A vulnerability in the Linux kernel's SMB client implementation was fixed to ensure dirty data is flushed before zeroing a range. Previously, when zeroing an interior range that did not reach the end of file (EOF), dirty data overlapping the range could be written back after zeroing, causing stale data to be read instead of zeroed data. The fix enforces unconditional flushing of dirty data before invalidating the page cache and issuing the zeroing command to the server.
A vulnerability in the Linux kernel's IIO core for the kxcjk-1013 accelerometer driver allows duplicate disable event requests to cause a runtime PM usage count underflow warning. This occurs because repeated disable requests improperly drop a runtime PM reference that was not acquired, potentially leading to incorrect power management state handling.
A vulnerability in the Linux kernel's AD4030 ADC driver was fixed by correcting invalid input validation of the oversampling_ratio parameter. The function ad4030_set_avg_frame_len() previously computed a logarithm on the input before validating it, which could lead to undefined behavior if zero or negative values were passed.
A vulnerability in the Linux kernel's iio adc pac1934 driver involves improper handling of ACPI label duplication. The issue occurs when a label duplication failure reaches the terminating-byte write, potentially causing improper access to missing labels. The flaw was detected by static analysis and reviewed with AI-assisted source auditing. The vulnerability affects specific Linux kernel versions and has been assigned a low severity rating.
A vulnerability in the Linux kernel's stm32-adc driver could cause a division by zero error when processing ADC channel data if the conversion fails or returns zero. This issue arises because the driver does not properly check for error conditions or zero values before processing the data, which can lead to invalid operations. The flaw has been fixed by adding checks to handle these cases appropriately.
A vulnerability in the Linux kernel's iio frequency driver for adf4377 involves incomplete initialization of clk_init_data and clk_parent_data structures. This can cause crashes when certain kernel stack initialization configurations are enabled. The issue arises because some members of these structures remain uninitialized, leading to potential instability.
A vulnerability in the Linux kernel's iio gyro driver for the adis16136 sensor allows unprotected debugfs reads. The issue arises because the serial_number file operations do not call debugfs_file_get(), which is required by debugfs_create_file_unsafe(). This causes debugfs_remove_recursive() to not wait for ongoing reads, potentially leading to use-after-free conditions when the device is unbound. The flaw has been fixed by replacing debugfs_create_file_unsafe() with debugfs_create_file().
A NULL pointer dereference vulnerability exists in the Linux kernel's max30102 driver interrupt handler. The interrupt remains enabled for the device's lifetime, but the handler may dereference a NULL active_scan_mask when no buffer is enabled, causing a kernel NULL pointer dereference. The issue is fixed by checking the FIFO sample readiness early in the interrupt handler and returning if no data is available.
A vulnerability in the Linux kernel's iio imu adis16480 driver allowed unprotected debugfs reads due to improper use of debugfs file operations. The issue was that firmware_revision and firmware_date file operations did not call debugfs_file_get(), causing debugfs_remove_recursive() to not wait for ongoing reads before freeing the device, potentially leading to use-after-free conditions. This flaw has been fixed by replacing debugfs_create_file_unsafe() with debugfs_create_file().
A vulnerability in the Linux kernel's iio light driver for the rohm-bu27034 sensor caused an infinite delay when reading the integration time failed. The issue was due to using the error code to compute sleep time, which has been fixed by defaulting to the smallest integration time if reading fails. This flaw affects multiple specific Linux kernel versions used in Ubuntu distributions and is rated with low severity.
A vulnerability in the Linux kernel's iio pressure sensor driver for rohm-bm1390 causes the data reading function to ignore cached error values and always return 0, even when a read operation fails. This issue was resolved by modifying the function to return the cached error value after stopping the measurement, allowing users to detect read failures and avoid using invalid data.
A vulnerability in the Linux kernel's AW96103 proximity sensor firmware parser allows improper validation of firmware data length. This can cause the parser to read beyond the allocated firmware buffer if the firmware image is truncated or malformed, potentially leading to memory corruption. The issue arises from underflow and incorrect length calculations in the firmware header processing.
A vulnerability in the Linux kernel's KVM subsystem for the s390 architecture was fixed by correcting the _gaccess_shadow_fault() function. The issue involved nested guest memory pages that might not be present in the parent guest's gmap, causing erroneous error propagation to userspace. This flaw has been addressed by ensuring proper linking of the nested guest memory when missing.
A vulnerability in the Linux kernel's KVM s390 subsystem was fixed by adding a missing srcu lock in the kvm_s390_set_irq_state() function. This lock is necessary to safely perform the Store status operation, similar to the existing kvm_s390_inject_vcpu() function. The flaw could lead to issues in the kernel's handling of virtual CPU interrupt state.
A high-severity vulnerability in the Linux kernel's KVM s390 subsystem involves improper handling of NULL pointers in the dat_cond_set_storage_key() function. This flaw occurs when some callers pass a NULL oldkey pointer, leading to a potential NULL pointer dereference in page_cond_set_storage_key(). The issue has been fixed by adding a NULL check and assigning a dummy local variable to prevent crashes.
A race condition vulnerability in the Linux kernel's KVM s390 architecture implementation related to storage key functions has been fixed. The flaw involved potential concurrent splitting of large pages causing crashes due to improper handling of storage key operations. The fix involves safer pointer dereferencing and retry logic to avoid race conditions.
A race condition vulnerability in the Linux kernel's KVM s390 architecture implementation was fixed by using READ_ONCE() in the _destroy_pages_crste() function to prevent multiple dereferences of a pointer. This flaw could lead to inconsistent or unsafe memory operations during page destruction.
A vulnerability in the Linux kernel s390/uv subsystem could cause a potential out-of-bounds read when the system stores more than 85 secrets. This occurs because the uv_secret_list struct array holds only up to 85 items per page, but the code incorrectly loops over the overall count rather than the per sub-list count, leading to reading beyond the array bounds. The issue has been fixed by correcting the loop to use the per sub-list count of stored secrets.
CVE-2026-98643 is a medium-severity vulnerability in the Linux kernel's BPF sock_ops program. It involves an out-of-bounds read of the rtt_min field in sock_ops due to improper type checking of the socket structure. This flaw allows reading adjacent kernel memory, potentially leaking kernel pointers. The issue arises because the code reads rtt_min directly without verifying that the socket is a fully locked tcp_sock, unlike other tcp_sock fields that use a guarded accessor. The vulnerability has been fixed by adding the appropriate guard check when reading rtt_min.
A vulnerability in the Linux kernel's KVM implementation for RISC-V was fixed by correcting the update order of nested HFENCE entries. The issue involved writing the Config word before updating Page_Number and Page_Count, which could cause incorrect TLB flush ranges due to stale values being observed by the SBI or NACL hardware. The fix ensures the parameter words are written first and the Config word last, using memory barriers to prevent reordering.