A vulnerability in the Linux kernel's wifi wfx driver allows a firmware response with an excessively large length field to cause a buffer over-read when copying data to a caller buffer. This occurs because the function wfx_hif_read_mib() does not validate that the firmware reply length fits within the caller's buffer size before performing the copy. The issue has been resolved by adding proper validation to prevent buffer overruns.
CVE-2026-98829 is a vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem where oversized fragments can cause an overflow in a 16-bit length field. This overflow leads to insufficient buffer allocation and a subsequent kernel crash when fragment data is appended. The issue arises because fragment lengths are accumulated in a 16-bit field that can wrap around if the total size exceeds 65535 bytes. The vulnerability has been fixed by adding checks to drop frames that would cause this overflow.
CVE-2026-98823 is a high-severity vulnerability in the Linux kernel's wifi cfg80211 component. It involves improper handling of hidden-group beacon Information Elements (IEs) during probe-response processing, which can lead to double-free errors and potential memory corruption. The flaw occurs when beacon IEs borrowed from a group's beacon entry are copied to an associated entry, resulting in two owners for the same allocation. This can cause use-after-free or double-free conditions when the group's beacon entry is released. The vulnerability has been resolved by skipping beacon IE replacement for hidden group entries while preserving normal probe-response processing.
CVE-2026-98818 is a Linux kernel vulnerability involving a deadlock risk in the memory management slab allocator. The issue arises because kfree_rcu() can be called while holding pi_lock, a raw spinlock, and it should not allocate memory with __GFP_KSWAPD_RECLAIM since waking up kswapd under pi_lock leads to a circular locking dependency and deadlock. This deadlock was confirmed using a modified kernel with lockdep instrumentation. The vulnerability affects specific Linux kernel versions including several 4.15.x, 5.0.x, and 5.3.x releases.
CVE-2026-98813 is a high-severity vulnerability in the Linux kernel's BPF subsystem related to improper handling of map BTF references in the memory allocator destructor. The flaw allows a use-after-free condition when the BPF memory allocator defers destruction work, potentially causing kernel memory corruption. This occurs because the map BTF reference is released too early while deferred work still accesses it. The issue affects multiple Linux kernel versions used in various Ubuntu releases.
A vulnerability in the Linux kernel's stmmac network driver affects the handling of received frames larger than the DMA buffer size when scatter-gather is used. The secondary RX buffer was not properly allocated for regular frames, causing DMA to write to an unmapped address and trigger an SMMU translation fault on IOMMU-based platforms. This issue has been fixed by enabling scatter-gather support for non-split-header frames on capable cores and properly allocating the secondary buffer. The fix also addresses frame trimming to avoid underflows and prepares for future multi-buffer XDP support.
A vulnerability in the Linux kernel netfilter subsystem allows invalid NAT manipulation types to be passed to nf_nat_setup_info(), causing a WARN_ON() and potential improper connection tracking cleanup. This issue arises because bpf_ct_set_nat_info() does not validate the NAT manipulation type before use. The fix involves validating the NAT manipulation type and dropping packets when invalid types are detected.
A vulnerability in the Linux kernel's drm/mediatek driver involves a missing IS_ERR check for the ovl_adaptor platform device. The platform_device_register_data() function can fail and return an ERR_PTR, but this return value was not checked, leading to an invalid pointer being stored and passed to other kernel functions. This flaw can cause a kernel crash. The issue has been resolved by adding the missing IS_ERR check to handle errors properly.
CVE-2026-98773 is a use-after-free vulnerability in the Linux kernel's USB cdc-acm driver. It occurs when the acm_port_shutdown() function restarts USB Request Blocks (URBs) after the device has been disconnected, leading to access of freed DMA memory. The flaw is fixed by adding a check to prevent URB resubmission during disconnect. This vulnerability affects specific Linux kernel versions and has a medium severity rating with a CVSS score of 5.4.
