A vulnerability in the Linux kernel's drm/panthor driver was resolved that involved improper validation of the userspace queue count against the number of initialized firmware slots. Unprivileged userspace could request more queues than the firmware had initialized, leading to potential crashes due to dereferencing uninitialized stream interfaces.
A use-after-free vulnerability in the Linux kernel's drm/xe/i2c driver was resolved. The issue occurs because a work item related to the i2c client device can remain queued or running after the adapter is unregistered and its memory freed, leading to dereferencing freed memory. The fix involves reordering the teardown process to unregister the bus notifier before client device teardown and canceling the work to prevent new scheduling and drain queued work items.
A concurrency vulnerability in the Linux kernel Bluetooth ISO socket connect function (iso_sock_connect) has been resolved. The flaw allowed concurrent connect calls to bypass socket state checks, potentially leading to use-after-free conditions due to race conditions in connection setup and teardown. The fix serializes concurrent connect calls by marking the connect operation in progress and rejecting concurrent attempts until completion. This prevents destination overwrites and stranded connection references.
A vulnerability in the Linux kernel's drm/fb-helper component was resolved. The issue involved improper handling of failures in drm_fb_helper_single_fb_probe(), where failures other than -EAGAIN did not mark the fb_helper for deferred setup. This caused stale mode_set configurations to be committed later, triggering warnings. The fix ensures deferred setup is marked on any failure, preventing stale commits until a successful re-probe occurs.
A vulnerability in the Linux kernel's drm/bridge th1520-dw-hdmi driver was fixed by correcting the remove() callback. The driver incorrectly handled a pointer type during teardown, which could cause improper cleanup.
A vulnerability in the Linux kernel's namespace handling was resolved by ensuring the old parent's ->overmount pointer is reset in the mnt_change_mountpoint() function. Previously, this pointer could become a dangling reference after certain mount operations, leading to use-after-free (UAF) conditions. This issue arises when mounts are reparented and the old parent's ->overmount is not cleared, potentially allowing references to freed mount structures.
A use-after-free vulnerability in the Linux kernel's Bluetooth SCO connection handling was resolved. The flaw involved improper synchronization of the sco_conn lifetime against sco_recv_scodata(), leading to potential use of freed memory. The fix ensures proper locking and reference counting to prevent concurrent access to freed objects.
A vulnerability in the Linux kernel's drm/xe component caused incorrect shrinker accounting due to double-subtraction of pages when nested external pins occur on buffer objects. This desynchronization can lead to excessive invocation of the shrinker under memory pressure. The issue was fixed by ensuring accounting updates only occur on the outermost pin and final unpin, and by excluding imported dma-bufs from shrinker accounting to prevent underflows.
A vulnerability in the Linux kernel's namespace handling has been resolved. The issue involves the may_copy_tree() function accepting mounts whose roots are nsfs or pidfs files before verifying if the mount is actually mounted. This allowed recursive copying of unmounted mount trees, which is unintended behavior. The fix prevents walking an unmounted tree during recursive copy operations, causing such attempts to fail with EINVAL. Bind mounting a namespace that is gone remains possible if pinned by a file descriptor.
A use-after-free vulnerability in the Linux kernel Bluetooth subsystem was resolved. The flaw involved improper handling of socket buffer (skb) lifetimes during passive scan setup, leading to potential use of freed memory. The issue was caused by lack of proper locking around command skb references, allowing concurrent workqueues to free and replace command data while still in use.
A vulnerability in the Linux kernel's drm/i915/gem component could cause improper memory cleanup by overstepping the exec array boundary during relocation parsing. This occurs when the function eb_relocate_parse_slow() calls kvfree() on entries beyond the original exec array due to an incremented buffer count that includes appended VMAs. The issue has been resolved by ensuring relocation cleanup uses the original exec object count, excluding appended VMAs.
A race condition vulnerability in the Linux kernel's i915 DRM driver was resolved by ensuring interrupts are only unmasked when the RPS (Render Power State) is active. The flaw involved a timing window where interrupts could be unmasked after the GPU was parked and the runtime power management wakelock was dropped, causing kernel taint due to hardware access without the wakelock held.
A vulnerability in the Linux kernel's openvswitch component caused a soft lockup during netlink flow dumps on production compute nodes with many datapath flows. The issue arises because the softirq backlog refills as fast as it drains, causing the dumping thread to monopolize CPU time without rescheduling, leading to a system hang. The fix involves holding bottom halves off across the entire callback to prevent nested softirq draining, ensuring the CPU can reschedule properly.
A vulnerability in the Linux kernel's skb_copy_and_csum_bits() function could cause stale memory bytes to be sent in network packets. When the function encounters unreadable fragments, it copies only the linear part of the buffer and leaves the rest unchanged, potentially leaking residual memory data in ICMP error messages or driver transmit buffers. The issue has been resolved by zeroing the unfilled parts of the buffer to prevent unintended data leakage.
A vulnerability in the Linux kernel's SCSI changer driver (ch) caused references to data transfer element devices to be retained improperly. This led to scsi_device objects never being released after device removal, preventing the unloading of the low-level driver module and requiring a system reboot to recover. The issue was fixed by dropping the reference immediately after use and removing the unused array that caused the leak.
A vulnerability in the Linux kernel's packet_rcv_spkt() function could cause a kernel panic when processing packets on devices without a visible link layer header, such as CAN interfaces. The issue arises because packet_rcv_spkt() does not guard the link layer header push operation, leading to an invalid length calculation and a panic in skb_push(). This flaw was introduced when other receive paths were updated but packet_rcv_spkt() was not. The vulnerability has been resolved by adding the appropriate guard to prevent the panic.
A locking order vulnerability in the Linux kernel's Bluetooth RFCOMM implementation (CVE-2026-99009) has been resolved. The issue involves a circular locking dependency between rfcomm_mutex and hdev->lock during RFCOMM socket connection and HCI event handling, which can cause lockdep warnings and potential deadlocks. The fix changes the order of locking by connecting the session socket before acquiring rfcomm_mutex, eliminating the circular dependency. Additional safeguards were added to handle race conditions where sockets or DLCs might be closed during connection setup.
A NULL pointer dereference vulnerability in the Linux kernel Bluetooth RFCOMM subsystem was fixed. The issue occurs in the rfcomm_dev_shutdown() function when closing an RFCOMM tty device. If the tty device registration fails, a NULL pointer dereference can happen because the code does not check if the tty device pointer is NULL before using it. This can lead to a kernel crash (general protection fault). The fix adds a NULL check to prevent this dereference.
A vulnerability in the Linux kernel's Xilinx axienet network driver was resolved. The issue involved the improper freeing of DMA buffers on dmaengine stop, causing a memory leak of SKBs and DMA mappings during interface shutdown. This could exhaust limited IOMMU aperture resources. The fix ensures all DMA-mapped buffers are properly unmapped and freed on stop, and adds synchronization to prevent race conditions between buffer callbacks and driver stop operations.
A vulnerability in the Linux kernel regulator driver for the LTC3676 chip involved reading write-only registers HRST and CLIRQ. These registers trigger hardware reset and interrupt clear commands when written, but reading them causes unintended board resets. The issue was resolved by making these registers writable only and preventing reads that cause resets.