CVE-2026-99184 is a vulnerability in the Linux kernel's accel/rocket driver where improper handling of core removal leads to an out-of-bounds write. The issue arises because the code does not search all core slots when a core is removed, causing stale references and array overruns. This can result in silent memory corruption during core unbinding and rebinding operations. The flaw was found on RK3588 devices and Orange Pi 5 Plus during testing. A fix involves recording the number of allocated slots and searching all of them to ensure proper teardown and rebinding of cores.
CVE-2026-99183 is a vulnerability in the Linux kernel's accel/rocket scheduler where the function sched_to_core() fails to search all core slots when looking up a scheduler. This can lead to NULL pointer dereferences when unbinding a core that is not the last one, causing faults in job execution and reset work. The issue arises because cores behind the unbound core fall outside the search range, resulting in sched_to_core() returning NULL for cores still bound and running jobs. This causes kernel faults such as null-pointer dereferences in workqueues related to the rocket scheduler. The vulnerability has been resolved by modifying the search to cover all allocated slots. However, unbinding a core while clients remain open can still cause scheduler issues, which require further consideration.
A vulnerability in the Linux kernel's ASoC SOF ipc4-topology component caused a shift-out-of-bounds error when handling aggregated ALH capture streams with fewer channels than devices. This occurs due to an underflow in a shift operation leading to an out-of-bounds shift exponent. The issue is fixed by treating cases where channel count is less than device count similarly to existing cases, applying the same channel mask to every aggregated device.
CVE-2026-99180 is a use-after-free vulnerability in the Linux kernel's unicode handling code affecting filesystems such as ext4, f2fs, and tmpfs. The issue arises because the unicode map is freed immediately after the last reference to a mount goes away, but ongoing pathwalks in RCU mode may still access the freed map, leading to a kernel memory corruption detected by KASAN. The vulnerability is reachable when a mount's last reference is dropped outside of umount(2), such as closing a file or changing directories out of a lazily unmounted directory. The fix delays freeing the unicode map until after a grace period to ensure no pathwalks access freed memory.
A race condition in the Linux kernel's watch_queue_set_size() function can lead to a NULL pointer dereference and kernel panic. This occurs because of unsynchronized publication of note pool data, allowing an unprivileged user to trigger a kernel crash by racing certain key management operations. The issue is fixed by enforcing proper memory ordering when publishing the number of notes.
A vulnerability in the Linux kernel's KVM SEV implementation related to improper page dirtying in the sev_gmem_post_populate() function has been fixed. The issue involved the use of set_page_dirty() without holding the required lock, which could lead to concurrency problems when marking pages dirty. The fix replaces this with set_page_dirty_lock() to ensure proper locking. This affects multiple specific Linux kernel versions used in Ubuntu distributions.
A vulnerability in the Linux kernel's KVM nVMX component causes a NULL pointer dereference when the MMU pointer is not reset to the root MMU after a failure loading L2 state in non-VM-Entry cases. This can lead to kernel crashes due to improper handling of nested virtualization state.
CVE-2026-99175 is a vulnerability in the Linux kernel's fsnotify subsystem where marks could be added during connector teardown, leading to a race condition. This flaw could cause a null pointer dereference (KASAN BUG) during an unprivileged file descriptor info read operation, potentially destabilizing the kernel. The issue arises because the walk cursor used during mark destruction does not prevent new marks from being inserted, which can cause the connector to detach improperly. The vulnerability has been resolved by introducing a DESTROYING flag to prevent new marks during teardown and adjusting locking to avoid races.
A use-after-free vulnerability in the ext4 filesystem implementation of the Linux kernel allows a race condition where ext4_put_super() frees internal structures without waiting for a grace period. This can lead to a null pointer dereference during pathwalk operations that follow symlinks, potentially causing kernel crashes. The issue arises when the last reference to a mount goes away concurrently with an ext4_get_link() pathwalk. The vulnerability has been resolved by deferring the freeing of the superblock info and associated counters until after a grace period.
