A vulnerability in the Linux kernel eventfs subsystem involves improper locking during remount operations that walk eventfs inodes. The issue arises because the code only holds an RCU read lock, which is insufficient to prevent races with inode removal and attribute updates. This can lead to use-after-free conditions and potential system instability or denial of service. The vulnerability affects version 3.0 of the affected software.
A vulnerability in the Linux kernel related to USB driver resource management has been resolved. The issue involved improper lifetime management of device-managed resources tied to USB interfaces, causing potential memory leaks when drivers are unbound without physical device disconnection. Specifically, the control message buffer lifetime was not correctly released on driver unbind, leading to resource leakage.
A vulnerability in the Linux kernel's netfilter nft_bitwise component allowed zero shift operands in left and right shift expressions during initialization. This caused undefined behavior due to improper carry propagation logic when a zero shift was used. The issue was addressed by rejecting zero shift operands in the control plane alongside existing checks for shifts greater than or equal to 32, preventing malformed rules from reaching the packet processing path.
A use-after-free vulnerability exists in the Linux kernel's CAIF network subsystem due to improper clearing of client service pointers during teardown. Specifically, caif_free_client() releases a service object but leaves a stale pointer, which is later dereferenced, causing potential kernel instability. This issue has been resolved by clearing client/service links before releasing the service object to prevent repeated teardown problems.
A vulnerability in the Linux kernel ALSA control component was identified where the function snd_ctl_elem_init_enum_names() could call strnlen() with a zero length buffer, triggering a kernel panic due to a fortified strnlen() check. This occurs when the buffer length reaches zero but the loop continues, causing a BRK exception panic. The issue was found through kernel fuzz testing on a Xiaomi smartphone and fixed by adding a buffer length check before calling strnlen().
A vulnerability in the Linux kernel's igorplugusb driver related to USB request structure handling has been resolved. The issue involves improper handling of DMA coherency rules for USB control requests, which must be allocated separately to obey DMA coherency. This vulnerability affects version 3.0 of the affected product. The impact is limited to availability, with no confidentiality or integrity impact reported. No known exploits are in the wild, and no patch links are provided in the data.
A vulnerability in the Linux kernel's zram module causes the blkdiscard command to hang indefinitely when issuing partial discard requests. This occurs because zram does not support partial discards and fails to properly complete the I/O operation, leading to a hang in submit_bio_wait(). The issue has been fixed by ensuring bio_endio() is called to end the I/O operation correctly.
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: check for PCI upstream bridge existence
pci_upstream_bridge() returns NULL if the device is on a root bus. If
8821CE is installed in the system with such a PCI topology, the probing
routine will crash. This has probably been unnoticed as 8821CE is mostly
supplied in laptops where there is a PCI-to-PCI bridge located upstream
from the device. However the card might be installed on a system with
different configuration.
Check if the bridge does exist for the specific workaround to be applied.
Found by Linux Verification Center (linuxtesting.org) with Svace static
analysis tool.
In the Linux kernel, the following vulnerability has been resolved:
ALSA: aloop: Fix peer runtime UAF during format-change stop
loopback_check_format() may stop the capture side when playback starts
with parameters that no longer match a running capture stream. Commit
826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved
the peer lookup under cable->lock, but the actual snd_pcm_stop() still
runs after dropping that lock.
A concurrent close can clear the capture entry from cable->streams[] and
detach or free its runtime while the playback trigger path still holds a
stale peer substream pointer.
Keep a per-cable count of in-flight peer stops before dropping
cable->lock, and make free_cable() wait for those stops before
detaching the runtime. This preserves the existing behavior while
making the peer runtime lifetime explicit.
A vulnerability in the Linux kernel's ext4 filesystem code allows an out-of-bounds read due to an improper bounds check in the check_xattrs() function. The issue arises because the bounds check permits a pointer to be within sizeof(u32) bytes of the end of the valid region, leading to a 4-byte read beyond the valid memory area. This can cause a high-severity impact including potential denial of service due to memory corruption. The vulnerability affects version 3.0 of the Linux kernel ext4 code as specified. A fix involves adjusting the bounds check to ensure sufficient space for the 4-byte read. No patch link is provided in the data, and no known exploits are reported in the wild.
