CVE-2026-98729 is a vulnerability in the Linux kernel affecting x86 memory management on AMD F15h processors. The issue arises because the kernel incorrectly applies virtual address alignment (va_align) to hugetlb mappings, causing address misalignment and triggering a kernel bug during huge page teardown. This affects certain AMD processors such as Carrizo and FX-8370E. The flaw has been resolved by modifying the alignment logic to skip randomization for hugetlbfs mappings.
A vulnerability in the Linux kernel's TPM driver (tpm2_get_random function) allows an off-by-four bounds check error when processing TPM2_ST_SESSIONS tagged responses. This flaw can cause memcpy() to read up to 4 bytes beyond the response buffer, potentially leaking stale buffer contents into the caller's random bytes. The issue arises because the bounds check does not account for a skipped 4-byte parameter size field in the response. The vulnerability has been fixed by correcting the bounds check to validate against the correct response length.
A vulnerability in the Linux kernel's nvme-multipath subsystem causes incorrect handling of zoned block device features. The namespace head is marked as zoned prematurely based on the command set identifier, leading to a mismatch when zone info reports zero zone size. This results in the head advertising zoned capability with a zero zone size, causing errors in zone reporting or writing operations due to invalid shifts. The fix involves setting the BLK_FEAT_ZONED feature only after the zone information is confirmed.
A vulnerability in the Linux kernel's nvme-multipath component allows an underflow in ANA log bounds checks. This occurs because the parser subtracts untrusted object sizes from the ANA log buffer size without verifying the current offset first, potentially leading to out-of-bounds reads. The issue has been fixed by adding checks to ensure offsets and sizes are consistent before parsing ANA data.
CVE-2026-98725 is a critical vulnerability in the Linux kernel's nvmet-auth component, specifically in the nvmet_auth_challenge() function. The flaw is an out-of-bounds write caused by incorrect size calculation of the challenge header, leading to memory corruption. This can trigger kernel panics due to KASAN slab-out-of-bounds errors. The issue affects multiple Linux kernel versions and has a high CVSS score of 9.2.
A vulnerability in the Linux kernel's nvmet pci-epf driver allows out-of-bounds reads due to improper handling of too-short SGL segments. This occurs when the host provides an SGL segment length smaller than one descriptor, causing the kernel to read memory outside the allocated buffer. The issue has been identified and fixed by rejecting segments that cannot hold at least one descriptor.
A vulnerability in the Linux kernel's nvmet subsystem causes the host ID to be copied incorrectly during controller initialization, leading to improper handling of Preempt and Abort operations in namespace reservations. This results in the preempting host incorrectly believing it has aborted the victim's in-flight I/O, while the victim's I/O continues. The issue affects multiple specific Linux kernel versions and has a CVSS score of 6.9 (medium severity).
A divide error vulnerability in the Linux kernel's block2mtd module occurs when the erase_size parameter is set to zero, leading to a division by zero during device initialization. This issue has been fixed by rejecting zero erase_size values before the modulo operation.
A vulnerability in the Linux kernel's Cadence NAND interrupt handler was fixed by ensuring the IRQ state is initialized before requesting the IRQ. The issue involved a race condition where a pending interrupt could access uninitialized synchronization state due to the IRQ being registered before initialization of the IRQ lock and completion object.
CVE-2026-98720 is a vulnerability in the Linux kernel's KVM nested virtualization (nVMX) implementation. It involves a failure to refresh the MSR bitmap when runtime eVMCS controls are modified, which can lead to improper TPR virtualization handling. This flaw allows a nested guest (L2) or the intermediate guest (L1) to read and write the host's (L0) TPR register incorrectly. The issue has been resolved by forcing a refresh of the vmcs02 MSR bitmap during nested VM-Enter when runtime eVMCS controls are updated.
CVE-2026-98717 is a vulnerability in the Linux kernel's KVM x86 memory management unit (mmu) subsystem. It occurs when shadow page table walks continue despite the root being invalid or a dummy root, leading to a NULL pointer dereference and kernel crash. This happens if memslot creation races with a stage-2 page fault, causing KVM to use the zero page incorrectly. The issue has been resolved by terminating shadow walks immediately when encountering a dummy root, preventing the NULL pointer dereference.
A vulnerability in the Linux kernel's KVM SVM implementation was fixed by ensuring the active VMCB's MSR bitmap is used when checking if an MSR is intercepted. Previously, the code incorrectly assumed usage of a specific bitmap (vmcb02) when L2 was active, which could lead to improper MSR interception handling.
CVE-2026-98715 is a low-severity vulnerability in the Linux kernel's KVM SVM implementation. It involves improper handling of TLB control on a failed VMRUN instruction, which can cause the CPU to skip a required TLB flush. This flaw may lead to unnecessary flushing of all ASIDs on subsequent successful runs, potentially causing performance noise but no direct security compromise. The issue arises from clearing TLB control on failure, which drops the flush operation. The vulnerability affects specific Linux kernel versions listed explicitly. There is no indication of active exploitation or critical impact.
A vulnerability in the Linux kernel's KVM SVM implementation was fixed by ensuring that control fields are updated on VMEXIT only if the VMRUN instruction succeeded. If VMRUN fails, control fields such as erap_ctl and control.clean remain unchanged, as AMD does not guarantee behavior on VMRUN failure.
A low-severity vulnerability in the Linux kernel's KVM arm64 implementation involves the handling of fine-grained undefined instructions (UNDEFs) without the FEAT_FGT hardware feature. The issue is addressed by applying fine-grained UNDEFs unconditionally, which also resolves a warning triggered when running a TLBI OS guest without FEAT_TLBIOS on non-FEAT_FGT hardware.
CVE-2026-98712 is a high-severity vulnerability in the Linux kernel's KVM arm64 virtual generic interrupt controller (vgic) subsystem. The flaw involves improper reference counting of interrupts referenced by last_lr_irq, which can lead to use-after-free conditions when interrupts vanish due to concurrent unmapped LPIs. The issue is resolved by incrementing the reference count when last_lr_irq is populated and decrementing it during LPI reclamation.
A vulnerability in the Linux kernel's cw1200 WiFi driver allowed out-of-bounds reads during transmission padding, leaking up to 511 bytes of kernel heap data to the device. This occurred because the TX path sent padded data from the frame buffer without reserving space for padding, exposing stale memory. The issue has been fixed by ensuring proper padding allocation and zeroing the padding bytes before transfer. The vulnerability has a low severity score and does not affect the RX path.
CVE-2026-98710 is a low severity vulnerability in the Linux kernel's iwlegacy wifi driver for the 3945 device. The issue involves a memory leak of EEPROM data when the PCI device is removed because the remove path does not free allocated EEPROM memory after a successful probe. This flaw was identified through manual code inspection and affects specific Linux kernel versions.
A use-after-free vulnerability exists in the Linux kernel's mac80211 wifi component due to improper counting of channel context reservations during replacement operations. This flaw can cause the kernel to prematurely free a channel context still in use, potentially leading to memory corruption during beacon generation.
CVE-2026-98708 is a high-severity vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem. It involves premature freeing of an old channel context (chanctx) while its replacement still references it, potentially leading to use-after-free conditions. The flaw occurs because early free paths do not consider the replacement pairing, causing stale pointers to be dereferenced during later operations. This issue affects specific linux-aws kernel versions and has been resolved by ensuring the old chanctx remains alive until its replacement is fully torn down.