CVE-2026-99173 is a use-after-free vulnerability in the Linux kernel's eventfs subsystem. The flaw occurs because the eventfs_inode is freed after an SRCU grace period that does not wait for RCU read-side critical sections, allowing a pathwalk operation to access a freed eventfs_inode. This leads to a kernel slab-use-after-free bug detected by KASAN during tracefs_d_revalidate().
A vulnerability in the Linux kernel's IPC subsystem causes a resource leak when the mqueue mount is not properly dropped on setup failure. Specifically, the mqueue mount created during namespace initialization is leaked if subsequent sysctl setup fails, due to improper unmount handling. This issue has been resolved by using kern_unmount() to correctly drop the mount on failure.
A use-after-free vulnerability exists in the Linux kernel's ntfs3 filesystem driver related to freeing the superblock private information without proper RCU delay. This can cause a kernel slab-use-after-free error during path lookups when the last reference to the mount is dropped. The issue is mitigated by introducing an RCU callback to delay freeing and switching locking mechanisms to prevent deadlocks.
CVE-2026-99170 is a vulnerability in the Linux kernel's namespace handling where a mount that copy_tree() omits can take over a lock improperly. This allows a root user in their own user namespace to remove a locked mount cover on a file without a race condition or modifying the underlying filesystem. The flaw involves the handling of mount namespace files during unshare(CLONE_NEWNS) and mount propagation, which can lead to a mount that cannot be unmounted and causes unshare() to fail subsequently. The issue was addressed by ensuring that locked mounts of mount namespace files cannot be left out during copy_tree() and by refusing to move such mounts beneath locked mounts. This prevents tasks from ending up with mounts they cannot unmount and unshare failures. The vulnerability affects specific Linux kernel versions including various 4.15.x, 5.0.x, and 5.3.x builds.
A vulnerability in the Linux kernel's futex subsystem related to the handling of FUT_OFF_MMSHARED futexes has been fixed. The flaw allowed processes to wait on shared futexes tied to a freed memory management structure (MM), potentially causing wakeups intended for a new MM to be consumed incorrectly. The fix involves using a unique 64-bit per-MM ID to key FUT_OFF_MMSHARED futexes, preventing cross-MM wakeup consumption.
A vulnerability in the Linux kernel's mshv_vtl component occurs due to improper checking of per-CPU register pages before memory mapping. If a CPU's register page is not allocated or registered properly, the system may attempt to access a NULL page, causing a fault. This issue affects multiple specific Linux kernel versions.
A use-after-free vulnerability in the Linux kernel's net/sched subsystem was fixed in the __tcf_action_put() function. The flaw involves decrementing the reference count before the binding count, allowing another thread to free the action and causing subsequent access to freed memory. This was detected by KASAN as a slab-use-after-free error. The fix involves holding the action IDR mutex across both counter updates and IDR removal to prevent premature freeing.
A vulnerability in the Linux kernel's RDS subsystem causes a kernel crash due to an uninitialized pointer dereference in the RDMA CM event handler when handling connection requests on non-InfiniBand devices such as iWARP RNICs. The flaw arises because the transport pointer is only initialized for InfiniBand devices, leading to a null dereference and kernel oops on other device types. The fix initializes the transport pointer explicitly and rejects connection requests on non-InfiniBand devices to prevent crashes.
A vulnerability in the Linux kernel SCTP implementation allows a NULL pointer dereference in the sctp_outq_tail function when message interleaving is enabled. This occurs due to improper revalidation of output streams after association connect wait, potentially causing a kernel panic.
A vulnerability in the Linux kernel spi: imx driver causes slab corruption due to undersized DMA bounce buffers. The driver allocated DMA buffers smaller than the size used for DMA operations, leading to memory corruption and kernel crashes under heavy load on certain hardware platforms. This issue has been fixed by aligning buffer allocation size with the DMA mapping size.
A vulnerability in the Linux kernel tracing/histograms subsystem allows improper handling of synthetic stacktrace fields. Specifically, non-stacktrace fields can be incorrectly accepted as stacktrace fields, leading to dereferencing of scalar values as kernel stacktrace pointers. This occurs due to insufficient validation in check_synth_field() and improper type checks in create_hist_field().