A vulnerability in the Linux kernel ext4 filesystem code could leave stale extent entries in the extent status tree if splitting an extent fails. This occurs because the code might return an error without properly dropping all partially processed extents. The issue has been resolved by ensuring all potentially stale extents are dropped when splitting fails. The vulnerability affects version 3.0 of the Linux kernel ext4 code. It has a medium severity rating and no known exploits in the wild.
A vulnerability in the Linux kernel's netfilter nft_counter component was addressed by adding a global static spinlock to serialize counter fetch and reset operations. This prevents concurrent dump-and-reset operations from causing counter value underruns. The fix involves taking a global lock before fetching the total counter value to avoid race conditions between parallel resets. The vulnerability affects version 3.0 of the product.
A vulnerability in the Linux kernel ext4 filesystem code could leave a stale unwritten extent in the extent status tree after certain block splitting and zeroing operations. This occurs when ext4_split_extent() attempts to split an unwritten extent with specific flags set but fails partially due to lack of space, resulting in inconsistent extent status caching. The issue has been fixed by ensuring the extent status entry is always cached after zeroing out the second part of the extent.
A NULL pointer dereference vulnerability exists in the Linux kernel's intel-ish-hid driver during the warm reset flow. Specifically, the cl->device pointer may be NULL if a reset occurs while clients are still enumerating, leading to a kernel panic when the code accesses cl->device->reference_count without a NULL check. This issue was found during multi-unit warm reboot stress cycles and fixed by adding a defensive NULL check to improve stability.
A vulnerability identified as CVE-2026-45893 in the Linux kernel's AppArmor component involves improper handling of possibly unaligned memory during table creation from a source blob that may originate from userspace. The issue has been fixed by correcting and optimizing the copying process to avoid unaligned memory accesses, which could otherwise lead to memory access errors. The vulnerability affects version 3.0 of the product. No known exploits are reported in the wild.
A vulnerability in the Linux kernel's libata-scsi subsystem can cause starvation of non-NCQ SCSI commands when multiple submission queues are used and the device is under constant NCQ command load. This results in very long delays or complete starvation of non-NCQ commands. The issue arises because non-NCQ commands are repeatedly deferred while NCQ commands continue to be issued, violating forward progress guarantees. The fix implements a mechanism to ensure non-NCQ commands are eventually processed by deferring their requeueing and managing command issuance accordingly.
A vulnerability in the Linux kernel ext4 filesystem was addressed to prevent stale data exposure when splitting unwritten extents during block allocation. The issue involved improper zeroing and marking of extents, which could leave stale data in written extents. The fix ensures correct handling of extent splitting flags to avoid converting entire extents to written prematurely.
In the Linux kernel, the following vulnerability has been resolved:
ipvs: skip ipv6 extension headers for csum checks
Protocol checksum validation fails for IPv6 if there are extension
headers before the protocol header. iph->len already contains its
offset, so use it to fix the problem.
A vulnerability in the Linux kernel's drm/display subsystem related to DisplayPort Multi-Stream Transport (DP MST) handling has been resolved. The issue involves a potential negative shift operation caused by a zero VCPI (Virtual Channel Payload Identifier) value when releasing a timeslot after a DP 2.1 monitor disconnects. This can lead to a shift-out-of-bounds error and kernel warnings or crashes. The flaw occurs because VCPI should never be zero, but the code did not properly handle this case, resulting in an invalid payload mask calculation.
A vulnerability in the Linux kernel's bareudp driver causes a NULL pointer dereference in the function bareudp_fill_metadata_dst(). This occurs because the function calls udp_tunnel6_dst_lookup() with a socket pointer that may be NULL if the device is down. The issue triggers a kernel crash (NULL pointer dereference) when the socket is not initialized. The vulnerability has been fixed by adding a NULL check that returns an error code when the socket is NULL.