity vulnerability in the Linux kernel's network scheduler (net/sched) component. It involves a race condition when two concurrent traffic control (tc) filter add requests operate on the same chain and priority of an unlocked classifier. This race can cause an empty protocol (proto) to remain linked in the chain erroneously, holding references that should have been released. The issue was addressed by ensuring that the proto is reclaimed on the error path of any failed request that holds a proto reference, preventing resource leakage.