A use-after-free vulnerability exists in the Linux kernel's idpf driver due to improper handling of Tx/Rx DIM work before freeing q_vectors. The driver fails to drain scheduled DIM work before freeing associated memory, leading to potential access of freed memory. This race condition can cause kernel memory corruption under certain load conditions.
CVE-2026-97595 is a use-after-free vulnerability in the Linux kernel's mac802154 subsystem. It arises from unsafe handling of queued received frames referencing network interfaces that may be concurrently removed, leading to potential memory corruption. The flaw is fixed by adding proper locking, reference counting, and frame dropping during interface teardown.
CVE-2026-97573 is a high-severity vulnerability in the Linux kernel's bnxt_en driver affecting version 5.10. It involves improper handling of buffer allocation failures in the bnxt_rx_ring_reset() function, which can lead to the use of uninitialized DMA addresses. This flaw is fixed by a fallback to a global reset to prevent re-enabling TPA with incomplete allocations.
A vulnerability in the Linux kernel's bnxt_en driver was fixed to properly propagate RX ring initialization failures in the bnxt_init_nic() function. Previously, errors from bnxt_init_rx_rings() were ignored, potentially enabling TPA over partially zeroed RX ring entries, which could cause a zeroed DMA address to be used.
CVE-2026-97570 is a vulnerability in the Linux kernel's bnxt_en network driver where software TPA IDs are not properly bounded, leading to out-of-bounds memory access. This can cause kernel crashes due to invalid pointer dereferences when the firmware advertises fewer concurrent TPAs than the software expects. The issue is fixed by allocating the rx_tpa array with a size rounded up to the next power of two and masking the firmware TPA ID accordingly.
A memory leak vulnerability in the Linux kernel's XFS filesystem was fixed. The flaw involved the function xqcheck_mod_live_ino_dqtrx not freeing a newly allocated dqa object if insertion into a resizable hash table (rhashtable) failed, causing a resource leak.
CVE-2026-97524 is a high-severity vulnerability in the Linux kernel's Multipath TCP (mptcp) implementation. It involves unneeded recursive actions on subflow reset that can cause excessive processing and potential denial of service. The issue arises when the mptcp receive path recursively calls mptcp_data_ready() under rare error conditions, leading to attempts to re-acquire a data lock. The fix introduces a new flag to break this recursion and explicitly flushes the RX queue during subflow reset, preventing unnecessary processing and avoiding double consumption of data buffers.
A vulnerability in the Linux kernel's netfilter nfnetlink_log component was resolved. The issue involved freeing per-network namespace state without waiting for an RCU grace period, potentially causing use-after-free conditions during concurrent packet processing. The fix ensures the pointer is cleared only after RCU readers have completed, preventing unsafe memory access.
A vulnerability in the Linux kernel's wifi libipw component was resolved that involved improper boundary checks when reading the WEP key index from network packet data. The function libipw_rx() previously checked for skb->len >= hdrlen + 3 before reading skb->data[hdrlen + 3], which did not sufficiently ensure the byte was within bounds. The fix requires hdrlen + 4 bytes before accessing that byte, preventing a potential out-of-bounds read. This is a local source-boundary check and does not affect key index semantics.
A vulnerability in the Linux kernel's wifi cfg80211 subsystem was resolved that involved improper validation of management frame lengths before processing. Specifically, certain management frames shorter than expected for their subtype could cause out-of-bounds reads when accessing fixed fields, such as the reason code in deauthentication frames. The fix added precise length checks per subtype and removed a misleading warning, ensuring malformed frames are dropped silently. This vulnerability affects specific Linux kernel versions listed and has a medium severity rating.
A vulnerability in the Linux kernel's cachefiles subsystem was fixed to address a double fput() call in error handling within cachefiles_create_tmpfile(). This flaw could lead to serious impacts on confidentiality, integrity, and availability. The issue affects specific Linux kernel versions listed and has a CVSS 3.1 score of 7.0, indicating a medium severity level.
A vulnerability in the Linux kernel's stmmac xgmac2 network driver caused an interrupt storm due to enabling the RX Buffer Unavailable (RBUE) interrupt by default. This interrupt storm occurs under heavy receive (RX) pressure when the DMA runs out of RX descriptors, firing RBUE continuously without forward progress, leading to degraded system performance. The issue was resolved by disabling RBUE in the default RX interrupt mask, preventing the interrupt storm while maintaining normal RX handling. This fix trades the storm for a clean stall with the same RX outcome. The vulnerability affects specific Linux kernel versions listed and has a CVSS score of 7.5, indicating medium severity with high impact on availability.
A vulnerability in the Linux kernel's ath11k Wi-Fi driver allows invalid data access and potential memory corruption due to packets exceeding the maximum native Wi-Fi header length. This occurs in the ath11k_dp_rx_h_undecap_nwifi() function when processing certain packet types. A fix has been implemented by adding a sanity check before processing to prevent this invalid access.
A vulnerability in the Linux kernel's ACPICA component related to validating handler object types in two functions has been resolved. The issue affected specific Linux kernel versions and could impact confidentiality, integrity, and availability. The vulnerability has a CVSS score of 8.4, indicating high severity. No known exploits in the wild have been reported. The affected versions are specific kernel builds around versions 3.11 to 3.13.
CVE-2026-93796 is a high-severity vulnerability in the Linux kernel's iwlwifi PCIe driver. It involves null RX pointers remaining non-NULL after being freed during initialization failure, which can lead to use of stale RX state during teardown or retry. This flaw was fixed by setting certain RX-related pointers to NULL after freeing to ensure safe repeated cleanup and retry operations.
A use-after-free vulnerability was fixed in the Linux kernel's octeon staging driver. The issue involved missing disabling of the NAPI instance before freeing interrupts, which could lead to the active poll function accessing freed memory and causing a crash.
A vulnerability in the Linux kernel's ath11k wireless driver caused frames with out-of-range MCS values to be dropped due to invalid rate metadata. This was fixed by capping the MCS value to the maximum supported and properly setting encoding metadata, allowing valid frames to be processed instead of discarded.