A flaw in the Linux kernel's drm/bridge th1520-dw-hdmi driver caused incorrect pointer handling during device removal, leading to improper teardown operations. The issue was fixed by correctly retrieving and passing the appropriate pointer type in the remove() callback.
CVE-2026-98995 is a high-severity vulnerability in the Linux kernel related to improper resetting of the old parent's ->overmount pointer in the mnt_change_mountpoint() function. This flaw can lead to a use-after-free (UAF) condition when a mount is moved and the old parent's ->overmount pointer incorrectly references a freed mount. This can cause the kernel to follow dangling pointers, potentially leading to privilege escalation or system compromise.
CVE-2026-98985 is a Linux kernel vulnerability in the pivot_root() function related to namespace mount checks. The flaw occurs because path_pivot_root() reads the parents of new_root and the caller's root mounts without verifying that both mounts belong to the caller's mount namespace, potentially causing a use-after-free error. This issue was fixed by ensuring both mounts are checked to be in the caller's namespace before reading their parents. The vulnerability results in an invalid read but returns EINVAL, preventing further damage.
CVE-2026-98975 is a vulnerability in the Linux kernel's XFS filesystem related to improper handling of reflink flags during extent exchanges between files. The flaw occurs when exchanging mappings that cover both files from offset 0 to the disk size, causing incorrect assumptions about shared blocks beyond the file size. This can lead to in-place writes instead of copy-on-write (CoW), resulting in corruption of shared data. The issue affects the XFS_IOC_SWAPEXT operation similarly, where reflink flags were improperly moved between inodes. The fix involves stopping the exchange of reflink flags and ensuring both inodes maintain the flag correctly. The vulnerability has a CVSS score of 7.8 (high severity).
CVE-2026-98965 is a vulnerability in the Linux kernel's ice driver for Intel Ethernet Controller E810-XXV on arm64 architectures. The issue arises from the use of writel_relaxed() for updating hardware transmit doorbells, which does not guarantee proper ordering of memory-mapped I/O writes. This can cause a race condition where the NIC starts transmitting before the driver updates the transmit queue accounting state, leading to a kernel BUG and crash under sustained network load. The problem was introduced by a change from writel() to writel_relaxed() and has been resolved by restoring the original writel() usage.
CVE-2026-98959 is a critical vulnerability in the Linux kernel's btrfs filesystem related to extended attribute (xattr) replacement when multiple xattrs are packed in the same item. The flaw causes corruption of the btrfs_dir_item structure during xattr replacement if the new value size differs, leading to filesystem transaction aborts and potential data loss. This occurs because certain fields in the btrfs_dir_item are not properly initialized after deletion and insertion operations. The issue was reproducible with specific xattr names that hash to the same value, triggering the bug during setxattr operations.
CVE-2026-98958 is a vulnerability in the Linux kernel's mt76 WiFi driver where non-AQL frames are incorrectly accounted per link instead of per peer. This causes the frame count to drift upwards, potentially blocking the station. The issue arises because increments and decrements of the non-AQL packet counter occur on different link wcids for MLO peers. The fix involves keeping the count on the wcid of the primary link.
A vulnerability in the Linux kernel's mt7915 WiFi driver causes system instability when unloading and reloading the mt7915e module. The issue arises because the driver does not disable the receive NAPI (New API) before removing the device, triggering warnings and instability especially on MT7916 hardware when changing frequency parameters.
This vulnerability in the Linux kernel's ASoC adau1372 driver involves improper handling of sleepy powerdown GPIOs. The issue arises because gpiod_set_value() emits a WARN when the GPIO provider indicates it can sleep, which is typical for I2C controlled GPIO expanders. The fix involves using the _cansleep variant to allow the driver to use sleepy GPIOs to power off the chip without warnings.
CVE-2026-98955 is a vulnerability in the Linux kernel's flow_dissector component where a 16-bit truncation of skb->len causes incorrect computation of the transport header offset (thoff). This truncation can lead to thoff being set to an invalid small value, causing transport header pointers to reference incorrect locations such as inside the Ethernet header. The issue arises with large skbs (socket buffers) exceeding 64KB, which are increasingly common due to features like GSO and BIG TCP. The fix changes the comparison to use 32-bit values and caps thoff to U16_MAX if it cannot be represented in 16 bits, reporting dissection failure rather than returning incorrect offsets.
A vulnerability in the Linux kernel's __virtio_net_hdr_to_skb() function caused improper dissection of Generic Segmentation Offload (GSO) packets. This flaw allowed malformed network headers to bypass validation, potentially leading to out-of-bounds memory reads during TCP header length calculations. The issue was fixed by ensuring proper initialization of skb fields and removing unsafe fallback code to enforce full packet dissection and validation.
CVE-2026-98953 is a vulnerability in the Linux kernel's devlink component involving a reference leak of devlink_rel objects when notify work is pending. The issue arises because the code queues work without checking if it is already pending, causing references to be leaked when the work runs only once but multiple references were taken. This leak can be triggered by repeatedly registering and unregistering nested devlink instances while holding the parent lock, resulting in multiple devlink_rel objects being leaked.
A vulnerability in the Linux kernel's PFCP implementation allows reading beyond the end of packet data when processing certain PFCP packets with the S flag set. This occurs because the code does not ensure the SEID field is fully linearized before reading, potentially leading to use of uninitialized memory in tunnel metadata. The issue is fixed by properly pulling up the SEID data and dropping packets that are too short.
CVE-2026-98951 is a vulnerability in the Linux kernel's riscv ptrace implementation where regset buffers are not zero-initialized before copying user data. This can lead to uninitialized stack buffer data being used in the target's virtual state and shadow stack pointer. The issue has been resolved by zero-initializing these buffers before use.
CVE-2026-98950 is a vulnerability in the Linux kernel's flow_dissector component where the hlen value used in bpf_flow_dissect() can be truncated due to u16 limits. This truncation causes offsets to be incorrectly clamped to zero when hlen exceeds 65535, potentially affecting packet flow dissection by BPF programs. The issue is similar to a previously fixed bug but affects the BPF path specifically. The vulnerability has been resolved by capping hlen to the maximum u16 value before clamping.
A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter copies URL parameters specifying an authentication token, target account, target item and dispatch state into the request attributes consumed by the Classic Web Client. Combined with CVE-2026-10632 on ZCS 10.1.16, this allows an attacker to supply their own valid token and document identifiers and execute JavaScript in another user's signed-in browser session. ZCS 10.1.17 blocks that XSS chain by changing the document renderer, but retains the request attribute override.
A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-50053, an attacker with an ordinary Zimbra account can supply their own authentication token and document identifiers in a URL and execute JavaScript in another signed-in user's Zimbra browser session when that user opens the URL. This permits reading mailbox data and performing authenticated actions as the victim. The issue affects ZCS 10.1.16 and was remediated in 10.1.17.
CVE-2026-112856 is a critical deserialization of untrusted data vulnerability in ThemeREX Group Vagabonds up to version 1.3.10. It allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.8, indicating high severity. No patch or remediation details are provided in the available data.
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.
A vulnerability in the Linux kernel's TPS65224 regulator driver caused out-of-bounds array access due to incorrect linear range count for BUCK2-4 descriptors. This flaw could lead to reading invalid memory during voltage constraint checks. The issue affects Linux kernel versions >=6.6.157 <6.6.160 and version 6.10. It has been fixed by correcting the count to match the actual array size.