A use-after-loop vulnerability in the Linux kernel's drm/nouveau/clk component was fixed. The issue occurs in the nvkm_clk_ustate_update function where a list cursor is used after the loop if no matching entry is found, leading to an out-of-bounds read. This can be triggered from userspace by requesting an invalid pstate id via the 'pstate' debugfs file. The fix introduces a 'found' variable to ensure proper validation of the pstate pointer.
CVE-2026-98622 is a vulnerability in the Linux kernel's net/sched subsystem where a WARN is triggered on benign failures of flow_offload_alloc(), which occur during normal operation under load. This WARN can cause a kernel panic if panic_on_warn=1 is set, allowing an unprivileged user to crash the system by racing conntrack flushes against a traffic control classifier using the ct commit action. The issue has been fixed by removing the unnecessary WARN without changing behavior.
CVE-2026-98621 is a critical vulnerability in the Linux kernel's Generic UDP Encapsulation (GUE) implementation. It involves improper handling of REMCSUM option offsets, which can cause an underflow leading to out-of-bounds memory writes. This flaw allows a forwarded packet with malformed checksum metadata to trigger a write of two bytes approximately 64 KiB beyond the intended buffer boundary.
A vulnerability in the Linux kernel's MediaTek Ethernet driver (mtk_eth_soc) causes improper handling of net_device unregistration during probe failure. Specifically, if register_netdev() fails for one of the devices, the error path skips the unregistration step, leading to freeing net_devices still marked as registered, triggering a kernel bug check.
A vulnerability in the Linux kernel's fbnic driver related to handling maximum standalone channels has been resolved. The issue involves incorrect allocation of NAPI vectors for Tx and Rx queues in a 64-Tx/64-Rx configuration, leading to NULL pointer dereferences during resource setup. This flaw has been fixed by including the maximum vector count in the standalone allocation process.
A vulnerability in the Linux kernel's fbnic network driver involves incorrect use of the Rx queue NAPI pointer to find the NAPI vector. The issue arises when standalone Tx vectors are present, causing the Rx queues to point to Tx NAPI vectors incorrectly. This can lead to improper queue management and potential instability. The fix involves using the correct stored napi pointer from netdev_rx_queue.napi and handling cases where the pointer is NULL to avoid accessing freed resources.
A vulnerability in the Linux kernel's fbnic driver involves improper resetting of the num_napi counter when napi vectors are freed during suspend and resume operations. This can lead to a kernel NULL pointer dereference when the network device is running with num_napi greater than zero but with freed napi vectors. The issue occurs in scenarios such as failed PCIe error recovery or partial failure during resume open, causing a use-after-free condition in fbnic_dbg_down().
A vulnerability in the Linux kernel's fbnic driver related to mailbox flushing has been resolved. The issue involved improper flushing of staged write requests during teardown of the firmware mailbox Rx ring, which could cause the flush operation to never complete. The fix involves setting both AW_FLUSH and AW_FLUSH_MODE bits to ensure staged writes drain correctly without affecting the read path.
CVE-2026-98614 is a vulnerability in the Linux kernel SCTP implementation where the function sctp_assoc_update_retran_path() can enter an infinite loop (livelock) when all remaining transports, including the retransmit path, are in the SCTP_UNCONFIRMED state. This occurs because the state check is performed before the loop wraparound test, preventing the loop from terminating properly. The issue has been fixed by adjusting the logic to consider only confirmed transports for the loop termination check and restoring a NULL guard to prevent invalid retransmit path assignments.
CVE-2026-98613 is a vulnerability in the Linux kernel's BPF subsystem related to unbounded ownership depth through local kernel pointers (kptrs) and graph roots. This flaw allows program-allocated objects to form arbitrarily deep chains via self-referential local kptr types, which can exhaust the kernel stack during object destruction. The vulnerability arises from insufficient checks on ownership depth and cycles in BPF Type Format (BTF) records, potentially leading to kernel stack exhaustion. The issue has been addressed by bounding ownership walks to a maximum depth of eight record-bearing types and updating validation logic accordingly.
A vulnerability in the Linux kernel's USB CATC driver (catc_rx_done function) allows crafted packets to cause out-of-bounds reads. The flaw involves improper bounding of the RX packet length, which can lead to reading past buffer limits and processing invalid Ethernet headers. This issue has been fixed by properly validating packet lengths and rejecting malformed packets.
A vulnerability in the Linux kernel's BPF subsystem allows reading beyond validated buffer boundaries due to improper parameter size checking before accessing reserved fields. This issue was fixed by moving the size check before the reserved field reads to prevent out-of-bounds access.
CVE-2026-98610 is a vulnerability in the Linux kernel's net/sched subsystem affecting the sch_hfsc queuing discipline. The flaw allows a classification walk to enter an infinite loop under certain conditions due to unbounded lateral hops between classes after level adjustments, causing a soft lockup and potential system hang. This can be triggered by unprivileged users with CAP_NET_ADMIN capability. The issue has been addressed by bounding the classify inner-filter walk with a drift budget to prevent infinite loops and dropping packets when the budget is exhausted.
A vulnerability in the Linux kernel's drm/virtio component causes an object reference leak when drm_gem_handle_create() fails. This leak occurs because the error handling path incorrectly calls drm_gem_object_release(), which does not properly decrement the reference count or free the object, leading to resource leaks including shmem pages, scatter-gather tables, and host-side resources. This flaw affects specific linux-aws kernel versions.
A vulnerability in the Linux kernel's drm/virtio component causes an object leak in the virtio_gpu_resource_create_ioctl() function. The issue arises because drm_gem_object_release() is called incorrectly on an error path, preventing the proper freeing of resources and leading to memory leaks of virtio_gpu_object and associated data.
A vulnerability in the Linux kernel's drm/virtio component causes object leaks in the virtio_gpu_resource_create_blob_ioctl() function. The issue arises because drm_gem_object_release() is called incorrectly on error paths, preventing the proper freeing of virtio_gpu_object resources, leading to resource leaks.
A use-after-free vulnerability exists in the Linux kernel's drm/virtio driver due to improper release of GEM objects on errors in virtio_gpu_vram_create(). This causes freed objects to remain referenced in an interval tree, leading to potential memory corruption and resource leaks.
A vulnerability in the Linux kernel's drm/bridge samsung-dsim driver involves incorrect handling of TE GPIO lifetime during host attach and detach operations. The issue arises from improper use of managed and non-managed GPIO descriptor functions, potentially causing resource mismanagement when the DSI host is detached and reattached without device destruction.
A low-severity vulnerability in the Linux kernel's ovpn module involves improper handling of local endpoint updates, which can cause torn reads of IPv6 addresses during concurrent updates. This issue arises because the local endpoint structure is updated in place without proper synchronization, while UDP transmission reads the field without locking. The flaw has been addressed by changing the update mechanism to replace the bind structure when learning a new local endpoint, ensuring safe publication and synchronization.
A vulnerability in the Linux kernel's ovpn module involves improper handling of stale local source addresses during UDP output fallback. The issue arises because the bind structure is modified in place while being concurrently accessed, potentially causing torn IPv6 address reads. The fix replaces in-place modification with a safer approach that retries route lookups and publishes a replacement bind with a wildcard local address to avoid cache inconsistencies. This vulnerability affects specific Linux kernel versions and has been addressed in those releases.