A buffer overread vulnerability in the Linux kernel's ath12k WiFi driver (ath12k_wmi_op_rx function) has been resolved. The flaw occurs because the firmware buffer is read without verifying it contains enough data to hold the expected header, potentially causing out-of-bounds memory access. The issue has been fixed by adding a check to ensure the buffer has sufficient data before reading. This vulnerability affects multiple specific Linux kernel versions used in various Ubuntu LTS releases.
A vulnerability in the Linux kernel's ath6kl WiFi driver has been resolved. The issue involved certain WMI event handlers reading from event buffers without verifying that the buffer was large enough, leading to potential buffer overreads. The affected handlers include ath6kl_wmi_scan_complete_rx(), ath6kl_wmi_addba_req_event_rx(), and ath6kl_wmi_delba_req_event_rx(). Length checks were added to prevent these overreads.
A vulnerability in the Linux kernel's ksmbd component allowed skipping mandatory byte-range lock checks for single-byte ranges, potentially permitting conflicting operations on locked bytes. This was due to a shortcut in the check_lock_range() function that incorrectly treated single-byte ranges as empty. The issue has been resolved by removing this shortcut to ensure proper lock checks.
A race condition in the Linux kernel's NFC subsystem (nci) was fixed that could cause a double completion callback leading to a socket reference count underflow and premature socket freeing. This occurs due to concurrent calls to nci_data_exchange_complete() from nci_close_device() and nci_rx_work after a change in workqueue flushing order. The fix ensures only one caller proceeds with the callback by using test_and_clear_bit().
A race condition vulnerability in the Linux kernel's mt76 wifi driver related to RXDMAD_C buffer recycling has been resolved. The issue involves buffers from RRO data queues' page pools being recycled directly, which can race with the owning NAPI, potentially leading to severe impact on confidentiality, integrity, and availability.
A use-after-free (UAF) vulnerability in the Linux kernel's BPF subsystem was fixed. The issue occurred because the bpf_link_show_fdinfo and bpf_link_get_info_by_fd functions accessed link->prog without proper locking, allowing a concurrent update to free the old program and cause UAF. The fix involves using RCU protection to safely access link->prog and ensure its lifetime during reads.
A vulnerability in the Linux kernel's IB/isert component allowed login PDUs to declare more data than was actually received, leading to out-of-bounds reads. This flaw occurred because the code did not verify that the declared DataSegmentLength in the login PDU's Basic Header Segment (BHS) matched the actual received data length. Attackers could exploit this by sending a login PDU with a declared length larger than the data sent, causing the kernel to read beyond the allocated buffer. The issue was fixed by adding checks to reject login PDUs where the declared length exceeds the received data length.
A use-after-free (UAF) vulnerability was resolved in the Linux kernel's RDMA/rxe component. The flaw occurs in the error-handling path of the rxe_odp_mr_init_user() function, where a memory region (MR) pointer is not cleared after a failed initialization, leading to a double release and use of freed memory. This can cause memory corruption. The vulnerability affects specific versions of the linux-hwe-edge kernel. It has a CVSS score of 7.8, indicating a high severity impact on confidentiality, integrity, and availability.
A use-after-free vulnerability was identified and fixed in the Linux kernel's RDMA core component, specifically in the ib_destroy_cq_user() function. The issue involved improper synchronization when accessing a Completion Queue (CQ) via the netlink path, allowing a short window where the CQ could be accessed after its resources were freed. The fix involved reordering the removal of the CQ from the resource tracking system to occur before resource deallocation, ensuring safe lifecycle management.
CVE-2026-90059 is a vulnerability in the Linux kernel's stmmac network driver where the RX DMA offset does not include NET_IP_ALIGN, causing misaligned IP headers on architectures with a 2-byte alignment requirement. This misalignment leads to fatal kernel panics on ARM32 systems when processing certain network packets, such as ICMP echo requests. The issue arises from a zero-copy RX path conversion that omitted NET_IP_ALIGN from the DMA offset calculation. The vulnerability has been fixed by restoring NET_IP_ALIGN in the RX offset to ensure proper packet header alignment.
A vulnerability in the Linux kernel related to the octeontx2-vf driver has been resolved. The issue involved a race condition between workqueue and network device operations during probe and remove phases. Specifically, the VF workqueue was not initialized before register_netdev(), which could cause ndo_set_rx_mode to queue work on a NULL workqueue. The fix ensures proper initialization and cleanup order to prevent this race condition.
CVE-2026-93107 is a high-severity vulnerability in the Linux kernel's RDMA/rxe subsystem. It involves improper handling of packets when a Queue Pair (QP) enters an error state, causing the same packet to be reprocessed multiple times. This leads to duplicate completions indistinguishable from legitimate receives, resulting in data stream corruption for user-level protocols relying on exactly-once delivery. The flaw can cause a kernel NULL pointer dereference and system instability. A fix has been implemented in Linux kernel version 6.4.
A vulnerability in the Linux kernel's RDMA hfi1 driver causes a resource leak when device initialization fails late in the probe process. Specifically, RX data allocated during initialization is not freed if certain later initialization steps fail, leading to memory leaks.
CVE-2026-92525 is a vulnerability in the Linux kernel's RDMA rxe driver where user-supplied Work Queue Elements (WQEs) are not properly validated before indexing an array, leading to an out-of-bounds read. This can be triggered by a local unprivileged user posting a WQE with out-of-range cur_sge or oversized num_sge values, causing a local denial of service (DoS) via a vmalloc out-of-bounds read. The issue has been fixed by adding bounds checks on num_sge and cur_sge before use.
A vulnerability in the Linux kernel's mt76 wireless driver (specifically mt7996) involves improper validation of the RX band index before accessing an array. The band_idx value, derived from a 2-bit descriptor field, could be out of bounds or null, leading to potential invalid memory access. This issue has been fixed by rejecting invalid band indices.
CVE-2026-90142 is a high severity vulnerability in the Linux kernel's virtio_net driver related to improper resizing of the RX ring buffer when an AF_XDP socket is attached. The flaw causes a write past the end of the buffer array during RX ring resizing, which can lead to memory corruption. The issue is reproducible using specific ethtool and xdpsock commands. A patch has been made available to fix this buffer resizing error.
joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi.