CVE-2026-98749 is a vulnerability in the Linux kernel's max3100 serial driver where a timer is not properly shut down before the port is freed. This can lead to a timer callback accessing freed memory, potentially causing instability. The issue arises during system suspend and resume sequences when the SPI device is unbound before resume. The fix involves proper timer teardown, freeing IRQs, and destroying workqueues to prevent race conditions and use-after-free scenarios.
A use-after-free vulnerability in the Linux kernel's serial driver for 8250_bcm7271 was fixed. The flaw occurs in the brcmuart_remove() function where a high-resolution timer callback can dereference freed memory due to improper timer cancellation order. This issue was identified by static analysis and affects specific Linux kernel versions.
A NULL pointer dereference vulnerability exists in the Linux kernel's serial core component within the serial_core_unregister_port() function. This occurs when the port device pointer is NULL due to no port device being installed or removed during teardown. The flaw can lead to a kernel crash when the function dereferences this NULL pointer. The issue has been fixed by adding checks to return early if no port device is present and properly clearing the port device pointer on error paths.
A clock reference leak vulnerability was identified and fixed in the Linux kernel's ma35d1 serial driver. The issue involved the ma35d1serial_probe() function failing to release clock references obtained via of_clk_get(), leading to resource leaks on error paths and during port removal.
CVE-2026-98745 is a vulnerability in the Linux kernel's arm64/fpsimd signal handling code affecting systems that support SME but not SVE. It occurs when restoring a crafted SVE signal context causes the task to have non-streaming SVE state, which is unsupported by the hardware. This can lead to fatal undefined instruction exceptions (EL1 UNDEF) and kernel panics during state restoration. The flaw arises because the kernel fails to reject signal contexts where the streaming mode flag is clear but an SVE payload is present. The issue has been resolved by correcting the context restoration logic to reject such invalid states.
CVE-2026-98744 is a medium severity vulnerability in the Linux kernel's ASoC codec max98363 driver. The issue arises because the stream_config structure is not properly initialized before being passed to sdw_stream_add_slave(), causing the type field to contain uninitialized (garbage) data. This uninitialized value is then copied to stream->type by sdw_config_stream(). The vulnerability has been fixed by zero-initializing stream_config so that the type defaults to SDW_STREAM_PCM.
CVE-2026-98743 is a medium-severity vulnerability in the Linux kernel's ASoC codec driver for rt1017-sdca-sdw. The issue arises because the stream_config->type field is uninitialized before being passed to sdw_stream_add_slave(), potentially causing it to contain garbage data. This field is later copied to stream->type by sdw_config_stream(). The fix involves zero-initializing stream_config so that type defaults to SDW_STREAM_PCM and using a helper function to set parameters correctly.
A concurrency vulnerability in the ALSA sequencer component of the Linux kernel allows improper serialization of compat port-info ioctl requests. This flaw can cause port index wrapping and duplicate port addresses, potentially leading to use-after-free conditions when subscribers are torn down.
CVE-2026-98741 is a vulnerability in the ALSA ua101 driver in the Linux kernel where mismatched capture and playback USB packet sizes are not properly validated. This can cause out-of-bounds memory writes during playback initialization, leading to potential kernel memory corruption. Genuine UA-101/UA-1000 hardware is unaffected due to proportional packet size declarations. The flaw was identified in specific Linux kernel versions and has a high severity rating.
A vulnerability in the Linux kernel's EDAC/altera driver involves the improper use of the __init attribute on ECC setup functions. These functions, which run during device probing, may be called after the __init memory is freed due to deferred probing or manual unbind/rebind operations. This can lead to dereferencing freed memory, causing potential instability or crashes. The issue affects specific Linux kernel versions used in various Ubuntu releases.
CVE-2026-98739 is a race condition vulnerability in the Linux kernel's Bluetooth RFCOMM implementation. It involves a race in managing the initial port reference between installation and release paths, which can lead to a use-after-free condition. This flaw was detected by KASAN and can cause kernel memory corruption. The issue affects specific linux-aws kernel versions. A fix has been implemented to use atomic bit operations to prevent double dropping of the reference.
CVE-2026-98738 is a high-severity vulnerability in the Linux kernel's Bluetooth subsystem. It involves a race condition in the handling of remote Out-Of-Band (OOB) data during Secure Manager Protocol (SMP) pairing. The flaw arises because SMP accesses remote OOB data without proper serialization, allowing concurrent removal of the data that can lead to use-after-free errors. This issue was detected by Kernel Address Sanitizer (KASAN) and could cause memory corruption. The vulnerability affects specific linux-aws kernel versions. A fix has been implemented by introducing a dedicated mutex to serialize access to remote OOB data, preventing concurrent modification and use-after-free conditions.
CVE-2026-98737 is a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem affecting the hci_sync component. The flaw arises from improper locking during inquiry cache lookups and updates, leading to potential access of freed memory. This issue has been fixed by ensuring proper locking and safe memory handling during Bluetooth inquiry cache operations.
CVE-2026-98736 is a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem related to enhanced SCO (Synchronous Connection-Oriented) setup. The flaw occurs because the hci_enhanced_setup_sync() function accesses a parent connection object without holding the necessary lock, allowing a race condition where the parent can be freed while still in use. This can lead to a kernel memory corruption detected by KASAN. The issue affects specific Linux kernel versions and has a medium severity rating with a CVSS score of 5.7.
CVE-2026-98735 is a use-after-free vulnerability in the Linux kernel's Bluetooth hci_core component. It arises from improper synchronization when scheduling ACL transmissions and deleting channels, leading to potential memory corruption. The flaw was detected by KASAN and involves race conditions between channel selection and teardown. This vulnerability affects specific Linux kernel versions and has a high severity score.
CVE-2026-98734 is a use-after-free vulnerability in the Linux kernel's Bluetooth hci_core component. It arises from improper serialization of SCO and ISO scheduling with connection teardown, leading to potential access of freed memory. The issue is fixed by holding the device lock across connection selection and transmission, preventing unsafe concurrent access and queue purging races.
CVE-2026-98733 is a use-after-free vulnerability in the Linux kernel's Bluetooth hci_core component. It arises from improper serialization of fragmented ISO packet queueing, where concurrent operations on the packet queue can lead to memory corruption and use-after-free conditions. This flaw has been addressed by holding the queue lock across the entire fragment batch to ensure safe concurrent access.
A buffer over-read vulnerability in the Linux kernel Bluetooth component (btintel) was fixed. The issue involved the btintel_hw_error() function printing exception information using skb->data + 1 without ensuring the 12-byte payload was NUL-terminated, potentially reading beyond the buffer's end. The fix bounds the print operation to the actual length of the data to prevent over-read.
A vulnerability in the Linux kernel Bluetooth subsystem (btintel_pcie) allows an integer overflow in the plen calculation in the btintel_pcie_recv_frame() function. The plen variable is a 16-bit unsigned integer computed as HDR_SIZE plus dlen, where dlen is a 16-bit field. If dlen is >= 0xFFFC, the addition wraps around, bypassing a length check and causing skb_trim() to truncate the packet improperly. This issue has been fixed by widening plen to a 32-bit integer to prevent overflow.
A vulnerability in the Linux kernel Bluetooth driver btintel_pcie allows a user-space process with HCI_CHANNEL_USER access to inject oversized TX packets, causing a buffer overflow in the send_frame() function. This occurs because the function copies data into a fixed-size 4096-byte buffer without properly rejecting packets that exceed the buffer size minus the PCIe header length. The issue has been resolved by rejecting packets larger than the allowed size on entry.