CVE-2026-98818 is a Linux kernel vulnerability involving a deadlock risk in the memory management slab allocator. The issue arises because kfree_rcu() can be called while holding pi_lock, a raw spinlock, and it should not allocate memory with __GFP_KSWAPD_RECLAIM since waking up kswapd under pi_lock leads to a circular locking dependency and deadlock. This deadlock was confirmed using a modified kernel with lockdep instrumentation. The vulnerability affects specific Linux kernel versions including several 4.15.x, 5.0.x, and 5.3.x releases.
A use-after-free vulnerability in the Linux kernel NVMe driver was fixed related to the character device (cdev) lifetime management. The issue occurs in multipath mode when the namespace head is torn down, causing open cdev file operations to reference freed memory, leading to a kernel crash detected by KASAN. This flaw allows referencing a freed nvme_ns_head structure after its reference count drops to zero.
A slab-out-of-bounds vulnerability in the Linux kernel's mlx5 driver was fixed. The issue occurred when handling team device events, where bonding-specific APIs were incorrectly called on team_port structures, causing out-of-bounds memory access detected by KASAN. The fix adds checks to ensure bonding-specific functions are only called for bonding devices, preventing memory errors during event processing.
A critical vulnerability in the Linux kernel's TIPC subsystem allows reuse of AES-GCM nonces when peer keys change, breaking confidentiality and enabling trivial forgeries. The flaw arises because the nonce counter resets on peer key changes while the transmit key remains the same, causing nonce reuse. This issue has been fixed by changing the nonce counter to use the transmit key's atomic counter, preventing reuse across peer key changes without altering the nonce format or receiver compatibility.
A vulnerability in the Linux kernel's sparx5 network driver causes a NULL pointer dereference during driver unbinding if the Precision Time Protocol (PTP) initialization was skipped. This occurs because sparx5_ptp_init() returns early without setting up PTP when certain features or interrupts are absent, but sparx5_ptp_deinit() does not check for this condition before cleanup. The issue has been fixed by adding an early return in sparx5_ptp_deinit() when PTP is not used.
CVE-2026-98791 is a vulnerability in the Linux kernel's net/mlx5e driver related to AF_XDP TX timestamp teardown. During teardown of the XSK TX queue, outstanding descriptors are completed without a completion queue entry (CQE). If a TX timestamp was requested, the code dereferences a NULL CQE pointer, causing a NULL pointer dereference. The issue has been fixed by returning zero when no CQE is available, preventing the NULL dereference.
CVE-2026-98789 addresses a memory management issue in the Linux kernel's BPF subsystem where objects can become stuck in the free_by_rcu_ttrace list due to improper handling of RCU callbacks. This can cause unbounded accumulation of such objects, potentially impacting system resource management. The vulnerability affects specific Linux kernel versions and has a medium severity rating with a CVSS score of 5.6.
A vulnerability in the Linux kernel's AMD display driver occurs when dc_state_create_copy() returns NULL due to allocation failure. The dm_suspend() function does not properly handle this NULL return and continues execution, leading to a NULL pointer dereference in dm_resume() during GPU reset recovery, which can cause a system crash. The issue is fixed by returning an error immediately if the copy fails, preventing the suspend operation from leaving a NULL cached state for resume.
A use-after-free vulnerability exists in the Linux kernel's nitro_enclaves component triggered on SLOT_ALLOC failure in the ne_create_vm_ioctl() function. The error path improperly handles the freeing of ne_enclave, causing ne_enclave_release() to dereference a freed object, leading to a KASAN slab-use-after-free error. The issue is fixed by clearing enclave_file->private_data before fput() on the error path, preventing the unsafe dereference. Normal enclave operations are unaffected by this fix.
CVE-2026-98773 is a use-after-free vulnerability in the Linux kernel's USB cdc-acm driver. It occurs when the acm_port_shutdown() function restarts USB Request Blocks (URBs) after the device has been disconnected, leading to access of freed DMA memory. The flaw is fixed by adding a check to prevent URB resubmission during disconnect. This vulnerability affects specific Linux kernel versions and has a medium severity rating with a CVSS score of 5.4.
A vulnerability in the Linux kernel's usb storage driver for Sierra MS devices allows a malicious USB device to leak up to 5 bytes of stale kernel heap memory to unprivileged userspace via a short IN transfer in the GetSwocInfo request. This occurs because the driver does not properly reject short transfers, leaving uninitialized memory exposed through a world-readable sysfs attribute. The issue affects specific Linux kernel versions and has a low severity rating.
A vulnerability in the Linux kernel's dummy-hcd USB gadget driver could allow a gadget driver's unbind routine to run before all outstanding request completions have finished. This flaw arises because the driver does not properly track request completion callbacks, potentially permitting the gadget driver's module to be unloaded while a completion handler is still running. The issue has been fixed by adjusting the callback usage counter to include request completion callbacks.
A vulnerability in the Linux kernel's USB Type-C driver (tipd) was fixed by zero-initializing the typec_partner_desc structure in the tps6598x_connect() function. Previously, some fields were left uninitialized, potentially leading to garbage function pointers being invoked and leakage of stack data via sysfs.
A vulnerability in the Linux kernel's USB Type-C driver (tipd) was fixed by zero-initializing the typec_partner_desc structure in the cd321x_update_work() function. Previously, uninitialized fields could lead to garbage function pointers being invoked and potential leakage of stack data via sysfs. This issue affects specific Linux kernel versions and has a medium severity rating.
A use-after-free vulnerability in the Linux kernel's USB Type-C UCSI glink driver was fixed. The issue involved work items running after the UCSI instance was unregistered, causing access to freed memory. This was addressed by disabling work items before unregistering and ensuring the instance is only unregistered if still registered. The flaw was found via static analysis and affects specific Linux kernel versions.
A use-after-free vulnerability in the Linux kernel's cdns3 USB gadget driver was fixed. The issue occurs because cdns3_gadget_exit() does not wait for deferred work handlers to complete before freeing resources, potentially allowing use of freed memory. This flaw was identified by static analysis and affects specific Linux kernel versions.
A NULL pointer dereference vulnerability exists in the Linux kernel's usb: cdns3 driver during the PCI probe process. This occurs when the second function of the Cadence USBSS controller is probed before the first function has set its driver data, leading to a kernel crash. The issue is resolved by deferring the probe until the first function completes its initialization.
A vulnerability in the Linux kernel's tty vcc component involved a control packet structure that was not fully zero-initialized before being sent, potentially leaking kernel stack data to a peer. This issue has been resolved by ensuring the control packet is zero-initialized prior to use.
CVE-2026-98754 is a use-after-free vulnerability in the Linux kernel's tty vcc driver. The issue occurs because vcc_cleanup() clears the tty pointer without holding the required port lock, leading to a race condition with callbacks that access the tty pointer under the lock. This can cause a callback to dereference a freed tty port, potentially leading to memory corruption or system instability.
CVE-2026-98753 is a vulnerability in the Linux kernel's tty subsystem where the TTY_IO_ERROR flag is not restored on activation failure. This flaw can lead to kernel panics or NULL-pointer dereferences when accessing powered down or deregistered TTY ports due to race conditions between ioctl calls and port hangups. The issue occurs because the flag is only reset during tty_port_close(), leaving a window where drivers may mishandle ioctl-hangup races.