A low-severity vulnerability in the Linux kernel's NTFS3 filesystem driver involves improper inode instantiation during directory creation. The issue arises from using d_instantiate() instead of d_instantiate_new() in ntfs_create_inode(), leading to a race condition where inode locks become corrupted. This can cause warnings related to lock underflow and potentially hang inode_lock() calls during concurrent mount operations. The flaw has been addressed by switching to d_instantiate_new() and removing the trailing unlock_new_inode() call.
CVE-2026-98538 is a medium severity vulnerability in the Linux kernel's writeback subsystem. It involves the cleanup_offline_cgwb() function rescanning inodes inefficiently, causing a quadratic time complexity in draining inodes on a dying writeback context. This can lead to soft lockups with CPUs stuck for extended periods when many inodes are attached. The issue is resolved by changing the scanning order to make the drain operation linear in time.
CVE-2026-98537 is a vulnerability in the Linux kernel workqueue subsystem where a NULL pointer dereference occurs during a flush dependency check. This happens because the code dereferences worker->current_pwq without verifying that it is non-NULL, which can occur when a kworker thread is not executing a work item. The issue has been fixed by adding a guard to ensure worker->current_pwq is valid before dereferencing. The vulnerability affects specific Linux Azure kernel versions and has a medium severity rating with a CVSS score of 5.7.
CVE-2026-98536 is a vulnerability in the Linux kernel's writeback subsystem related to reporting Tasks-RCU quiescent states during cgroup writeback (cgwb) drain passes. On certain kernel configurations with preemption enabled, the drain loop fails to report quiescent states properly, causing long-running drain operations that can lead to system hangs and kernel panics. This issue affects specific Linux kernel versions and has been fixed by ensuring proper quiescent state reporting during the drain loop.
A clock reference leak vulnerability in the Linux kernel's fsl/fman component was fixed. The issue occurred because the read_dts_node() function called clk_get() to obtain a clock reference but did not call clk_put() to release it, causing a reference count leak. This fix ensures the clock reference is released after reading its rate, including error paths.
A use-after-free vulnerability in the Linux kernel's ipe component was fixed. The flaw occurred when auditing a newly loaded policy, where a concurrent delete could free the policy while it was still in use, potentially leading to memory corruption. The issue was resolved by auditing the policy load under the appropriate lock to prevent concurrent access.
A vulnerability in the Linux kernel's dm-verity implementation was addressed by protecting the root hash with Read-Copy-Update (RCU) synchronization. The issue involved the function ipe_bdev_setintegrity() freeing the old root hash while it could still be dereferenced during policy evaluation, potentially leading to use-after-free conditions. The fix ensures that the root hash is protected with RCU, aligning with the existing evaluation path that runs under rcu_read_lock().
A vulnerability in the Linux kernel's IPv6 Segment Routing (SR) implementation allows an out-of-bounds read of uninitialized kernel memory due to improper validation of the SEG6_ATTR_DST attribute length. This can lead to leakage of 16 bytes of kernel heap memory to userspace. The issue arises because the attribute length is only checked for maximum length, permitting shorter lengths that cause the out-of-bounds read. The vulnerability is fixed by enforcing exact attribute length validation.
A Linux kernel vulnerability in kprobes causes a permanent hang when flushing the kprobe optimizer by writing 0 to /proc/sys/debug/kprobes-optimization. This results in a process sleeping indefinitely in an uninterruptible state (D state) while holding a mutex, causing subsequent reads or writes to the sysctl to hang as well. The issue arises from improper synchronization and completion handling during optimizer flushing, leading to deadlock conditions.
CVE-2026-98523 is a vulnerability in the Linux kernel's Direct Rendering Manager (DRM) client code. It involves a NULL pointer dereference triggered when closing a DRM file descriptor if a partially initialized framebuffer device client remains registered. This occurs because the restore function attempts to restore state unconditionally, even when initialization failed, leading to access of uninitialized memory and a kernel warning followed by a crash.
