CVE-2026-98644 is a medium severity vulnerability in the Linux kernel's BPF subsystem that causes a soft lockup during batch lookup and delete operations on hash tables. The issue arises because the function __htab_map_lookup_and_delete_batch() lacks rescheduling points, leading to long CPU holds especially on large maps and non-preemptive kernels. This can cause the kernel's soft lockup watchdog to trigger, impacting system responsiveness. The flaw has been fixed by adding rescheduling points to break up long processing loops and allow the kernel to yield CPU time appropriately.
CVE-2026-98643 is a medium-severity vulnerability in the Linux kernel's BPF sock_ops program. It involves an out-of-bounds read of the rtt_min field in sock_ops due to improper type checking of the socket structure. This flaw allows reading adjacent kernel memory, potentially leaking kernel pointers. The issue arises because the code reads rtt_min directly without verifying that the socket is a fully locked tcp_sock, unlike other tcp_sock fields that use a guarded accessor. The vulnerability has been fixed by adding the appropriate guard check when reading rtt_min.
A use-after-free (UAF) vulnerability was identified and fixed in the Linux kernel's BPF subsystem related to concurrent consumption of ttrace lists in the alloc_bulk function. The flaw arises from a race condition where synchronization is missing between __free_rcu() callbacks and concurrent alloc_bulk() operations on waiting_for_gp_ttrace and free_by_rcu_ttrace lists. This can lead to memory being accessed after it has been freed, causing potential kernel crashes or memory corruption. The issue was resolved by introducing a raw spinlock to synchronize these concurrent operations.
CVE-2026-98641 is a vulnerability in the Linux kernel's BPF implementation on arm64 architectures. It involves improper setup of the frame pointer for the exception callback, which can cause stack pointer mismanagement. This flaw allows a helper function to write over its own return address, potentially leading to kernel panic or other memory corruption issues. The issue arises because the frame pointer register (x25) is not correctly set during exception callbacks, resulting in invalid stack frame references.
A vulnerability in the Linux kernel's amd_sfh driver allows out-of-bounds memory access due to improper validation of PCI BAR 2 size before mapping. This can cause a page fault during device probe if the BAR size is smaller than expected. The issue has been fixed by ensuring the BAR size is at least 128KB before mapping.
A vulnerability in the Linux kernel's KVM implementation for RISC-V was fixed by correcting the update order of nested HFENCE entries. The issue involved writing the Config word before updating Page_Number and Page_Count, which could cause incorrect TLB flush ranges due to stale values being observed by the SBI or NACL hardware. The fix ensures the parameter words are written first and the Config word last, using memory barriers to prevent reordering.
A vulnerability in the Linux kernel's KVM arm64 implementation involves improper validation of the Scalable Vector Extension (SVE) vector length in the pkvm_vcpu_init_sve() function. The function only clamps the upper bound of the host-provided vector length, allowing an invalid length to reach a fatal WARN_ON() condition at EL2. The fix involves validating the vector length before deriving the state size to prevent this fatal error.
A vulnerability in the Linux kernel KVM arm64 implementation involves improper handling of the Scalable Vector Extension (SVE) feature flag during vCPU initialization failure. Specifically, when pkvm_vcpu_init_sve() fails, it clears the KVM_ARM_VCPU_SVE flag but leaves KVM_ARCH_FLAG_GUEST_HAS_SVE set, causing subsequent vCPUs to skip proper SVE setup and register with a NULL sve_state. This can lead to errors when the guest performs its first floating-point access.
A vulnerability in the Linux kernel's SquashFS implementation allows a shift-out-of-bounds error when mounting an abnormal SquashFS image with a COMP_OPTS flag set to 1 but a dictionary size of 0. This occurs because the code performs a shift operation with an exponent of -1, which is invalid. The issue has been fixed by adding a dictionary size range check before the shift operation.
