A race condition vulnerability in the NFC LLCP socket accept queue lifecycle in the Linux kernel was fixed. The flaw allowed concurrent unlinking and releasing of the same child socket, causing use-after-free or NULL pointer dereference. The fix involved changing socket locking mechanisms and deferring resource release to avoid sleeping in atomic context.
A memory leak vulnerability was fixed in the Linux kernel's NFC LLCP implementation. The issue involved failure paths in the nfc_genl_llc_sdreq() function where allocated TLV nodes were not freed properly on parse, allocation, or send failures, potentially causing resource leaks.
A low severity vulnerability in the Linux kernel's NFC subsystem (st21nfca driver) involves improper validation of the ISO15693 inventory length. The vulnerability occurs because the code removes a two-byte prefix without verifying its presence and accepts a one-byte remainder before reading data as the DSFID. This could lead to incorrect processing of NFC data. The issue has been resolved by requiring the prefix and at least two remaining bytes before copying UID data and reading the DSFID.
A vulnerability in the Linux kernel's NFC LLCP implementation allowed a WKS SAP hijacking due to improper prefix matching in the nfc_llcp_wks_sap() function. The function compared only the length of the service name, causing short names to match longer ones incorrectly. This was fixed by requiring an exact length match before string comparison.
A slab-out-of-bounds read vulnerability was fixed in the Linux kernel's NFC LLCP component. The issue occurred because non-null-terminated strings were passed to debug logging functions using %s format specifiers, causing reads beyond allocated buffers. The fix involved using length-limited string output to prevent out-of-bounds reads.
A vulnerability in the Linux kernel NFC driver for pn533 (CVE-2026-98575) allows an out-of-bounds (OOB) read due to improper validation of the datalen field in the pn533_acr122_is_rx_frame_valid() function. This occurs because the datalen value is used unchecked as an index into a data buffer, potentially causing the driver to read beyond the buffer limits. The issue is fixed by bounding datalen against the maximum ACR122 frame size and improving validation checks.
A use-after-free vulnerability in the Linux kernel's bcmgenet network driver occurs because Tx NAPI is stopped after disabling the transmit queues, allowing a transmit to reach freed rings. This flaw affects specific Linux kernel versions and was detected via KASAN on a Raspberry Pi CM4. The issue is resolved by stopping Tx NAPI before disabling the queues in both bcmgenet_netif_stop() and bcmgenet_suspend() paths.
A vulnerability in the Linux kernel's IPv6 packet processing code allows an integer underflow in skb_checksum_setup_ipv6() due to improper bounds checking. This flaw can cause a negative length to be passed to skb_copy_bits(), potentially leading to an out-of-bounds memory copy. The issue occurs when parsing IPv6 extension headers if the skb linear area is larger than MAX_IPV6_HDR_LEN. The vulnerability has been fixed by correcting the pull-bound calculation to prevent negative deltas.
A vulnerability in the Linux kernel's BPF implementation on MIPS32 architectures was fixed. The issue involved an incorrect instruction emitted for immediate JMP JEQ/JNE operations, causing invalid comparison results when the immediate operand was negative. This flaw affected constant blinding by misinterpreting the immediate value as a register. The problem was identified using test_bpf on MIPS32r1 emulated by QEMU and has been resolved.
A critical vulnerability in the Linux kernel's stmmac network driver involves improper handling of buffer pages after a socket buffer (skb) build failure. Specifically, when napi_build_skb() fails in stmmac_rx(), the buffer page pointer (buf->page) is not cleared after recycling the page, leading to reuse of a stale pointer. This inconsistency can cause the recycled page to be reprogrammed into the RX descriptor, potentially leading to memory corruption or instability.
A vulnerability in the Linux kernel's IPv6 networking code causes improper handling of MAC header space in the dst_dev_overhead() function. This leads to a negative offset calculation and out-of-bounds memory write when processing packets through VLAN devices with reorder_hdr off. The issue affects certain kernel versions and can be triggered by forwarding IPv6 ping traffic through affected devices.
A vulnerability in the Linux kernel's ip_gre component allows enabling metadata collection through the changelink interface, which does not enforce metadata tunnel uniqueness. This can cause metadata receive entries to be replaced or cleared improperly, breaking metadata lookup for surviving devices. The issue has been resolved by rejecting metadata mode enablement in changelink callbacks before modifying tunnel parameters.
A time-of-check to time-of-use (TOCTOU) race condition exists in the Linux kernel's vxlan module when generating neighbour replies. The function vxlan_na_create() samples headroom size twice, allowing a concurrent vxlan_changelink() to update the needed headroom between reads, potentially causing an out-of-bounds write in the Ethernet header. This vulnerability has been confirmed by KASAN detection and affects specific Linux kernel versions.
CVE-2026-98567 is a vulnerability in the Linux kernel's network subsystem related to the handling of traffic classes in the transmit queue mapping. The flaw occurs when the kernel does not properly reject traffic classes that are out of range, leading to an out-of-bounds write in the XPS (Transmit Packet Steering) map. This can cause memory corruption and kernel crashes when the number of traffic classes is lowered without properly clearing related arrays.
A vulnerability in the Linux kernel's drm/imagination component involves improper bounds checking on freelist reconstruction requests. The firmware reconstruction count was not clamped to the request capacity, potentially leading to out-of-bounds accesses. The issue has been resolved by clamping the count to the request capacity and maintaining the firmware recovery exchange for oversized requests.
A NULL pointer dereference vulnerability was fixed in the Linux kernel's DSA mt7530 driver affecting MT7531 and MT7621 devices. The issue occurs because regulator_disable() is called unconditionally on potentially NULL pointers during device unbinding, which can lead to a kernel crash.
A vulnerability in the Linux kernel's mt7530 driver related to MDIO IRQ mappings has been resolved. The issue involved improper handling of interrupt mappings during device removal, which could lead to the kernel dispatching interrupts on already freed mappings. However, the late dispatch is harmless as the PHY handlers are freed by that time, preventing any action. The vulnerability affects specific Linux kernel versions used in various Ubuntu releases.
A vulnerability in the Linux kernel's phylink component could cause a stale pointer to a freed PHY device to persist after a failed PHY bringup. This occurs because the PHY pointer is recorded before the last fallible step in the bringup process, leading to potential use-after-free scenarios when errors occur. The issue affects certain Linux kernel versions and has been resolved by changing the order of pointer assignment to ensure the PHY is recorded only after the bringup cannot fail.
A race condition vulnerability in the Linux kernel's net: libwx Tx timestamp handling has been fixed. The issue involves improper synchronization between the Tx path, PTP auxiliary worker, and timestamp cleanup paths, potentially causing use-after-free and reference leaks of skb structures. The fix introduces a dedicated spinlock to serialize access and prevent these race conditions.
A use-after-free vulnerability in the Linux kernel's nfp driver related to IPsec RX state handling has been resolved. The issue occurs because the driver releases the XArray lock before safely acquiring a reference to the xfrm_state, allowing the state to be deleted and leading to a potential reference count increment on a freed object. This can cause instability or crashes in affected kernel versions.