A vulnerability in the Linux kernel's dm-verity implementation was addressed by protecting the root hash with Read-Copy-Update (RCU) synchronization. The issue involved the function ipe_bdev_setintegrity() freeing the old root hash while it could still be dereferenced during policy evaluation, potentially leading to use-after-free conditions. The fix ensures that the root hash is protected with RCU, aligning with the existing evaluation path that runs under rcu_read_lock().
A vulnerability in the Linux kernel's IPv6 Segment Routing (SR) implementation allows an out-of-bounds read of uninitialized kernel memory due to improper validation of the SEG6_ATTR_DST attribute length. This can lead to leakage of 16 bytes of kernel heap memory to userspace. The issue arises because the attribute length is only checked for maximum length, permitting shorter lengths that cause the out-of-bounds read. The vulnerability is fixed by enforcing exact attribute length validation.
A Linux kernel vulnerability in kprobes causes a permanent hang when flushing the kprobe optimizer by writing 0 to /proc/sys/debug/kprobes-optimization. This results in a process sleeping indefinitely in an uninterruptible state (D state) while holding a mutex, causing subsequent reads or writes to the sysctl to hang as well. The issue arises from improper synchronization and completion handling during optimizer flushing, leading to deadlock conditions.
A runtime power management (PM) reference leak was fixed in the arizona_gpio_direction_out() function of the Linux kernel's gpio arizona driver. The flaw occurred when switching a persistent GPIO line from input to output: if regmap_update_bits() failed, the runtime PM reference on the parent device was not released, causing a leak. This could lead to resource management issues but does not directly cause code execution or data corruption.
A vulnerability in the Linux kernel gpio cdev subsystem could leak kernel stack contents to user-space due to improper handling of an error path in gpio_desc_to_lineinfo(). This occurs when the GPIO chip guard acquisition fails, causing an uninitialized info struct to be passed to user-space. The issue has been fixed by changing the function to return an error code and ensuring the info struct is zeroed before use.
A runtime PM (power management) reference leak occurs in the Linux kernel's gpio: zynq driver due to improper handling of pm_runtime_get_sync() failure. This causes the controller's clock to remain enabled as it cannot runtime-suspend, potentially impacting power efficiency.
A vulnerability in the Linux kernel's LLC (Logical Link Control) layer involves insufficient reservation of device headroom for allocated frames. The function llc_alloc_frame() reserves link-layer headroom based on the device type, which is inadequate for stacked Ethernet devices like VLAN devices. This can cause an underflow of skb headroom in eth_header() when an LLC response is processed. The issue is addressed by using LL_RESERVED_SPACE() to correctly account for the actual required headroom while maintaining the existing device-type check.
A vulnerability in the Linux kernel's MCTP socket tag handling allows any MCTP socket within the same network namespace to use and consume another socket's preallocated tag. This occurs because the function mctp_lookup_prealloc_tag() iterates over a namespace-wide tag list instead of the socket's own tag list, leading to improper tag matching. The issue has been fixed by changing the iteration to the socket's own tag list, preventing unauthorized tag usage.
CVE-2026-98523 is a vulnerability in the Linux kernel's Direct Rendering Manager (DRM) client code. It involves a NULL pointer dereference triggered when closing a DRM file descriptor if a partially initialized framebuffer device client remains registered. This occurs because the restore function attempts to restore state unconditionally, even when initialization failed, leading to access of uninitialized memory and a kernel warning followed by a crash.
A flaw in the Linux kernel's drm/imagination driver caused the pvr_mmu_map_sgl() function to not correctly propagate map failures to the pvr_mmu_map() interface. This improper error handling could lead to a NULL pointer dereference and kernel crash. The issue has been fixed by ensuring the proper error code is returned from pvr_mmu_map_sgl().
CVE-2026-98521 is a medium severity vulnerability in the Linux kernel's drm/i915 driver involving an incorrect RCU teardown order. The issue arises when the i915_gem_busy_ioctl function iterates over fences in a GEM object without holding a proper reference, only the RCU read lock. This can lead to a destroyed GEM object during iteration, causing an endless loop due to improper handling of dma_fence references. The vulnerability has been fixed by deferring fence reference drops until after the RCU grace period.
A runtime power management (PM) reference leak was fixed in the Linux kernel's amdgpu driver in the function amdgpu_debugfs_test_ib_show(). The issue occurred when the function resumed the device but failed to release the PM reference if acquiring a write lock was interrupted, causing the GPU to remain awake unnecessarily.
A reference leak vulnerability in the Linux kernel's Nouveau DRM driver was fixed. The function nv1a_ram_new() failed to release a PCI device reference after reading memory size from its config space, causing a bridge reference leak.
A vulnerability in the Linux kernel's drm/nouveau component caused a gem reference leak in the validate_init() function. This occurs when certain error paths break a loop without releasing a reference taken by drm_gem_object_lookup(), leading to resource leakage. The issue has been fixed by dropping the reference before exiting on these error paths.
A low-severity vulnerability in the Linux kernel's nouveau DRM driver causes a runtime power management (PM) reference leak in the nouveau_connector_detect() function. If nvif_outp_edid_get() fails, the function returns early without releasing the runtime PM reference, causing the device to remain powered on unnecessarily until the next successful detection. This issue has been fixed by balancing the PM reference on the error path.
A vulnerability in the Linux kernel's nouveau DRM driver causes an incorrect increment of the pin count when a re-pin operation fails. This leads to a warning triggered in the ttm_bo_release() function due to an unbalanced pin count decrement. The issue was discovered through fuzzing and involves the nouveau_bo_pin_locked() function improperly calling ttm_bo_pin() even when the pin request fails.
A memory leak vulnerability in the Linux kernel's drm/virtio driver was fixed. The issue occurs when the virtio_gpu_execbuffer_ioctl() function reserves a DRM event but encounters an error before the fence event is properly handled, causing the event to be orphaned and leaked permanently. This leak happens because the cleanup path drops the fence without cancelling the event, and the event is never freed. The flaw was discovered through fuzzing with Syzkaller and affects multiple Linux kernel versions.
A NULL pointer dereference vulnerability exists in the Linux kernel's drm/virtio driver due to lack of proper NULL checks after fence allocation failure. This can cause a general protection fault and kernel crash when the virtio_gpu_fence_alloc() function returns NULL under memory pressure, and the caller does not handle this condition properly.
A vulnerability in the Linux kernel's huge page memory management subsystem was resolved. The flaw involved improper handling of gigantic huge pages without runtime support, leading to potential corruption of the free list during memory management operations. This issue affects specific versions of the linux-hwe-edge kernel and has been assigned CVE-2026-98506. The severity is considered low.
A race condition in the Linux kernel's memory management subsystem involving huge page table entries (PTEs) was fixed. The damon_hugetlb_mkold() function previously read and updated PTEs without properly synchronizing with hardware-driven updates, risking loss of hardware-set bits such as the dirty bit. The fix involves clearing the PTE atomically during the read to prevent parallel hardware updates from being lost. Because huge pages are in-memory and not reclaimable, no critical impact is expected.