A vulnerability in the Linux kernel's KVM SEV implementation involves improper freeing of the 'have_run_cpus' cpumask during virtual machine destruction. This occurs even if the VM is no longer using SEV, such as after intra-host migration. The flaw could lead to use-after-free conditions if the mask is not correctly managed. The issue affects specific versions of the linux-hwe-edge kernel and has been assigned a medium severity rating with a CVSS score of 4.6.
CVE-2026-98470 is a vulnerability in the Linux kernel's KVM arm64 implementation where an unknown VM ioctl in protected mode causes a WARN condition. This occurs because kvm_pkvm_ioctl_allowed() triggers a WARN when kvm_get_cap_for_kvm_ioctl() does not find the ioctl number in vm_ioctl_caps[]. This can lead to a panic on hosts configured with panic_on_warn when userspace issues an ioctl with an unknown number, resulting in a tainted pKVM host.
CVE-2026-98468 addresses a spurious warning in the Linux kernel's KVM arm64 code related to a benign race condition during stage 2 page table teardown. The warning occurs under memory pressure when nested virtualization guests are exited, causing a race between migration notifications and stage 2 page table release. The fix updates the code to no longer treat this race as an error, preventing false warnings while preserving warnings for other conditions.
CVE-2026-98467 is a vulnerability in the Linux kernel's KVM module for arm64 architecture involving a null pointer dereference during nested stage 2 page table unmapping and write-protection operations. The flaw arises from a race condition between concurrent teardown and invalidation operations on nested guest memory management structures, potentially causing a kernel null pointer dereference. This issue has been fixed by adding a check to ensure the page table pointer is non-null before dereferencing during invalidation.
A vulnerability in the Linux kernel scheduler was fixed by correctly deriving the SCX_RQ_IN_WAKEUP flag from core enqueue flags. The flaw caused deferred scheduling actions to be skipped improperly, potentially leading to stale requests referencing freed memory after the scheduler is disabled. This issue affects specific Linux kernel versions and has been resolved.
A vulnerability in the Linux kernel's Bluetooth subsystem related to connection ownership handling in the hci_conn component has been fixed. The issue involved improper management of connection holds during CIS (Connected Isochronous Stream) reuse, which could lead to inconsistent connection states. The fix ensures that connection holds are correctly taken and dropped to maintain proper ownership and state consistency.
A vulnerability in the Linux kernel Bluetooth subsystem (hci_sock) allows an out-of-bounds read due to improper validation of event length before filtering. The flaw occurs because the code reads event data without confirming the event buffer is sufficiently long, potentially leading to memory access errors when processing malformed Bluetooth events.
A vulnerability in the Linux kernel Bluetooth subsystem (hci_sock) allows an unprivileged socket to submit out-of-range OCF values that alias allowlisted commands due to improper masking. This could cause the security filter to incorrectly allow commands that should be rejected. The issue has been resolved by rejecting OCF values that cannot be represented by the security filter instead of aliasing them onto unrelated commands.
CVE-2026-98459 is a high-severity vulnerability in the Linux kernel's Bluetooth ISO subsystem. It involves improper reference counting in the hci_bind_bis() function, which can lead to premature disconnection of a Bluetooth socket while still in use. This flaw has been resolved by ensuring proper hold management on the parent connection before linking. The vulnerability affects specific Linux kernel versions used in various Ubuntu releases.
A medium-severity vulnerability in the Linux kernel Bluetooth ISO layer involves improper release of unused CIS holds after channel attachment. The flaw occurs when iso_chan_add() returns success or -EBUSY without creating a new association, leaving a hold unused. This can lead to resource mismanagement in the ISO connection handling.
A vulnerability in the Linux kernel Bluetooth L2CAP implementation allows out-of-bounds reads due to improper validation of frame length before accessing control and FCS fields. This flaw affects certain Linux kernel versions and can lead to memory access errors when processing short ERTM or streaming-mode frames.
CVE-2026-98455 is a medium severity vulnerability in the Linux kernel's Bluetooth RFCOMM implementation. It involves a NULL pointer dereference in the RFCOMM_CONNINFO getsockopt handler when deferred setup is enabled and a socket is not properly connected. This occurs because the session pointer can be cleared while the deferred setup flag remains set, leading to an unconditional dereference of a NULL session pointer. The flaw can cause a kernel crash (general protection fault) when getsockopt is called on the affected socket after a disconnect (DISC) event. The issue affects specific Linux kernel versions listed and was reproduced under QEMU with KASAN enabled.
A vulnerability in the Linux kernel SMB client handling causes a server-side handle to remain open after a create-context parsing failure in SMB2_open(). This occurs because the handle is not closed when malformed context data is rejected, leading to resource leakage and an elevated count of remote opens. The issue has been resolved by ensuring the handle is closed on error paths after parsing failures.
A vulnerability in the Linux kernel SMB client related to handling cached directory opens has been resolved. The issue involves improper cleanup of failed cached directory opens where the CREATE request succeeds but subsequent commands fail, potentially causing resource management errors. The fix ensures proper validation of CREATE responses, correct handling of file identifiers (FIDs), and improved reconnect handling to avoid hidden errors.
A vulnerability in the Linux kernel SMB client causes improper handling of compound wait errors during remote file operations. Specifically, if a later wait is interrupted or fails, an earlier remote file create operation may leave a handle open without proper cancellation, potentially causing resource leaks. The issue has been resolved by marking earlier operations as cancelled when synchronization aborts and ensuring proper cleanup of remote handles.
A vulnerability in the Linux kernel's SMB client handling causes improper management of compound request message IDs (mids) on send failure. This leads to double decrementing of in-flight credits and kernel warnings during SMB2 negotiation when socket send fails.
A vulnerability in the Linux kernel's XFS filesystem was fixed where a reference to the orphanage directory inode was leaked if the chown operation failed. This flaw could lead to resource leakage but has been resolved.
CVE-2026-98447 is a vulnerability in the Linux kernel's XFS filesystem code where an incorrect memcpy operation during the formatting of ondisk rtrefcount btree roots causes memory corruption. The issue arises because the inode btree root formatting methods copy more bytes than necessary, leading to overwriting memory beyond intended buffers. This flaw has been addressed in specific Linux kernel versions.
CVE-2026-98446 is a high-severity vulnerability in the Linux kernel's XFS filesystem code. It involves an integer underflow in the xfs_metafile_resv_init function where the hidden_space variable can become negative, leading to incorrect space accounting. This flaw occurs when the reserved fdblocks for a metadata btree file are less than the space already used, causing an underflow and potentially large incorrect space subtraction. The issue has been fixed by correcting the logic that adjusts available blocks and fixing related comments.
A vulnerability in the Linux kernel's XFS filesystem code allows memory allocation failures in the function xrep_newbt_add_blocks to cause block leaks and disrupt filesystem repairs. The issue arises because the code cannot both undo transactions and return errors properly, leading to filesystem instability during repair operations. The fix involves changing the allocation to a NOFAIL type, preventing the problem.