A use-after-free race condition in the Linux kernel's drm/xe virtual memory management subsystem could lead to a NULL pointer dereference. The flaw occurs because page tables (PTs) were destroyed before contested virtual memory areas (VMAs) were unlinked, causing a NULL pointer dereference when concurrent threads evict shared buffer objects. This vulnerability has been fixed by deferring PT destruction until after all contested VMAs are unlinked and destroyed.
CVE-2026-98507 is a high-severity vulnerability in the Linux kernel's memory management subsystem related to a missing memory barrier between anon_vma initialization and its publication to a virtual memory area (VMA). This flaw can cause a use-after-free (UAF) condition and lead to deadlocks where anon_vma locks are never released, resulting in hung tasks on affected systems. The issue arises from concurrent faults on adjacent VMAs that are anon_vma-compatible but not merged, allowing race conditions due to reordered memory stores. The vulnerability affects specific Linux kernel versions listed and has been addressed by fixing the memory barrier to ensure proper synchronization.
A use-after-free vulnerability exists in the Linux kernel's HID alps driver due to improper handling of input device registration failures. Specifically, if input2 registration fails, a freed input device pointer remains referenced, which can be dereferenced during certain input events, leading to potential memory corruption.
A vulnerability in the Linux kernel's HID wacom driver (wacom_wac_pen_serial_enforce function) allows an out-of-bounds read due to improper offset calculation when processing HID reports with mismatched usage counts. This can lead to information disclosure by leaking memory contents to userspace via MSC_SERIAL events. The issue has been fixed by clamping the loop to the correct report count, preventing invalid memory reads.
A vulnerability in the Linux kernel's mlx5e driver causes swapped IPv6 IPsec policy masks, leading to incorrect hardware rules that may miss or incorrectly match traffic. This affects specific kernel versions and can impact confidentiality, integrity, and availability of network traffic.
CVE-2026-98491 is a high-severity vulnerability in the Linux kernel's openvswitch conntrack component. It involves a use-after-free (UAF) condition triggered when cloned skb packets with unconfirmed conntrack entries are committed with different extension sets, leading to pointer corruption in the expectation list. This flaw can cause memory corruption and potentially impact confidentiality, integrity, and availability. The vulnerability affects specific linux-aws kernel versions. A fix has been implemented to reset the entry during commit to prevent shared unconfirmed conntrack entry modifications.
CVE-2026-98489 is a vulnerability in the Linux kernel's atl1c network driver that causes a soft lockup due to an out-of-range tpd_cons read. The hardware can report a tpd_cons value of 0xffff during PCIe link or MAC reset, which the driver loop interprets incorrectly and spins indefinitely. This issue has been reproduced on systems with Qualcomm Atheros AR8151 v2.0 NICs, triggered by rebooting a Mikrotik CCR2004 PCIe card. The problem leads to a CPU soft lockup detected by the watchdog, causing system instability.
CVE-2026-98488 is a vulnerability in the Linux kernel's atl1e network driver that causes a soft lockup due to an out-of-range read of hw_next_to_clean. This occurs when the hardware reports an invalid value (0xffff) during PCIe link or MAC reset, causing an infinite loop in the driver. The issue is similar to a previous atl1c driver vulnerability and has been fixed by treating the out-of-range value as no new data to clean.
A vulnerability in the Linux kernel's ena driver causes a memory leak of a DMA buffer when the probe function fails after partial initialization. This occurs because the error path does not properly release the MMIO read request buffer, leading to resource leakage.
A vulnerability in the Linux kernel's netfilter nf_tables subsystem causes expired catchall elements to be skipped incorrectly during insert and delete operations. This leads to stale entries that block re-insertion and cause silent failures or incorrect deletions. The issue arises because the lookup and dump paths handle expired elements differently than insert and delete paths, causing inconsistencies until garbage collection removes the stale entries.
A use-after-free vulnerability was identified and fixed in the Linux kernel's NFC subsystem, specifically in the nfc_get_local_general_bytes function. The issue arose from improper reference counting and memory management, which could lead to accessing freed memory. The fix involved refactoring the functions to use caller-provided buffers, ensuring safe memory handling without ownership transfer issues. Multiple NFC drivers were updated accordingly.
A vulnerability in the Linux kernel's NFC LLCP receive handler (nfc_llcp_recv_hdlc) allows reading of uninitialized memory when processing truncated I, RR, or RNR PDUs. This occurs because the sequence byte is read before verifying the PDU length, potentially leading to use of uninitialized data. The issue is fixed by adding a length check before reading the sequence byte, ensuring truncated PDUs are rejected without processing.
A vulnerability in the Linux kernel NFC port100 driver allows out-of-bounds memory reads due to improper validation of frame length fields. The driver fails to check that the declared frame length does not exceed the actual received data length, leading to potential memory corruption. This issue has been resolved by rejecting frames whose declared length exceeds the received data before validation.
A vulnerability in the Linux kernel NFC driver for the trf7970a device causes improper power-down handling on startup RX gain failure. If register read or write fails during startup, the device remains powered up due to missing power-down calls, leading to unbalanced power states. This issue was found during static code analysis and affects specific Linux kernel versions.
CVE-2026-98478 is a vulnerability in the Linux kernel's SCSI UFS core subsystem where internal commands become blocked during error handling, causing a deadlock. The issue arises because internal commands share a request queue with regular logical units, which are quiesced during error recovery, preventing internal commands from dispatching. The fix involves selectively unquiescing the pseudo SCSI device queue to allow internal commands to proceed while keeping logical units quiesced, preventing the deadlock.
A vulnerability in the Linux kernel's perf subsystem was fixed where a NULL pointer was passed to the pmu->sched_task() function, causing a kernel NULL pointer dereference. This issue occurs because __perf_pmu_sched_task() always passes NULL instead of the expected CPU-wide context, leading to a potential kernel crash. The flaw was addressed by passing the correct CPU-wide context pointer, preventing the NULL dereference.
A NULL pointer dereference vulnerability was identified and fixed in the Linux kernel's s390/cio subsystem. The issue occurs when the channel path registry entry associated with a CHPID is removed while the subchannel's PMCW still references that CHPID, causing a function to return NULL and leading to a NULL pointer dereference. This was addressed by adding a missing NULL check before dereferencing the pointer.
A vulnerability in the Linux kernel s390/cmf subsystem involved confusion between virtual and physical addresses when storing extended format channel measurement data. The issue affected kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE=y, causing firmware to use incorrect addresses. This has been fixed by defining certain fields as dma64_t and adding the missing virt_to_dma64() translation to ensure correct address usage.
A vulnerability in the Linux kernel's s390/pci subsystem was fixed by adding a missing device lock in the zpci_report_status() function. The issue involved accessing the device's driver without holding the necessary device lock when pdev was non-NULL, potentially leading to inconsistent device state during recovery. The fix expands the device lock critical section and adds a lockdep assertion to ensure proper locking.
CVE-2026-98473 addresses three related issues in the Linux kernel's s390/vfio-ap driver involving improper handling of KVM interrupt and page resources when a queue is removed from the host's AP configuration while assigned to a mediated device. The flaws cause resource leaks, including KVM GISC registration and pinned guest pages, and a potential double-free condition. These issues are fixed by improving response code handling and resource cleanup logic in the driver.