A vulnerability in the Linux kernel's KVM arm64 implementation involves improper validation of the Scalable Vector Extension (SVE) vector length in the pkvm_vcpu_init_sve() function. The function only clamps the upper bound of the host-provided vector length, allowing an invalid length to reach a fatal WARN_ON() condition at EL2. The fix involves validating the vector length before deriving the state size to prevent this fatal error.
A vulnerability in the Linux kernel KVM arm64 implementation involves improper handling of the Scalable Vector Extension (SVE) feature flag during vCPU initialization failure. Specifically, when pkvm_vcpu_init_sve() fails, it clears the KVM_ARM_VCPU_SVE flag but leaves KVM_ARCH_FLAG_GUEST_HAS_SVE set, causing subsequent vCPUs to skip proper SVE setup and register with a NULL sve_state. This can lead to errors when the guest performs its first floating-point access.
A vulnerability in the Linux kernel's SquashFS implementation allows a shift-out-of-bounds error when mounting an abnormal SquashFS image with a COMP_OPTS flag set to 1 but a dictionary size of 0. This occurs because the code performs a shift operation with an exponent of -1, which is invalid. The issue has been fixed by adding a dictionary size range check before the shift operation.
A vulnerability in the Linux kernel's SCSI block subsystem allows an out-of-bounds write in the zone report handling code. This occurs because the zones_cond array is sized based on disk capacity and zone size, but the index used to write into this array is not properly checked against its size. Disks reporting more zones than the array can hold, especially those exceeding 32-bit zone counts, can cause memory corruption. The issue is fixed by validating the index before writing and refusing to revalidate if the zone count exceeds 32 bits.
A vulnerability in the Linux kernel's SCSI zoned block device (sd_zbc) handling allows disks reporting an excessively high number of zones to cause inconsistent zone bookkeeping. This occurs because the kernel truncates the 64-bit zone count to a 32-bit unsigned int, and uses a signed int for indexing, which can overflow. The kernel now rejects devices reporting more zones than the maximum signed int value at scan time.
A vulnerability in the Linux kernel Bluetooth driver btnxpuart causes a socket buffer (skb) memory leak when CONFIG_DEV_COREDUMP is disabled. This occurs because hci_devcd_append() returns an error without freeing the skb, preventing recovery functions from executing. The issue has been fixed by conditioning the call to hci_devcd_append() on the CONFIG_DEV_COREDUMP setting.
CVE-2026-98632 is a use-after-free vulnerability in the Bluetooth mesh management code of the Linux kernel. It occurs when a mesh transmission is canceled but a queued entry still holds a pointer to the freed transmission object, leading to unsafe memory access. This flaw has been fixed by properly dequeuing pending entries before freeing them and ensuring the transmission queue advances correctly after cancellation or errors.
CVE-2026-98631 is a vulnerability in the Linux kernel's xsk_map_gen_lookup function where a 32-bit compare was not properly used, leading to an out-of-range index that can cause a read past the bounds of the xsk_map array. This occurs because BPF_JMP_IMM sign-extends immediates to 64 bits, causing incorrect bounds checking for large max_entries values. The issue has been resolved by switching to a 32-bit unsigned comparison using BPF_JMP32_IMM.
A vulnerability in the Linux kernel's fbnic Ethernet driver was fixed to correct improper cleanup of the payload page pool on allocation failure. The issue involved passing an error pointer to page_pool_destroy() instead of properly destroying the header page pool, potentially causing a dereference of an error pointer and leaving resources allocated.
CVE-2026-98629 is a vulnerability in the Linux kernel's net/sched cls_u32 subsystem where manual hash tables created with explicit handles can cause IDR aliasing. This leads to unreachable IDR entries on deletion, causing permanent resource leaks and potential misrouting of lookups to incorrect tables. The issue arises because manual tables key their IDR entries differently from the destroy paths, causing conflicts in handle management. The vulnerability has been fixed by aligning allocation and removal key domains and rejecting manual handles that alias existing IDs.
