A vulnerability in the Linux kernel's iio pressure driver for rohm-bm1390 sensors caused the data reading function to ignore cached error values and always return 0, even when a read operation failed. This could lead to user-space applications receiving invalid data without indication of failure. The issue has been resolved by modifying the function to return the cached error value after stopping the measurement, ensuring that users are informed if a read fails and that invalid data is not silently propagated.
A vulnerability in the Linux kernel's iio proximity driver for aw96103 was resolved by improving validation of firmware data length. The firmware parser previously could read beyond the buffer or interpret an underflowed length as a very large value, potentially causing out-of-bounds reads. The fix involves validating header size, rejecting underflowed lengths, and ensuring the payload fits within the firmware image.
A vulnerability in the Linux kernel's KVM arm64 implementation was resolved by improving validation of the SVE vector length in the pkvm_vcpu_init_sve() function. The issue involved insufficient validation of the host-provided sve_max_vl value, which could lead to a fatal condition at EL2 due to an invalid vector length causing a WARN_ON() trigger. The fix ensures that sve_vl_valid() is checked before calculating the state size, preventing invalid lengths from causing kernel faults.
A vulnerability in the Linux kernel Bluetooth driver (btintel_pcie) was resolved that involved improper validation of device-supplied DMA indices. The driver used a 16-bit device-controlled value as an array index without bounds checking, allowing out-of-bounds memory access. Additionally, a loop could become infinite due to unvalidated indices. The issue was fixed by adding bounds checks and logging invalid values.
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) sock context code generation was fixed. The issue involved incorrect handling of the rx_queue_mapping field, where the code used 64-bit move instructions that could cause the register to hold values outside the verifier's assumptions. This discrepancy could lead to unexpected runtime values. The fix ensures the read value width matches the assumed size by using 32-bit move instructions and correctly reporting the destination variable size.
A vulnerability in the Linux kernel NFC driver for pn533 devices allowed an out-of-bounds read due to improper validation of the ccid.datalen field from USB response frames. This could be triggered by a malicious or malfunctioning device sending crafted data. The issue was fixed by bounding the datalen value against the maximum frame size before use.
A vulnerability in the Linux kernel's BPF implementation on MIPS32 was fixed. The issue involved an incorrect instruction emitted for immediate JMP JEQ/JNE operations, causing invalid comparisons when the immediate operand was negative. This was due to using an addu instruction instead of addiu, leading to misinterpretation of the immediate value as a register. The flaw affected constant blinding via BPF_REG_AX. The vulnerability was identified with test_bpf on MIPS32r1 emulated by QEMU and has been resolved.
A vulnerability in the Linux kernel's af_packet subsystem involves an integer overflow in the prb_calc_retire_blk_tmo() function. This overflow can cause a negative timeout value to be used in a high-resolution timer, resulting in a timer that fires continuously at maximum rate. This behavior can cause a CPU to spin indefinitely in a softirq context, effectively leading to a denial of service. The issue arises from 32-bit integer arithmetic overflow when calculating block size timeouts, triggered by user-controlled parameters. The vulnerability has been resolved by changing the calculation to use 64-bit arithmetic.
A vulnerability in the Linux kernel's atl1e network driver caused a soft lockup due to an out-of-range hardware pointer read during PCIe link or MAC reset. This issue was fixed by treating the out-of-range value as no new data to clean, preventing an infinite loop.
A vulnerability in the Linux kernel's atl1 network driver caused a soft lockup due to an out-of-range read of cmb_tpd_next_to_clean. This occurs when the hardware reports an invalid value (0xffff) during PCIe link or MAC reset, causing an infinite loop in the driver. The issue has been resolved by treating the out-of-range value as indicating no new data to clean.
A vulnerability in the Linux kernel's atl1c network driver caused a soft lockup due to an out-of-range tpd_cons read. The hardware can report an invalid tpd_cons value (0xffff) during PCIe link or MAC reset, causing an infinite loop and CPU soft lockup. This issue was reproduced on systems using Qualcomm Atheros AR8151 v2.0 NICs, triggered by rebooting a Mikrotik CCR2004 PCIe card. The problem manifests as a transmit queue timeout and a stuck CPU thread in the atl1c_clean_tx function.
A vulnerability in the Linux kernel related to the SO_RESERVE_MEM socket option has been fixed. The issue involved improper handling of SO_RESERVE_MEM on UDP sockets, which are only supported for TCP, leading to potential memory corruption due to concurrent operations and lack of proper locking. Additionally, there was no upper bound on the value passed to SO_RESERVE_MEM, causing integer overflow and memory corruption risks. The fix restricts SO_RESERVE_MEM usage to TCP sockets and caps the maximum value to 1GB.
CVE-2026-98797 is a high-severity vulnerability in the Linux kernel related to the handling of skb->queue_mapping during packet transmission. The flaw arises when a nested transmit operation consumes a stale queue_mapping value, leading to out-of-bounds access in the taprio scheduler's child array. This can occur when a local user with CAP_NET_ADMIN in a network namespace redirects packets between devices with differing numbers of TX queues under specific kernel configurations. The issue has been resolved by properly capping skb->queue_mapping and managing the skip_txqueue flag to prevent stale values from affecting outer transmit operations.
A vulnerability in the Linux kernel's drm/mediatek driver involves a missing IS_ERR check for the ovl_adaptor platform device. The platform_device_register_data() function can fail and return an ERR_PTR, but this return value was not checked, leading to an invalid pointer being stored and passed to other kernel functions. This flaw can cause a kernel crash. The issue has been resolved by adding the missing IS_ERR check to handle errors properly.
CVE-2026-98744 is a medium severity vulnerability in the Linux kernel's ASoC codec max98363 driver. The issue arises because the stream_config structure is not properly initialized before being passed to sdw_stream_add_slave(), causing the type field to contain uninitialized (garbage) data. This uninitialized value is then copied to stream->type by sdw_config_stream(). The vulnerability has been fixed by zero-initializing stream_config so that the type defaults to SDW_STREAM_PCM.
A vulnerability in the Linux kernel's mac80211 minstrel_ht rate control module allows out-of-bounds memory access via the fixed_rate_idx debugfs file. This file accepts any u32 value, which can lead to invalid indexing into internal arrays and subsequent kernel memory corruption. The debugfs file is only accessible to root, so this is not a privilege escalation issue but remains a kernel memory safety bug.
A vulnerability in the Linux kernel's SCSI zoned block device (sd_zbc) handling allows disks reporting an excessively high number of zones to cause inconsistent zone bookkeeping. This occurs because the kernel truncates the 64-bit zone count to a 32-bit unsigned int, and uses a signed int for indexing, which can overflow. The kernel now rejects devices reporting more zones than the maximum signed int value at scan time.