A race condition vulnerability in the Linux kernel's tty port handling was fixed by adding missing serialization to the tty_port_tty_vhangup() and tty_port_hangup() functions. The flaw could cause use-after-free and NULL-pointer dereferences during concurrent hangup operations, potentially leading to kernel instability or crashes.
CVE-2026-98751 is a vulnerability in the Linux kernel's tty subsystem involving a race condition between break signalling ioctls and hangup events. This race can cause calls into a tty driver for a device that may no longer be present or powered down. The issue has been addressed by requiring drivers to handle this race properly and abort break signalling to avoid unsafe callbacks after user-controlled timeouts or device reopenings.
A race condition vulnerability in the Linux kernel's TTY subsystem involving saved termios reset on device registration has been fixed. The issue arises when a minor device number is reused for a different device without properly resetting saved termios state, potentially causing a use-after-free condition. This can prevent the port from opening under certain settings. The fix introduces a new flag to ensure saved termios state is reset only when safe.
A use-after-free vulnerability in the Linux kernel's serial driver for 8250_bcm7271 was fixed. The flaw occurs in the brcmuart_remove() function where a high-resolution timer callback can dereference freed memory due to improper timer cancellation order. This issue was identified by static analysis and affects specific Linux kernel versions.
A clock reference leak vulnerability was identified and fixed in the Linux kernel's ma35d1 serial driver. The issue involved the ma35d1serial_probe() function failing to release clock references obtained via of_clk_get(), leading to resource leaks on error paths and during port removal.
CVE-2026-98745 is a vulnerability in the Linux kernel's arm64/fpsimd signal handling code affecting systems that support SME but not SVE. It occurs when restoring a crafted SVE signal context causes the task to have non-streaming SVE state, which is unsupported by the hardware. This can lead to fatal undefined instruction exceptions (EL1 UNDEF) and kernel panics during state restoration. The flaw arises because the kernel fails to reject signal contexts where the streaming mode flag is clear but an SVE payload is present. The issue has been resolved by correcting the context restoration logic to reject such invalid states.
CVE-2026-98736 is a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem related to enhanced SCO (Synchronous Connection-Oriented) setup. The flaw occurs because the hci_enhanced_setup_sync() function accesses a parent connection object without holding the necessary lock, allowing a race condition where the parent can be freed while still in use. This can lead to a kernel memory corruption detected by KASAN. The issue affects specific Linux kernel versions and has a medium severity rating with a CVSS score of 5.7.
CVE-2026-98735 is a use-after-free vulnerability in the Linux kernel's Bluetooth hci_core component. It arises from improper synchronization when scheduling ACL transmissions and deleting channels, leading to potential memory corruption. The flaw was detected by KASAN and involves race conditions between channel selection and teardown. This vulnerability affects specific Linux kernel versions and has a high severity score.
CVE-2026-98729 is a vulnerability in the Linux kernel affecting x86 memory management on AMD F15h processors. The issue arises because the kernel incorrectly applies virtual address alignment (va_align) to hugetlb mappings, causing address misalignment and triggering a kernel bug during huge page teardown. This affects certain AMD processors such as Carrizo and FX-8370E. The flaw has been resolved by modifying the alignment logic to skip randomization for hugetlbfs mappings.
CVE-2026-98725 is a critical vulnerability in the Linux kernel's nvmet-auth component, specifically in the nvmet_auth_challenge() function. The flaw is an out-of-bounds write caused by incorrect size calculation of the challenge header, leading to memory corruption. This can trigger kernel panics due to KASAN slab-out-of-bounds errors. The issue affects multiple Linux kernel versions and has a high CVSS score of 9.2.
CVE-2026-98715 is a low-severity vulnerability in the Linux kernel's KVM SVM implementation. It involves improper handling of TLB control on a failed VMRUN instruction, which can cause the CPU to skip a required TLB flush. This flaw may lead to unnecessary flushing of all ASIDs on subsequent successful runs, potentially causing performance noise but no direct security compromise. The issue arises from clearing TLB control on failure, which drops the flush operation. The vulnerability affects specific Linux kernel versions listed explicitly. There is no indication of active exploitation or critical impact.
A vulnerability in the Linux kernel's cw1200 WiFi driver allowed out-of-bounds reads during transmission padding, leaking up to 511 bytes of kernel heap data to the device. This occurred because the TX path sent padded data from the frame buffer without reserving space for padding, exposing stale memory. The issue has been fixed by ensuring proper padding allocation and zeroing the padding bytes before transfer. The vulnerability has a low severity score and does not affect the RX path.
CVE-2026-98710 is a low severity vulnerability in the Linux kernel's iwlegacy wifi driver for the 3945 device. The issue involves a memory leak of EEPROM data when the PCI device is removed because the remove path does not free allocated EEPROM memory after a successful probe. This flaw was identified through manual code inspection and affects specific Linux kernel versions.
A vulnerability in the Linux kernel's mac80211 wifi subsystem allowed proxy path management to bypass the mesh path limit, potentially leading to exceeding the maximum allowed mesh paths. This was due to incorrect accounting of proxy paths against the mesh path limit, which could cause the interface path counter to become negative and allow more mesh paths than intended. The issue has been resolved by properly reserving and releasing quota for proxy paths, enforcing a shared 1024-entry budget for mesh and proxy paths.
A race condition in the Linux kernel USB serial driver could cause a NULL-pointer dereference if a device is disconnected during lengthy break signalling. The issue arises because tty ioctls can race with hangup, potentially calling into a tty driver for a device that is no longer present or powered down. This vulnerability has been fixed by serializing callbacks with the tty port mutex and adding checks to ensure the port has not been hung up before accessing driver data or hardware.
A vulnerability in the Linux kernel SMB client was resolved that involved improper discarding of pagecache data when extending a file via clone range. Specifically, the pagecache for folios overlapping the destination region was discarded, but the folio straddling the old EOF was not, potentially exposing stale data beyond the original EOF as file content after extension.
A vulnerability in the Linux kernel's ADE9000 ADC driver caused Phase C dip events to be unreported due to an off-by-one error in scanning event bits. The issue was fixed by adjusting the scanning range to include the highest event bit, ensuring proper handling of Phase C dip events.
A NULL pointer dereference vulnerability exists in the Linux kernel's max30102 driver interrupt handler. The interrupt remains enabled for the device's lifetime, but the handler may dereference a NULL active_scan_mask when no buffer is enabled, causing a kernel NULL pointer dereference. The issue is fixed by checking the FIFO sample readiness early in the interrupt handler and returning if no data is available.
A vulnerability in the Linux kernel's iio pressure sensor driver for rohm-bm1390 causes the data reading function to ignore cached error values and always return 0, even when a read operation fails. This issue was resolved by modifying the function to return the cached error value after stopping the measurement, allowing users to detect read failures and avoid using invalid data.
A vulnerability in the Linux kernel's AW96103 proximity sensor firmware parser allows improper validation of firmware data length. This can cause the parser to read beyond the allocated firmware buffer if the firmware image is truncated or malformed, potentially leading to memory corruption. The issue arises from underflow and incorrect length calculations in the firmware header processing.