A vulnerability in the Linux kernel's SCSI block subsystem allows an out-of-bounds write in the zone report handling code. This occurs because the zones_cond array is sized based on disk capacity and zone size, but the index used to write into this array is not properly checked against its size. Disks reporting more zones than the array can hold, especially those exceeding 32-bit zone counts, can cause memory corruption. The issue is fixed by validating the index before writing and refusing to revalidate if the zone count exceeds 32 bits.
A vulnerability in the Linux kernel's SCSI zoned block device (sd_zbc) handling allows disks reporting an excessively high number of zones to cause inconsistent zone bookkeeping. This occurs because the kernel truncates the 64-bit zone count to a 32-bit unsigned int, and uses a signed int for indexing, which can overflow. The kernel now rejects devices reporting more zones than the maximum signed int value at scan time.
A vulnerability in the Linux kernel Bluetooth driver btnxpuart causes a socket buffer (skb) memory leak when CONFIG_DEV_COREDUMP is disabled. This occurs because hci_devcd_append() returns an error without freeing the skb, preventing recovery functions from executing. The issue has been fixed by conditioning the call to hci_devcd_append() on the CONFIG_DEV_COREDUMP setting.
CVE-2026-98632 is a use-after-free vulnerability in the Bluetooth mesh management code of the Linux kernel. It occurs when a mesh transmission is canceled but a queued entry still holds a pointer to the freed transmission object, leading to unsafe memory access. This flaw has been fixed by properly dequeuing pending entries before freeing them and ensuring the transmission queue advances correctly after cancellation or errors.
CVE-2026-98631 is a vulnerability in the Linux kernel's xsk_map_gen_lookup function where a 32-bit compare was not properly used, leading to an out-of-range index that can cause a read past the bounds of the xsk_map array. This occurs because BPF_JMP_IMM sign-extends immediates to 64 bits, causing incorrect bounds checking for large max_entries values. The issue has been resolved by switching to a 32-bit unsigned comparison using BPF_JMP32_IMM.
A vulnerability in the Linux kernel's fbnic Ethernet driver was fixed to correct improper cleanup of the payload page pool on allocation failure. The issue involved passing an error pointer to page_pool_destroy() instead of properly destroying the header page pool, potentially causing a dereference of an error pointer and leaving resources allocated.
CVE-2026-98629 is a vulnerability in the Linux kernel's net/sched cls_u32 subsystem where manual hash tables created with explicit handles can cause IDR aliasing. This leads to unreachable IDR entries on deletion, causing permanent resource leaks and potential misrouting of lookups to incorrect tables. The issue arises because manual tables key their IDR entries differently from the destroy paths, causing conflicts in handle management. The vulnerability has been fixed by aligning allocation and removal key domains and rejecting manual handles that alias existing IDs.
CVE-2026-98628 is a Linux kernel vulnerability affecting the BPF verifier's post-verification instruction rewrite process. The issue causes the verifier to perform quadratic-time work when removing certain instructions, which cannot be interrupted by signals like SIGKILL. This results in a privileged loader process being unkillable during this phase. The fix makes these rewrite operations preemptible and cancelable, allowing prompt termination of the loader process.
A high-severity vulnerability in the Linux kernel's BPF CO-RE relocation handling allows malformed metadata to poison instructions beyond intended relocatable instructions. This flaw could enable manipulation of critical instructions such as jumps, calls, and exits before proper validation. The issue has been addressed by restricting poisoning to only valid relocatable instructions and enhancing validation checks.
CVE-2026-98625 is a use-after-free vulnerability in the Linux kernel's netfilter flowtable subsystem. It occurs because the HW_DEAD flag is published before the worker clears the HW_PENDING flag, allowing concurrent garbage collection to free a flow object prematurely. This flaw has been resolved by reordering the flag updates to ensure safe object lifecycle management.
CVE-2026-98624 is a high-severity vulnerability in the Linux kernel's netfilter nfnetlink_queue component. It involves improper synchronization of the nfnl mutex in the event notifier, which can lead to a general protection fault due to concurrent operations on socket processes. The flaw allows parallel UNBIND and URELEASE events that cause a crash. The issue has been resolved by serializing the release notifier and the config netlink function to prevent concurrent access.