CVE-2026-98738 is a high-severity vulnerability in the Linux kernel's Bluetooth subsystem. It involves a race condition in the handling of remote Out-Of-Band (OOB) data during Secure Manager Protocol (SMP) pairing. The flaw arises because SMP accesses remote OOB data without proper serialization, allowing concurrent removal of the data that can lead to use-after-free errors. This issue was detected by Kernel Address Sanitizer (KASAN) and could cause memory corruption. The vulnerability affects specific linux-aws kernel versions. A fix has been implemented by introducing a dedicated mutex to serialize access to remote OOB data, preventing concurrent modification and use-after-free conditions.
CVE-2026-98737 is a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem affecting the hci_sync component. The flaw arises from improper locking during inquiry cache lookups and updates, leading to potential access of freed memory. This issue has been fixed by ensuring proper locking and safe memory handling during Bluetooth inquiry cache operations.
CVE-2026-98736 is a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem related to enhanced SCO (Synchronous Connection-Oriented) setup. The flaw occurs because the hci_enhanced_setup_sync() function accesses a parent connection object without holding the necessary lock, allowing a race condition where the parent can be freed while still in use. This can lead to a kernel memory corruption detected by KASAN. The issue affects specific Linux kernel versions and has a medium severity rating with a CVSS score of 5.7.
CVE-2026-98735 is a use-after-free vulnerability in the Linux kernel's Bluetooth hci_core component. It arises from improper synchronization when scheduling ACL transmissions and deleting channels, leading to potential memory corruption. The flaw was detected by KASAN and involves race conditions between channel selection and teardown. This vulnerability affects specific Linux kernel versions and has a high severity score.
CVE-2026-98734 is a use-after-free vulnerability in the Linux kernel's Bluetooth hci_core component. It arises from improper serialization of SCO and ISO scheduling with connection teardown, leading to potential access of freed memory. The issue is fixed by holding the device lock across connection selection and transmission, preventing unsafe concurrent access and queue purging races.
CVE-2026-98733 is a use-after-free vulnerability in the Linux kernel's Bluetooth hci_core component. It arises from improper serialization of fragmented ISO packet queueing, where concurrent operations on the packet queue can lead to memory corruption and use-after-free conditions. This flaw has been addressed by holding the queue lock across the entire fragment batch to ensure safe concurrent access.
A buffer over-read vulnerability in the Linux kernel Bluetooth component (btintel) was fixed. The issue involved the btintel_hw_error() function printing exception information using skb->data + 1 without ensuring the 12-byte payload was NUL-terminated, potentially reading beyond the buffer's end. The fix bounds the print operation to the actual length of the data to prevent over-read.
A vulnerability in the Linux kernel Bluetooth subsystem (btintel_pcie) allows an integer overflow in the plen calculation in the btintel_pcie_recv_frame() function. The plen variable is a 16-bit unsigned integer computed as HDR_SIZE plus dlen, where dlen is a 16-bit field. If dlen is >= 0xFFFC, the addition wraps around, bypassing a length check and causing skb_trim() to truncate the packet improperly. This issue has been fixed by widening plen to a 32-bit integer to prevent overflow.
A vulnerability in the Linux kernel Bluetooth driver btintel_pcie allows a user-space process with HCI_CHANNEL_USER access to inject oversized TX packets, causing a buffer overflow in the send_frame() function. This occurs because the function copies data into a fixed-size 4096-byte buffer without properly rejecting packets that exceed the buffer size minus the PCIe header length. The issue has been resolved by rejecting packets larger than the allowed size on entry.
CVE-2026-98729 is a vulnerability in the Linux kernel affecting x86 memory management on AMD F15h processors. The issue arises because the kernel incorrectly applies virtual address alignment (va_align) to hugetlb mappings, causing address misalignment and triggering a kernel bug during huge page teardown. This affects certain AMD processors such as Carrizo and FX-8370E. The flaw has been resolved by modifying the alignment logic to skip randomization for hugetlbfs mappings.
A vulnerability in the Linux kernel's nvmet subsystem causes the host ID to be copied incorrectly during controller initialization, leading to improper handling of Preempt and Abort operations in namespace reservations. This results in the preempting host incorrectly believing it has aborted the victim's in-flight I/O, while the victim's I/O continues. The issue affects multiple specific Linux kernel versions and has a CVSS score of 6.9 (medium severity).
A low-severity vulnerability in the Linux kernel's KVM arm64 implementation involves the handling of fine-grained undefined instructions (UNDEFs) without the FEAT_FGT hardware feature. The issue is addressed by applying fine-grained UNDEFs unconditionally, which also resolves a warning triggered when running a TLBI OS guest without FEAT_TLBIOS on non-FEAT_FGT hardware.
CVE-2026-98710 is a low severity vulnerability in the Linux kernel's iwlegacy wifi driver for the 3945 device. The issue involves a memory leak of EEPROM data when the PCI device is removed because the remove path does not free allocated EEPROM memory after a successful probe. This flaw was identified through manual code inspection and affects specific Linux kernel versions.
A vulnerability in the Linux kernel's mac80211 minstrel_ht rate control module allows out-of-bounds memory access via the fixed_rate_idx debugfs file. This file accepts any u32 value, which can lead to invalid indexing into internal arrays and subsequent kernel memory corruption. The debugfs file is only accessible to root, so this is not a privilege escalation issue but remains a kernel memory safety bug.
A vulnerability in the Linux kernel's mac80211 wireless subsystem allows a specially crafted Channel Switch Announcement (CSA) frame to cause a kernel panic. This occurs because the kernel improperly handles an invalid 320 MHz bandwidth indication on non-6 GHz links, leading to an uninitialized read and potential panic when panic_on_warn is enabled. The issue has been resolved by rejecting invalid channel definitions before processing.
A medium severity vulnerability in the Linux kernel's mac80211 wifi subsystem was fixed by ensuring the info->band field is correctly set for 802.3 encapsulation offload frames. Previously, this field remained zero on non-MLD interfaces, causing incorrect band usage in transmission rate calculations. The fix aligns the handling with ieee80211_build_hdr() by dropping frames without a channel context and leaving the band at zero on MLD interfaces.
A use-after-free (UAF) vulnerability was fixed in the Linux kernel's mac80211 wireless subsystem related to mesh fast transmit path deletion. The flaw involved stale pointers in a cache after mesh path deletion, which could lead to referencing freed memory. This issue affects specific Linux kernel versions and has a high severity rating with a CVSS score of 7.3.
CVE-2026-98693 is a vulnerability in the Linux kernel's Thunderbolt driver related to improper handling of router references for allocated HopIDs. The flaw allows a DP tunnel to outlive its expected lifecycle, leading to operations on freed IDAs and triggering warnings. This can occur when unbinding the driver while a DP tunnel is still waiting for DPRX capabilities to be read, notably triggered by unplugging the Apple NHI cable. The issue is resolved by holding a router reference for each allocated HopID and releasing it appropriately to keep ports and their HopID IDAs alive during use.
A vulnerability in the Linux kernel's SMB client implementation was fixed to ensure dirty data is flushed before zeroing a range. Previously, when zeroing an interior range that did not reach the end of file (EOF), dirty data overlapping the range could be written back after zeroing, causing stale data to be read instead of zeroed data. The fix enforces unconditional flushing of dirty data before invalidating the page cache and issuing the zeroing command to the server.
A vulnerability in the Linux kernel's IIO core for the kxcjk-1013 accelerometer driver allows duplicate disable event requests to cause a runtime PM usage count underflow warning. This occurs because repeated disable requests improperly drop a runtime PM reference that was not acquired, potentially leading to incorrect power management state handling.