CVE-2026-98602 is a low-severity vulnerability in the Linux kernel's Bluetooth BNEP (Bluetooth Network Encapsulation Protocol) implementation. It involves multiple out-of-bounds read flaws in the processing of short RX/TX frames and control frames. These flaws could lead to information leaks due to improper validation of frame lengths before accessing data. The issue affects specific Linux kernel versions and has been addressed by adding proper length checks and control flow fixes.
A vulnerability in the Linux kernel Bluetooth driver btintel_pcie allows a malicious or malfunctioning PCIe device to supply out-of-range DMA indices. This can cause out-of-bounds memory access and potentially lead to driver instability or denial of service. The flaw arises from lack of bounds checking on device-controlled indices used as array indexes. The issue affects specific Linux kernel versions and has been addressed by adding validation and error logging.
CVE-2026-98599 is a high-severity vulnerability in the Linux kernel's BPF subsystem where non-negative offsets are not properly rejected in the stack_slot_obj_get_spi() function. This flaw allows a pointer to the stack frame pointer plus zero offset (fp+0) to be incorrectly validated against a stack slot at a negative offset (fp-8), potentially enabling a kernel function to read memory outside the intended BPF stack region. The issue arises from incorrect handling of offset calculations leading to unsafe memory access.
A vulnerability in the Linux kernel's IPv6 implementation allows a reference cycle and resource leak when handling dying fib6_info structures. This occurs because a flag preventing new exceptions from being inserted is not properly set during removal, causing stalled network device unregistration.
A vulnerability in the Linux kernel's USB network driver for the sr9700 device involves improper length checking of received packets. The flaw arises because the receive fixup subtracts the Ethernet CRC from the packet length but compares the payload length against the entire remaining receive buffer, potentially causing incorrect memory handling. This issue was identified by static analysis and has been resolved.
A vulnerability in the Linux kernel IPv6 implementation causes a memory leak of destination cache entries (dst) for uncached routes when devices are unregistered. This occurs due to a race condition in handling the uncached route list, leading to improper reference counting and resource leaks. The issue affects specific Linux kernel versions and has been assigned a medium severity score.
A vulnerability in the Linux kernel's UDP socket handling causes a disconnected UDP socket to remain in the 4-tuple hash table. This stale entry leads to continued processing of packets through the 4-tuple lookup, potentially causing resource inefficiencies and unexpected behavior. The issue affects both IPv4 and IPv6 sockets and was fixed by removing the socket entry from the hash table before disconnection completes.
CVE-2026-98594 is a low severity vulnerability in the Linux kernel's tg3 driver where PHYLIB resources are not properly cleaned up on probe failure. This can lead to resource leaks due to incomplete teardown of MDIO bus and PHY connections when tg3_init_one() fails. The issue was found during static analysis and fixed by ensuring proper disconnection and unregistration of PHYLIB resources in error paths.
A NULL pointer dereference vulnerability in the Linux kernel's s390/debug subsystem was fixed in debug_info_copy(). The flaw occurs when debug_register_static() fails and clears certain data structures but leaves area bounds unchanged, leading to dereferencing NULL pointers during copy operations. This issue affects specific Linux kernel versions and has been resolved by skipping the copy loop when no valid areas exist.
CVE-2026-98592 is a medium-severity vulnerability in the Linux kernel's spacemit network driver. It involves improper clearing of the TX descriptor on fragment mapping failure during packet transmission. This can lead to stale DMA addresses being used, potentially causing memory corruption or data integrity issues.
A vulnerability in the Linux kernel's BPF subsystem related to skb-backed dynamic pointers has been fixed. The issue involves an underflow in a bounds check within the skb_pointer_if_linear() function, which can cause invalid memory pointers to be returned. This flaw affects certain Linux kernel versions and has a high severity rating with a CVSS score of 8.4.
A vulnerability in the Linux kernel's BPF subsystem related to bpf_sock context code generation has been fixed. The issue involved incorrect handling of the rx_queue_mapping field size during context access, causing the verifier's assumptions about register values to be violated. This could lead to runtime values exceeding expected limits due to sign-extension of a special value. The fix ensures correct instruction usage and proper size reporting for the bpf_sock field.
CVE-2026-98589 is a vulnerability in the Linux kernel's BPF subsystem related to how packet (PTR_TO_PACKET) pointers are handled in mutating subprograms. The verifier did not properly reject BPF code passing PTR_TO_PACKET pointers to subprograms that may mutate packets, potentially leading to incorrect memory assumptions. This flaw has been resolved by enforcing rejection of such code unless the subprogram is guaranteed not to mutate the packet.
A vulnerability in the Linux kernel's BPF sockmap implementation allows creation of sockmaps with max_entries values exceeding INT_MAX, leading to out-of-bounds memory access during sockmap free operations. This can cause memory corruption or kernel crashes. The issue arises because sock_map_alloc() does not properly reject max_entries values greater than INT_MAX, causing a signed integer overflow in sock_map_free().
A race condition vulnerability in the Linux kernel SCTP implementation allows a reference count underflow due to improper ordering of timer rearming and reference holding in timer handlers. This can lead to use-after-free conditions when the timer's reference is taken after the timer is deleted, causing potential memory corruption.
CVE-2026-98585 is a vulnerability in the Linux kernel's fbnic Ethernet driver related to handling zero ring sizes. The issue arises because the rounding function roundup_pow_of_two() is undefined for zero, and ethtool allows a zero ring size to reach the driver. The fix ensures zero ring sizes are left unchanged so that the minimum-size check can deterministically reject zero values, preventing undefined behavior.
A potential stack information leak vulnerability was identified and fixed in the Linux kernel's net/sched subsystem in the em_text_dump() function. The issue arose because a struct allocated on the stack was not fully zero-initialized before being copied to a netlink response, potentially leaking uninitialized stack memory. The vulnerability was detected by Kernel Memory Sanitizer (KMSAN) in Linux kernel 7.2-rc6. The root cause was the replacement of strncpy() with strscpy(), which does not zero-pad the destination buffer, leaving some bytes uninitialized. The fix involves zero-initializing the struct to prevent leakage.
A vulnerability in the Linux kernel NFC driver (nfcmrvl) allows improper validation of helper command length before processing. This flaw occurs because the firmware download receive path removes the NCI data header and reads the helper command before verifying the remaining packet length, potentially allowing malformed short frames to be accessed before rejection. The issue has been resolved by validating the complete helper command length prior to stripping the NCI data header.
A vulnerability in the Linux kernel NFC driver for ST21NFCA devices allows malformed frames to bypass proper size validation, potentially causing out-of-bounds reads during frame processing. The issue arises from improper handling of frame truncation and byte unstuffing, which can lead to reading beyond the buffer boundary. This flaw has been addressed by enforcing minimum frame size checks before and after unstuffing and improving the byte-stuffing removal logic.
A vulnerability in the Linux kernel NFC subsystem's LLCP protocol handling can cause list corruption and reference count desynchronization in the nfc_llcp_recv_dm() function. This occurs when a socket is left linked on the connecting_sockets list but marked closed without proper locking and unlinking, leading to concurrent list mutations and memory leaks. An unprivileged local process can exploit this to exhaust kernel memory, causing a denial of service.