A low-severity vulnerability in the Linux kernel's nouveau DRM driver causes a runtime power management (PM) reference leak in the nouveau_connector_detect() function. If nvif_outp_edid_get() fails, the function returns early without releasing the runtime PM reference, causing the device to remain powered on unnecessarily until the next successful detection. This issue has been fixed by balancing the PM reference on the error path.
CVE-2026-98503 is a vulnerability in the Linux kernel's packet TX_RING handling where improper management of skb destructors and zero-copy completion can cause ring slots to be reused prematurely. This flaw could lead to inconsistent state and missing packet timestamps during transmission. The issue has been resolved by switching to standard zero-copy completion and improving reference management to ensure slots are only released after all references are freed or copied.
CVE-2026-98493 is a vulnerability in the Linux kernel's DHCP option construction code. The function ic_dhcp_init_options() appends DHCP options including hostname (option 12), vendor-class (option 60), and client-ID (option 61) into a fixed 312-byte buffer without properly checking bounds for hostname and vendor-class options. This can cause a buffer overflow when large hostname and vendor-class values are used, potentially leading to a kernel panic if CONFIG_FORTIFY_SOURCE is enabled and panic_on_warn=1 is set. The issue is addressed by routing options through a helper that ensures buffer limits are respected, dropping options that would overflow the buffer. Configurations with short options remain unaffected.
CVE-2026-98543 is a vulnerability in the Linux kernel related to BPF LSM programs and inode locking assumptions in the path_unlink and path_rmdir hooks. The issue arises because these hooks run before the victim inode's i_rwsem lock is taken, allowing a sleepable BPF LSM program to mutate extended attributes (xattrs) without holding the required lock. The fix involves dropping these hooks from the d_inode_locked_hooks list so that the verifier uses locking variants of BPF functions that take the lock themselves.
CVE-2026-98532 is a high severity vulnerability in the Linux kernel's IPv6 implementation where the function ipv6_find_hdr() can return an offset beyond the end of a packet. This flaw allows out-of-bounds memory access when the Open vSwitch component uses this offset as the transport header, leading to a use-after-free error and potential kernel memory corruption.
CVE-2026-98512 is a use-after-free vulnerability in the Linux kernel's drm/nouveau driver scheduler. The flaw arises because the nouveau_sched object is freed with kfree() instead of kfree_rcu(), leading to a race condition where userspace can access freed memory via sync_file interfaces. This can cause a kernel memory corruption and potential denial of service. The vulnerability affects specific Linux kernel versions including several 4.15.x, 5.0.x, and 5.3.x builds.
A use-after-free vulnerability was identified and fixed in the Linux kernel's NFC subsystem, specifically in the nfc_get_local_general_bytes function. The issue arose from improper reference counting and memory management, which could lead to accessing freed memory. The fix involved refactoring the functions to use caller-provided buffers, ensuring safe memory handling without ownership transfer issues. Multiple NFC drivers were updated accordingly.
A NULL pointer dereference vulnerability was identified and fixed in the Linux kernel's s390/cio subsystem. The issue occurs when the channel path registry entry associated with a CHPID is removed while the subchannel's PMCW still references that CHPID, causing a function to return NULL and leading to a NULL pointer dereference. This was addressed by adding a missing NULL check before dereferencing the pointer.
A vulnerability in the Linux kernel s390/cmf subsystem involved confusion between virtual and physical addresses when storing extended format channel measurement data. The issue affected kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE=y, causing firmware to use incorrect addresses. This has been fixed by defining certain fields as dma64_t and adding the missing virt_to_dma64() translation to ensure correct address usage.
A vulnerability in the Linux kernel's s390/pci subsystem was fixed by adding a missing device lock in the zpci_report_status() function. The issue involved accessing the device's driver without holding the necessary device lock when pdev was non-NULL, potentially leading to inconsistent device state during recovery. The fix expands the device lock critical section and adds a lockdep assertion to ensure proper locking.