A vulnerability in the Linux kernel PCI subsystem causes a NULL pointer dereference and early boot hang when CONFIG_PCI_DYNAMIC_OF_NODES is enabled. This occurs because certain PCI bridges without a subordinate bus have their bus properties improperly processed. The issue has been fixed by generating 'bus-range' and 'interrupt-map' properties only when a subordinate bus exists, preventing the NULL dereference.
CVE-2026-98503 is a vulnerability in the Linux kernel's packet TX_RING handling where improper management of skb destructors and zero-copy completion can cause ring slots to be reused prematurely. This flaw could lead to inconsistent state and missing packet timestamps during transmission. The issue has been resolved by switching to standard zero-copy completion and improving reference management to ensure slots are only released after all references are freed or copied.
A vulnerability in the Linux kernel's HID alps driver causes a memory leak by failing to unregister a secondary input device (DualPoint Stick) on device removal. This occurs because the driver lacks a proper .remove handler to unregister the second input device, leading to resource leakage each time the device is removed.
A reference leak vulnerability in the Linux kernel's mlx5_tc_ct_shared_counter_get() function was fixed. The issue occurs when a reverse entry's counter is being released, causing a reference count increment to fail and the reference to never be dropped, potentially keeping the reverse entry alive indefinitely. This flaw affects specific versions of the Linux kernel and has a medium severity rating.
A use-after-free vulnerability exists in the Linux kernel's airoha network driver related to watchdog timer (WDT) work cancellation timing. The issue arises because the watchdog IRQ is freed only after the remove function returns, allowing a watchdog handler to reschedule work on freed memory. This can lead to dereferencing freed memory and potential kernel instability. The flaw was identified through static analysis and affects specific Linux kernel versions.
A medium-severity vulnerability in the Linux kernel ARP ioctl handling allows an out-of-bounds read due to improper termination of the device name field before lookup. This flaw occurs because the arp_dev field may lack a NUL terminator, causing strcmp() to read beyond the intended buffer when matching interface names. The issue has been resolved by ensuring the device name is properly terminated before lookup.
A medium severity vulnerability in the Linux kernel's atl1 network driver causes a soft lockup due to an out-of-range read of cmb_tpd_next_to_clean. This occurs when the hardware reports an invalid value (0xffff) during PCIe link or MAC reset, causing an infinite loop in the driver code. The issue is similar to a previously fixed problem in the atl1c driver. A fix has been implemented to treat the out-of-range value as indicating no new data to clean, preventing the lockup.
CVE-2026-98493 is a vulnerability in the Linux kernel's DHCP option construction code. The function ic_dhcp_init_options() appends DHCP options including hostname (option 12), vendor-class (option 60), and client-ID (option 61) into a fixed 312-byte buffer without properly checking bounds for hostname and vendor-class options. This can cause a buffer overflow when large hostname and vendor-class values are used, potentially leading to a kernel panic if CONFIG_FORTIFY_SOURCE is enabled and panic_on_warn=1 is set. The issue is addressed by routing options through a helper that ensures buffer limits are respected, dropping options that would overflow the buffer. Configurations with short options remain unaffected.
CVE-2026-98492 addresses a memory leak issue in the Linux kernel's macb network driver related to dma_alloc_coherent() during error handling in macb_alloc(). The flaw causes leaks of transmit (Tx) and receive (Rx) buffers under certain error conditions, such as buffer allocations crossing a 4GB boundary or Rx buffer allocation failures. The issue is fixed by ensuring allocated buffers are stored promptly to enable proper freeing during error cleanup.
A use-after-free (UAF) and memory leak vulnerability exists in the Linux kernel's LLC (Logical Link Control) code related to skb handling in llc_mac_hdr_init() failure paths. Incorrect freeing of socket buffers (skb) can lead to leaks, double frees, and reads from freed memory. This flaw affects specific Linux kernel versions and has been assigned CVE-2026-98555 with a high severity rating.
CVE-2026-98550 is a vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) protocol where invalid or unexpected GRP_ACK_MSG messages can cause an underflow of the bc_ackers counter. This underflow leads to a wraparound that causes the system to permanently report congestion and block future group broadcasts on the affected socket. The flaw arises from incomplete checks on acknowledgment messages, allowing duplicate or stale ACKs to decrement the counter improperly. The issue affects specific Linux Azure kernel versions and has been addressed by rejecting invalid ACK messages under certain conditions.
CVE-2026-98549 is a critical vulnerability in the Linux kernel's TCP implementation that allows improper collapsing of socket buffers (skbs) across encryption boundaries in the retransmission queue. This flaw can cause encrypted data to be retransmitted in cleartext or cause connection stalls due to dropped packets in TLS device offload scenarios.
CVE-2026-98548 is a critical use-after-free vulnerability in the Linux kernel's SCTP implementation. It occurs when processing a bundled ERROR(Stale Cookie) and DATA packet from a non-primary address during the COOKIE-ECHOED state, leading to a dangling pointer dereference after the associated transport is removed but still referenced. This flaw can be triggered by any malicious SCTP peer or local unprivileged user without special privileges. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-98543 is a vulnerability in the Linux kernel related to BPF LSM programs and inode locking assumptions in the path_unlink and path_rmdir hooks. The issue arises because these hooks run before the victim inode's i_rwsem lock is taken, allowing a sleepable BPF LSM program to mutate extended attributes (xattrs) without holding the required lock. The fix involves dropping these hooks from the d_inode_locked_hooks list so that the verifier uses locking variants of BPF functions that take the lock themselves.
CVE-2026-98532 is a high severity vulnerability in the Linux kernel's IPv6 implementation where the function ipv6_find_hdr() can return an offset beyond the end of a packet. This flaw allows out-of-bounds memory access when the Open vSwitch component uses this offset as the transport header, leading to a use-after-free error and potential kernel memory corruption.
A use-after-free vulnerability in the Linux kernel's rds_ib module occurs when the scatterlist is not properly cleared after a failed DMA mapping in rds_ib_map_frmr(). This can lead to a dangling pointer in the MR pool, potentially allowing local privilege escalation. The flaw is detected by KASAN as a slab-use-after-free error during MR teardown.
A vulnerability in the Linux kernel's nouveau DRM driver related to VRAM pinning was resolved. The issue involved the device-private region size growing without resizing the backing VRAM buffer object accordingly, causing address resolution errors beyond the first chunk. This could lead to unauthorized access or corruption of VRAM memory regions.
A use-after-free (UAF) vulnerability was identified and fixed in the Linux kernel's Nouveau DRM driver, specifically in the nouveau_uvmm_sm function when a buffer object (BO) is in the TTM_PL_SYSTEM memory placement. The flaw occurs because the code incorrectly treats a ttm_resource as a nouveau_mem structure, leading to an invalid memory read and potential kernel memory corruption. This issue was detected by Kernel Address Sanitizer (KASAN) and could cause system instability or crashes.
A double-free vulnerability exists in the Linux kernel's drm/nouveau driver in the function nvif_vmm_dtor. This occurs because the nouveau_cli_fini() function is called twice during error handling, leading to an unconditional free of the same memory twice without clearing the pointer. This flaw was discovered through fuzzing and can cause kernel memory corruption.
CVE-2026-98512 is a use-after-free vulnerability in the Linux kernel's drm/nouveau driver scheduler. The flaw arises because the nouveau_sched object is freed with kfree() instead of kfree_rcu(), leading to a race condition where userspace can access freed memory via sync_file interfaces. This can cause a kernel memory corruption and potential denial of service. The vulnerability affects specific Linux kernel versions including several 4.15.x, 5.0.x, and 5.3.x builds.