A use-after-loop vulnerability in the Linux kernel's drm/nouveau/clk component was fixed. The issue occurs in the nvkm_clk_ustate_update function where a list cursor is used after the loop if no matching entry is found, leading to an out-of-bounds read. This can be triggered from userspace by requesting an invalid pstate id via the 'pstate' debugfs file. The fix introduces a 'found' variable to ensure proper validation of the pstate pointer.
CVE-2026-98613 is a vulnerability in the Linux kernel's BPF subsystem related to unbounded ownership depth through local kernel pointers (kptrs) and graph roots. This flaw allows program-allocated objects to form arbitrarily deep chains via self-referential local kptr types, which can exhaust the kernel stack during object destruction. The vulnerability arises from insufficient checks on ownership depth and cycles in BPF Type Format (BTF) records, potentially leading to kernel stack exhaustion. The issue has been addressed by bounding ownership walks to a maximum depth of eight record-bearing types and updating validation logic accordingly.
A vulnerability in the Linux kernel's ovpn module involves improper handling of stale local source addresses during UDP output fallback. The issue arises because the bind structure is modified in place while being concurrently accessed, potentially causing torn IPv6 address reads. The fix replaces in-place modification with a safer approach that retries route lookups and publishes a replacement bind with a wildcard local address to avoid cache inconsistencies. This vulnerability affects specific Linux kernel versions and has been addressed in those releases.
CVE-2026-98594 is a low severity vulnerability in the Linux kernel's tg3 driver where PHYLIB resources are not properly cleaned up on probe failure. This can lead to resource leaks due to incomplete teardown of MDIO bus and PHY connections when tg3_init_one() fails. The issue was found during static analysis and fixed by ensuring proper disconnection and unregistration of PHYLIB resources in error paths.
A NULL pointer dereference vulnerability in the Linux kernel's s390/debug subsystem was fixed in debug_info_copy(). The flaw occurs when debug_register_static() fails and clears certain data structures but leaves area bounds unchanged, leading to dereferencing NULL pointers during copy operations. This issue affects specific Linux kernel versions and has been resolved by skipping the copy loop when no valid areas exist.
A vulnerability in the Linux kernel NFC driver (nfcmrvl) allows improper validation of helper command length before processing. This flaw occurs because the firmware download receive path removes the NCI data header and reads the helper command before verifying the remaining packet length, potentially allowing malformed short frames to be accessed before rejection. The issue has been resolved by validating the complete helper command length prior to stripping the NCI data header.
A low severity vulnerability in the Linux kernel's NFC subsystem (st21nfca driver) involves improper validation of the ISO15693 inventory length. The vulnerability occurs because the code removes a two-byte prefix without verifying its presence and accepts a one-byte remainder before reading data as the DSFID. This could lead to incorrect processing of NFC data. The issue has been resolved by requiring the prefix and at least two remaining bytes before copying UID data and reading the DSFID.
A vulnerability in the Linux kernel NFC driver for pn533 (CVE-2026-98575) allows an out-of-bounds (OOB) read due to improper validation of the datalen field in the pn533_acr122_is_rx_frame_valid() function. This occurs because the datalen value is used unchecked as an index into a data buffer, potentially causing the driver to read beyond the buffer limits. The issue is fixed by bounding datalen against the maximum ACR122 frame size and improving validation checks.
A vulnerability in the Linux kernel's IPv6 packet processing code allows an integer underflow in skb_checksum_setup_ipv6() due to improper bounds checking. This flaw can cause a negative length to be passed to skb_copy_bits(), potentially leading to an out-of-bounds memory copy. The issue occurs when parsing IPv6 extension headers if the skb linear area is larger than MAX_IPV6_HDR_LEN. The vulnerability has been fixed by correcting the pull-bound calculation to prevent negative deltas.
A vulnerability in the Linux kernel's BPF implementation on MIPS32 architectures was fixed. The issue involved an incorrect instruction emitted for immediate JMP JEQ/JNE operations, causing invalid comparison results when the immediate operand was negative. This flaw affected constant blinding by misinterpreting the immediate value as a register. The problem was identified using test_bpf on MIPS32r1 emulated by QEMU and has been resolved.