A vulnerability in the Linux kernel's USB DWC3 gadget driver causes an interrupt request (IRQ) storm due to improper handling of an invalid event buffer count. When the event count exceeds the buffer length, the interrupt line remains asserted, leading to a kernel panic triggered by spurious interrupts.
A vulnerability in the Linux kernel USB core affects the handling of non-ep0 control endpoints. Specifically, when disabling such endpoints with reset_hardware set, only one direction's endpoint pointer is cleared, leaving the other pointing to a disabled or freed endpoint. This flaw has been fixed by ensuring both endpoint pointers (ep_in and ep_out) are cleared. The issue was tested and resolved in Linux kernel 7.3.0-rc3.
A vulnerability in the Linux kernel's USB Type-C driver (tipd) was fixed by zero-initializing the typec_partner_desc structure in the cd321x_update_work() function. Previously, uninitialized fields could lead to garbage function pointers being invoked and potential leakage of stack data via sysfs. This issue affects specific Linux kernel versions and has a medium severity rating.
A use-after-free vulnerability in the Linux kernel's cdns3 USB gadget driver was fixed. The issue occurs because cdns3_gadget_exit() does not wait for deferred work handlers to complete before freeing resources, potentially allowing use of freed memory. This flaw was identified by static analysis and affects specific Linux kernel versions.
A NULL pointer dereference vulnerability exists in the Linux kernel's usb: cdns3 driver during the PCI probe process. This occurs when the second function of the Cadence USBSS controller is probed before the first function has set its driver data, leading to a kernel crash. The issue is resolved by deferring the probe until the first function completes its initialization.
CVE-2026-98753 is a vulnerability in the Linux kernel's tty subsystem where the TTY_IO_ERROR flag is not restored on activation failure. This flaw can lead to kernel panics or NULL-pointer dereferences when accessing powered down or deregistered TTY ports due to race conditions between ioctl calls and port hangups. The issue occurs because the flag is only reset during tty_port_close(), leaving a window where drivers may mishandle ioctl-hangup races.
CVE-2026-98749 is a vulnerability in the Linux kernel's max3100 serial driver where a timer is not properly shut down before the port is freed. This can lead to a timer callback accessing freed memory, potentially causing instability. The issue arises during system suspend and resume sequences when the SPI device is unbound before resume. The fix involves proper timer teardown, freeing IRQs, and destroying workqueues to prevent race conditions and use-after-free scenarios.
A clock reference leak vulnerability was identified and fixed in the Linux kernel's ma35d1 serial driver. The issue involved the ma35d1serial_probe() function failing to release clock references obtained via of_clk_get(), leading to resource leaks on error paths and during port removal.
CVE-2026-98744 is a medium severity vulnerability in the Linux kernel's ASoC codec max98363 driver. The issue arises because the stream_config structure is not properly initialized before being passed to sdw_stream_add_slave(), causing the type field to contain uninitialized (garbage) data. This uninitialized value is then copied to stream->type by sdw_config_stream(). The vulnerability has been fixed by zero-initializing stream_config so that the type defaults to SDW_STREAM_PCM.
CVE-2026-98743 is a medium-severity vulnerability in the Linux kernel's ASoC codec driver for rt1017-sdca-sdw. The issue arises because the stream_config->type field is uninitialized before being passed to sdw_stream_add_slave(), potentially causing it to contain garbage data. This field is later copied to stream->type by sdw_config_stream(). The fix involves zero-initializing stream_config so that type defaults to SDW_STREAM_PCM and using a helper function to set parameters correctly.
CVE-2026-98739 is a race condition vulnerability in the Linux kernel's Bluetooth RFCOMM implementation. It involves a race in managing the initial port reference between installation and release paths, which can lead to a use-after-free condition. This flaw was detected by KASAN and can cause kernel memory corruption. The issue affects specific linux-aws kernel versions. A fix has been implemented to use atomic bit operations to prevent double dropping of the reference.