A vulnerability in the Linux kernel's XFS filesystem code was fixed where the dquot flush lock was not properly released if the associated buffer could not be found. This could lead to a lock being held indefinitely, potentially affecting system stability. The issue was identified and resolved by ensuring the lock is dropped even when no buffer is available.
A use-after-free (UAF) vulnerability in the Linux kernel's openvswitch conntrack helper due to improper handling of extension reallocations has been fixed. The issue arises when a raw pointer to the extensions area is stored in an expectations list before all extensions are added, leading to invalid pointer dereferences during expectation removal. The fix ensures helpers are called only after all extensions are added.
CVE-2026-98487 is a use-after-free vulnerability in the Linux kernel's network bridge multicast database (mdb) handling. The flaw occurs because the function br_mdb_flush_pgs() maintains a pointer-to-pointer cursor while iterating over port groups, but deletions performed by br_multicast_del_pg() can cause the cursor to reference freed memory. This leads to a kernel slab-use-after-free error when the stale pointer is dereferenced during an RTM_GETMDB operation. The issue has been addressed by resetting the cursor after each deletion to avoid stale references.
A vulnerability in the Linux kernel's netfilter ip6t_rt module allows an out-of-bounds read when processing IPv6 routing addresses with zero address count in non-strict match mode. This flaw can cause kernel panics or memory corruption due to reading beyond allocated structures. The issue is fixed by rejecting invalid rules and correcting loop termination logic.
A vulnerability in the Linux kernel's SCSI libiscsi_tcp component allows improper handling of Data-In PDUs. The flaw causes the kernel to copy target-supplied data into the initiator's memory buffers without verifying the data direction, potentially overwriting data intended for write operations. This can lead to data corruption where the initiator's buffer contains unexpected target data after a write operation completes.
A vulnerability in the Linux kernel's KVM SEV implementation involves improper cache maintenance on the source VM during intra-host migration. The issue arises because the source VM is converted to a non-SEV VM, and KVM's memory reclaim processes do not trigger necessary cache maintenance, potentially leaving stale data in CPU caches after the VM is destroyed. This could lead to integrity issues during VM migration. The vulnerability affects specific Linux kernel versions used in various Ubuntu releases.
A vulnerability in the Linux kernel's KVM subsystem for arm64 architecture involving incorrect handling of the AArch32 DBGBXVR<n> register has been fixed. The issue caused the VM to be marked dead when an AArch32 guest accessed DBGBXVR<n> due to improper mapping of Op2 values in debug register accessors. This flaw has been resolved by restoring correct mapping behavior.
A high-severity vulnerability in the Linux kernel's KVM module for arm64 architecture involves improper handling of hyp stack pages in the host stage-2 memory management. The fix addresses an issue where the hyp stack pages were not properly walked and transferred out of the host stage-2, potentially leading to serious security impacts.
A vulnerability in the Linux kernel's RISC-V KVM implementation allows race conditions during IMSIC attribute access with vCPU migration. This can cause stale interrupt file references to be accessed, potentially leading to incorrect interrupt handling and denial of service. The issue is fixed by serializing IMSIC attribute operations with the target vCPU mutex to prevent concurrent migration and access conflicts.
CVE-2026-98464 is a critical vulnerability in the Linux kernel's RISC-V KVM implementation involving improper synchronization of hrtimer callbacks during vCPU teardown. This race condition can lead to use-after-free errors where a vCPU is freed while a timer callback is still running, potentially causing system crashes or arbitrary code execution. The issue arises when the teardown process observes the timer as not set and skips cancellation, allowing the vCPU to be destroyed prematurely. The vulnerability affects specific Linux kernel versions and has a high CVSS score of 9.3.
A race condition vulnerability in the Linux kernel Bluetooth management code (read_unconf_index_list()) can cause an out-of-bounds write due to improper synchronization of device flags during asynchronous controller setup. This flaw affects specific linux-aws kernel versions and has been resolved by allocating response space for every device on the hci_dev_list to prevent buffer overflows.
CVE-2026-98454 is a high-severity vulnerability in the Linux kernel's SMB client implementation. It involves out-of-bounds reads in the create context parsing logic, where malformed create-context chains can expose unintended memory areas. The flaw arises because the parser does not properly limit each context record to its declared size before dispatching handlers, leading to potential information exposure. The vulnerability affects specific Linux kernel versions and has been addressed by validating context boundaries and rejecting malformed chains.
A high-severity vulnerability in the Linux kernel's SMB client handling allows improper management of non-regular inodes such as symlinks during file creation operations. This can lead to resource leaks and improper inode handling, potentially impacting system stability and security.
CVE-2026-98443 is a high-severity vulnerability in the Linux kernel's XFS filesystem code related to improper cursor and pointer handling during recovery of iunlink buckets. The flaw involves use-after-free and memory leak issues caused by not nulling pointers after release and incorrect handling of inode unlinking pointers, which can create loops in the unlinked inode list. These bugs were fixed to prevent potential corruption or denial of service during inode recovery.
CVE-2026-98442 is a use-after-free (UAF) vulnerability in the Linux kernel's net/sched subsystem, specifically in the act_ct helper. The issue arises because a raw pointer to the extensions area is stored in an expectations list before all extensions are fully added, and subsequent reallocations can invalidate this pointer. This can lead to invalid memory access when the expectation is later removed. The vulnerability has been fixed by ensuring helpers are called only after all extensions are added.
CVE-2026-98441 is a high-severity vulnerability in the Linux kernel's net/sched act_ct module. It involves improper handling of shared unconfirmed connection tracking (ct) entries when skb packets are cloned. This can lead to use-after-free (UAF) conditions due to modification of shared unconfirmed ct entries, potentially causing system crashes or other impacts. The issue arises when multiple clones of an skb with an unconfirmed ct entry are processed with different extension sets, breaking pointers in the expectation list. The vulnerability affects specific Linux kernel versions and has been addressed by resetting the ct entry to avoid unsafe sharing and modification.
A vulnerability in the Linux kernel's KVM module for arm64 architecture involves improper timing of freeing shadow Stage 2 (S2) structures. The issue arises because these structures are freed prematurely from kvm_arch_flush_shadow_all(), which can lead to use-after-free conditions. The fix delays freeing these shadow S2 structures until the virtual machine (VM) is fully destroyed, ensuring safe cleanup after all virtual CPUs have been terminated.
A high-severity vulnerability in the Linux kernel's SMB server component allows asynchronous requests to remain active when a connection is closed, potentially preventing the connection from closing properly. The issue is resolved by canceling active asynchronous requests before waiting for their completion.
A vulnerability in the Linux kernel's Qualcomm iris media driver caused runtime power management (PM) reference leaks. The issue was fixed by ensuring proper use of pm_runtime_resume_and_get() and always calling pm_runtime_put_sync() to maintain balanced runtime PM references.
A vulnerability in the Linux kernel's EDAC/altera driver was addressed by changing the device resource management in the altr_portb_setup() function to use the parent device for devres operations. This ensures proper anchoring of resource groups and IRQ requests to the long-lived parent device, preventing resource management inconsistencies.