CVE-2026-98939 is a vulnerability in the Linux kernel related to the x86 memory management subsystem. It involves an unnecessary PMD page copy operation during page freeing, which causes a potential deadlock due to circular locking dependencies involving the mmap_lock and pool_shrink_rwsem locks. The issue arises when the kernel attempts to avoid hardware setting Accessed=1 bits in unreachable page table entries, which is unnecessary. The fix removes the PMD copy, detaches the PMD page at the PUD level, flushes mid-level caches, and frees PTE tables directly, eliminating the problematic allocation and locking cycle.
A vulnerability in the Linux kernel USB hub driver causes an AMD platform issue due to holding a USB3 hub power management runtime reference for 200ms during hub resume. This can lead to crashes on systems using Android adb that frequently wake the USB subsystem. The issue is mitigated by reducing the hold time to 120ms for USB3 root hubs, which is also an optimization. External hubs retain the 200ms hold time. Vendors are working on solutions, and disabling USB runtime PM can prevent the issue.
A vulnerability in the Linux kernel's KVM arm64 module related to the lifecycle management of the nested_mmus array has been fixed. The nested_mmus array holds shadow page tables for nested virtualization contexts. Improper handling could lead to use-after-free conditions when the array is reallocated during VCPU initialization while a vCPU is running. The fix changes the array to an array of pointers allocated at VM creation to avoid reallocation and clarifies object lifecycle management.
A vulnerability in the Linux kernel's AMD display driver related to DPMS (Display Power Management Signaling) was resolved by removing unsafe usage of the optional stream->sink pointer. The fix ensures that stream->sink is checked before dereference and replaces stream->sink->link with stream->link to avoid null pointer dereferences and resource inconsistencies.
Hewlett Packard Enterprise (HPE) released security updates addressing 72 vulnerabilities in ArubaOS, including eight maximum-severity flaws involving authentication bypass and remote code execution (RCE). These critical vulnerabilities affect multiple versions of AOS-8 and AOS-10 and can be exploited remotely without privileges or user interaction. HPE strongly urges customers to apply patches promptly and recommends restricting access to management interfaces to reduce exploitation risk. No public exploit code or active exploitation has been reported as of the advisory date.
CVE-2026-99082 is a vulnerability in the Linux kernel's KVM x86 virtualization component related to the handling of per-vCPU MMIO cache and memslots in System Management Mode (SMM). The flaw allows stale MMIO cache entries from the SMM address space to remain valid after switching back to the normal address space, potentially causing incorrect memory writes that bypass KVM's write-tracking mechanisms. This can lead to inconsistent nested EPT table states and trigger kernel warnings. The issue is fixed by using the active memslots for caching and validation, ensuring proper separation of address spaces.
A resource management vulnerability in the Linux kernel's Microchip Sparx5 driver was resolved. The flaw involved improper cleanup of PSFP (Per-Stream Filtering and Policing) resources when the flower setup process failed, potentially leading to resource leaks. Specifically, allocated stream gate, flow meter, and stream filter resources were not released on error paths. Additionally, incorrect handling of flow meter IDs could cause erroneous deletion attempts and reference count inconsistencies.
A vulnerability in the Linux kernel's AMD GPU driver was resolved. The issue involved scheduling thermal work on a queue that was not initialized when Dynamic Power Management (DPM) was disabled via the amdgpu.dpm=0 module parameter. This could lead to improper handling of thermal work scheduling.
A vulnerability in the Linux kernel's imx mailbox driver was resolved by adjusting the power management runtime enablement sequence. The issue involved early usage of the device before probe completion, which could lead to improper device removal and shutdown handling. The fix delays pm_runtime_enable() to the removal path and reorders device registration to ensure proper cleanup.
CVE-2026-99078 is a critical vulnerability in the Linux kernel's mlx5e network driver related to AF_XDP zero-copy buffer management. It involves stale XSK buffer releases during MPWQE refill retries, which can lead to double-free conditions. The flaw is fixed in specific Linux kernel commits.
A vulnerability in the Linux kernel's Xilinx GPIO driver causes a runtime power management (PM) reference leak when the gpio request function fails. This leak prevents the controller from runtime-suspending, leaving its clock enabled unnecessarily. The issue is fixed by changing the PM usage counter increment to occur only on success.
A race condition vulnerability in the Linux kernel's key management subsystem was fixed. The flaw allowed a writer with write permission on a destination keyring to bypass keyring restrictions by exploiting a timing issue in add_key() operations. This could result in keys being linked despite a reject-all restriction. The issue was confirmed through extensive testing and was resolved by reordering the restriction check to ensure proper synchronization.
A vulnerability in the Linux kernel's sdhci-sprd driver involves improper handling of runtime power management (PM) during device removal. The driver enables runtime PM on probe but does not correctly disable it on removal, potentially leading to clock management issues if the device is runtime suspended. The issue was identified through manual code inspection and has been fixed in specific commits.
CVE-2026-99009 is a vulnerability in the Linux kernel's Bluetooth RFCOMM implementation involving improper locking order during session socket connection. This flaw causes a circular locking dependency between rfcomm_mutex and hdev->lock, leading to lockdep warnings and potential deadlocks. The issue arises when an RFCOMM connect() call is made while a BR/EDR link is being authenticated. The fix involves changing the locking order to connect the session socket before acquiring rfcomm_mutex, preventing the circular dependency and ensuring proper session management.
CVE-2026-99005 is a race condition vulnerability in the Linux kernel's drm/i915 graphics driver related to power management interrupt handling. The flaw allows unmasking of interrupts when the graphics technology (GT) is parked and the runtime power management wakelock is dropped, potentially causing kernel tainting due to hardware access without proper wakelock. This issue arises from a timing window between checking an ACTIVE state and queuing work that can execute after the GT is parked. The vulnerability has been fixed by ensuring interrupts are only unmasked when the ACTIVE state is true.
A memory management issue in the Linux kernel's btrfs subsystem was fixed where the function btrfs_uring_read_extent() failed to free allocated iov memory on error paths except for a specific deferred case. This could lead to a memory leak. The issue affects Linux kernel version 6.13 and has been corrected in subsequent commits.
A vulnerability in the Linux kernel's drm/vc4 driver was fixed by disabling the V3D interrupt across runtime suspend. The issue involved spurious interrupts occurring after the power domain was turned off, causing the interrupt handler to run when hardware registers returned invalid data. This could lead to scheduling of overflow memory work incorrectly. The fix ensures the interrupt line is disabled during power management transitions to prevent these spurious interrupts.
A vulnerability in the Linux kernel's dpaa2-switch component was fixed by correcting the error handling in the dpaa2_switch_rx() function. The issue involved improper freeing of frame descriptors on error paths, which could lead to incorrect memory management. The fix involves adjusting the freeing mechanism to properly handle DMA unmapping and page freeing before SKB creation and SKB freeing afterwards.