A vulnerability in the Linux kernel's BPF implementation on MIPS32 architectures was fixed. The issue involved an incorrect instruction emitted for immediate JMP JEQ/JNE operations, causing invalid comparison results when the immediate operand was negative. This flaw affected constant blinding by misinterpreting the immediate value as a register. The problem was identified using test_bpf on MIPS32r1 emulated by QEMU and has been resolved.
CVE-2026-98488 is a vulnerability in the Linux kernel's atl1e network driver that causes a soft lockup due to an out-of-range read of hw_next_to_clean. This occurs when the hardware reports an invalid value (0xffff) during PCIe link or MAC reset, causing an infinite loop in the driver. The issue is similar to a previous atl1c driver vulnerability and has been fixed by treating the out-of-range value as no new data to clean.
A vulnerability in the Linux kernel's net/packet subsystem could cause a TX_RING byte count overflow. This occurs when the tpacket_snd() function accumulates packet lengths in a signed integer, which can wrap into a negative value after many transmissions. This triggers a BUG in sock_sendmsg_nosec(), potentially causing a kernel panic on systems configured to panic on oops. The issue is fixed by preventing the byte count from exceeding INT_MAX, leaving frames pending for later transmission.
A vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem allows oversized fragmented frames to cause an overflow in a 16-bit length field, leading to a kernel crash. The issue arises because the sum of fragment lengths can exceed the maximum value of a 16-bit unsigned integer, causing an integer overflow and buffer overflow during packet reassembly. This flaw has been fixed by dropping oversized fragments to prevent the overflow.
A vulnerability in the Linux kernel's rtc: mpfs driver was fixed by adding proper error checking for the devm_clk_get() function's return value. Previously, an error pointer returned by devm_clk_get() was passed unchecked into clk_get_rate(), which only guards against NULL pointers, leading to a potential kernel crash during device probe. The fix ensures that the error pointer is checked with IS_ERR() before use, preventing crashes caused by dereferencing error pointers.
A vulnerability in the Linux kernel Bluetooth subsystem (btintel) related to improper validation of DDC record lengths has been resolved. The flaw involved incorrect parsing of DDC record lengths, allowing values like 0xFF to wrap improperly. The fix ensures that records smaller than the mandatory three-byte header, records exceeding the maximum unsigned 8-bit value, and records exceeding remaining firmware bytes are rejected before processing. This prevents potential issues during Intel_Write_DDC operations.
A vulnerability in the Linux kernel related to the SO_RESERVE_MEM socket option has been resolved. The issue involved improper handling of SO_RESERVE_MEM on UDP sockets, which are only supported for TCP sockets. This could lead to memory accounting corruption due to concurrent access and lack of proper locking. Additionally, there was no upper bound on the SO_RESERVE_MEM value, allowing values near INT_MAX to cause integer overflows and memory corruption. The fix restricts SO_RESERVE_MEM usage to TCP sockets and caps the maximum value to 1GB.
A vulnerability in the Linux kernel's drm/mediatek component involves a missing IS_ERR check for the ovl_adaptor platform device. The function platform_device_register_data() can fail and return an error pointer, but this return value was not checked, leading to an invalid pointer being stored and passed to other kernel functions. This flaw could cause a kernel crash. The issue has been fixed by adding the missing IS_ERR() check to handle errors properly.
A vulnerability in the Linux kernel Bluetooth subsystem (btintel_pcie) was fixed to address a plen overflow in the btintel_pcie_recv_frame() function. The issue involved a 16-bit plen value that could wrap around when adding header size and data length, allowing packet truncation checks to be bypassed. The fix involved widening plen to 32 bits to prevent overflow.
A vulnerability in the Linux kernel's mac80211 minstrel_ht rate control module allows out-of-bounds memory access via the fixed_rate_idx debugfs file. This file accepts any 32-bit value, which can lead to invalid indexing and kernel memory corruption. The debugfs interface is root-only, so this is not a privilege escalation issue but remains a critical kernel bug.
A vulnerability in the Linux kernel's iio pressure driver for rohm-bm1390 causes the data reading function to ignore cached error values and always return 0, even when a read operation fails. This issue has been fixed by modifying the function to return the cached error value after stopping the measurement, allowing users to detect read failures and avoid using invalid data.
A vulnerability in the Linux kernel's AW96103 proximity sensor driver allows improper validation of firmware data length. The firmware parser reads a length field from the binary header and uses it to process register/value entries. A truncated or malformed firmware image can cause the parser to read beyond the allocated buffer or interpret an underflowed length as a very large value, potentially leading to memory corruption.
A vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation related to uninitialized values in the mptcp_write_data_fin function has been resolved. The issue occurs when sending a DATA_FIN without data, where certain checksum fields were not properly initialized due to changes in packet processing code. This could lead to incorrect packet formation.
Schroedinger libschroedinger versions up to 1.0.11 contain a divide by zero vulnerability. This flaw allows attackers to cause a denial of service by crashing applications when a zero value is supplied for slice_bytes_denom or slice count in a Dirac stream. The vulnerability triggers a SIGFPE signal during parsing of crafted low-delay pictures.
CVE-2026-98547 is a vulnerability in the Linux kernel's af_packet subsystem where an integer overflow occurs in the function prb_calc_retire_blk_tmo(). This overflow leads to a negative timeout value being used for a high-resolution timer, causing the timer to fire at maximum rate indefinitely. This results in a CPU spinning in softirq context, holding a lock and potentially causing a denial of service. The issue arises from 32-bit integer arithmetic overflow when calculating block size timeouts with user-controlled parameters. The vulnerability has been fixed by changing the calculation to use 64-bit arithmetic.
A vulnerability in the Linux kernel's atl1 network driver caused a soft lockup due to an out-of-range read of cmb_tpd_next_to_clean during PCIe link or MAC reset. This issue leads to an infinite loop when the hardware reports an invalid value (0xffff). The problem has been fixed by treating the out-of-range value as "nothing new to clean."
A vulnerability in the Linux kernel's atl1c network driver causes a soft lockup due to an out-of-range tpd_cons read during PCIe link or MAC reset. The hardware can report a tpd_cons value of 0xffff, which the driver loop cannot handle, resulting in an infinite spin and CPU lockup. This issue has been reproduced on systems using Qualcomm Atheros AR8151 v2.0 NICs and triggers a transmit queue timeout and soft lockup watchdog alerts.