CVE-2026-98707 is a high-severity vulnerability in the Linux kernel's mac80211 WiFi subsystem. It involves improper handling of the RX Block Acknowledgement (BA) session timer during teardown, which can lead to use-after-free conditions. This occurs because the session timer may remain queued on freed memory, allowing later timer callbacks to access invalid memory. The flaw is addressed by using timer_shutdown_sync() to prevent rearming of the timer once teardown begins.
CVE-2026-98706 is a high-severity vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem. It involves improper handling of power-save (PS) delivery work during the teardown of a station (AP or mesh). The flaw allows a delayed worker to continue processing after the station has been marked dead and removed, potentially causing inconsistent driver state and queue management.
A vulnerability in the Linux kernel's mac80211 wifi subsystem allowed proxy path management to bypass the mesh path limit, potentially leading to exceeding the maximum allowed mesh paths. This was due to incorrect accounting of proxy paths against the mesh path limit, which could cause the interface path counter to become negative and allow more mesh paths than intended. The issue has been resolved by properly reserving and releasing quota for proxy paths, enforcing a shared 1024-entry budget for mesh and proxy paths.
A high-severity vulnerability in the Linux kernel's mac80211 WiFi subsystem involves use-after-free of fallback association elements when associating to a non-transmitted MBSSID profile. This occurs during association response parsing when certain information elements (WMM, HT, or VHT) are omitted, leading to reading freed memory. The issue has been resolved by keeping the fallback parse result alive until association setup completes.
A vulnerability in the Linux kernel's mac80211 minstrel_ht rate control module allows out-of-bounds memory access via the fixed_rate_idx debugfs file. This file accepts any u32 value, which can lead to invalid indexing into internal arrays and subsequent kernel memory corruption. The debugfs file is only accessible to root, so this is not a privilege escalation issue but remains a kernel memory safety bug.
A vulnerability in the Linux kernel's mac80211 wireless subsystem allows a specially crafted Channel Switch Announcement (CSA) frame to cause a kernel panic. This occurs because the kernel improperly handles an invalid 320 MHz bandwidth indication on non-6 GHz links, leading to an uninitialized read and potential panic when panic_on_warn is enabled. The issue has been resolved by rejecting invalid channel definitions before processing.
CVE-2026-98701 is a high-severity vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem. It involves improper release of mesh path quota when mesh path additions fail, leading to exhaustion of the MESH_MAX_MPATHS quota despite fewer actual paths being held. This prevents new mesh paths from being created to reachable destinations.
A medium severity vulnerability in the Linux kernel's mac80211 wifi subsystem was fixed by ensuring the info->band field is correctly set for 802.3 encapsulation offload frames. Previously, this field remained zero on non-MLD interfaces, causing incorrect band usage in transmission rate calculations. The fix aligns the handling with ieee80211_build_hdr() by dropping frames without a channel context and leaving the band at zero on MLD interfaces.
A use-after-free (UAF) vulnerability was fixed in the Linux kernel's mac80211 wireless subsystem related to mesh fast transmit path deletion. The flaw involved stale pointers in a cache after mesh path deletion, which could lead to referencing freed memory. This issue affects specific Linux kernel versions and has a high severity rating with a CVSS score of 7.3.
A vulnerability in the Linux kernel's mac80211 wifi component allows improper handling of empty FILS association request payloads. This can lead to a kernel BUG or passing invalid data to the crypto backend during AES-SIV encryption. The issue occurs because the code does not properly handle zero-length plaintext in the FILS Session element of (Re)Association Request frames.
A race condition vulnerability in the Linux kernel's USB serial driver was fixed by ensuring dynamic IDs are only freed after the driver deregistration and removal of the 'new_id' attribute. This prevents leaking IDs added by concurrent writes to the attribute.
A vulnerability in the Linux kernel USB serial driver modules related to improper driver deregistration order has been fixed. The issue involved unloading the USB driver after the USB serial bus drivers, which could lead to use-after-free errors in completion handlers accessing port data. The fix ensures the USB driver is deregistered before the USB serial bus drivers and that 'new_id' attributes are removed first to prevent new IDs from triggering probes after deregistration.
A race condition in the Linux kernel USB serial driver could cause a NULL-pointer dereference if a device is disconnected during lengthy break signalling. The issue arises because tty ioctls can race with hangup, potentially calling into a tty driver for a device that is no longer present or powered down. This vulnerability has been fixed by serializing callbacks with the tty port mutex and adding checks to ensure the port has not been hung up before accessing driver data or hardware.
A use-after-free vulnerability was identified and fixed in the Thunderbolt driver of the Linux kernel. The issue occurs when a request is canceled, leading to a race condition where a work item may be scheduled after its associated memory has been freed. This flaw was detected by KASAN during stress testing and could cause kernel memory corruption. The fix ensures canceled requests are not rescheduled and cleans up memory properly during cancellation.
CVE-2026-98693 is a vulnerability in the Linux kernel's Thunderbolt driver related to improper handling of router references for allocated HopIDs. The flaw allows a DP tunnel to outlive its expected lifecycle, leading to operations on freed IDAs and triggering warnings. This can occur when unbinding the driver while a DP tunnel is still waiting for DPRX capabilities to be read, notably triggered by unplugging the Apple NHI cable. The issue is resolved by holding a router reference for each allocated HopID and releasing it appropriately to keep ports and their HopID IDAs alive during use.
A vulnerability in the Linux kernel's Thunderbolt driver related to DisplayPort (DP) tunnel activation callback handling has been resolved. The issue involved an optional callback that, if not provided, caused a reference leak for every tunnel without a callback. This affected hibernation restore by blocking for up to 12 seconds. The fix makes the DP tunnel activation callback mandatory, removing the synchronous path and ensuring proper reference management and improved hibernation restore performance.
CVE-2026-98691 is a vulnerability in the Linux kernel's Thunderbolt driver where inactive DisplayPort (DP) tunnels are not properly torn down when the domain is stopped. This causes queued work related to DP tunnels to run against a domain that has already been torn down, potentially leading to blocking behavior until a timeout occurs. The fix ensures that inactive DP tunnels are also torn down, canceling the queued work without affecting active display tunnels.
A domain reference leak vulnerability in the Linux kernel's Thunderbolt driver was fixed. The issue occurs when a DisplayPort (DP) tunnel read operation is canceled, causing a domain reference to be leaked and potentially blocking driver unbinding indefinitely. The fix ensures proper reference management by pairing get/put calls within the same file, preventing leaks and blocking.
CVE-2026-98689 is a high-severity vulnerability in the Linux kernel's Thunderbolt driver related to DisplayPort (DP) tunnel handling. The flaw occurs when the kernel accesses a DP tunnel after its DPRX read operation has been canceled, leading to potential use of torn-down resources during system suspend or domain shutdown. This happens due to improper synchronization and flag checking around the cancellation and stopping of DPRX reads. The issue affects specific Linux kernel versions used in various Ubuntu LTS releases.
A vulnerability in the Linux kernel's thunderbolt driver allows a malicious peer to cause a heap out-of-bounds read by sending an oversized XDomain properties response. The flaw arises because the driver allocates a fixed-size buffer but trusts a length field that can specify a larger size, leading to reading beyond the allocated buffer.