A race condition in the Linux kernel's memory management subsystem (anon_vma handling) on arm64 servers can cause a deadlock or hung task due to a missing memory barrier between anon_vma initialization and publication. This leads to use-after-free of anon_vma->root, causing inconsistent locking states and potential indefinite blocking of tasks.
A vulnerability in the Linux kernel's nouveau DRM driver was resolved that involved incorrect handling of pin counts when a re-pin operation failed. Specifically, the function nouveau_bo_pin_locked() would increment the pin count even when the re-pin failed due to incompatible memory domains, leading to a mismatch in pin/unpin operations and triggering warnings in the kernel. This issue was discovered through fuzz testing and could cause kernel warnings related to resource management.
A vulnerability in the Linux kernel's memory management subsystem related to huge page table entry (PTE) updates has been resolved. The issue involves the damon_hugetlb_mkold() function, which updates page table entries without properly handling concurrent hardware-driven updates, potentially causing loss of hardware-updated bits such as dirty bits. The fix avoids parallel updates by clearing the page table entry atomically during read operations. Since hugetlbfs is an in-memory filesystem and huge pages cannot be reclaimed, no critical impact is expected. The vulnerability was discovered by Sashiko and has been addressed in the Linux kernel.
A race condition vulnerability in the Linux kernel's drm/xe virtual memory management was resolved. The issue involved premature destruction of page tables (PTs) before contested VMAs (virtual memory areas) were unlinked, leading to a NULL pointer dereference when concurrent threads accessed shared buffer objects. This could cause kernel crashes due to dereferencing a NULL pointer in xe_pt_zap_ptes(). The fix defers destruction of PTs until after all contested VMAs are safely unlinked and destroyed.
A vulnerability in the Linux kernel's memory management subsystem related to huge pages has been resolved. The issue involves the function dissolve_free_hugetlb_folio() not properly checking for gigantic pages without runtime support, leading to improper freeing of memory folios and potential corruption of the free list during rollback operations.
A vulnerability in the Linux kernel's NFC driver for the trf7970a device was resolved. The issue occurs when the trf7970a_startup() function powers up the device before applying an optional RX gain reduction. If a register read or write fails, the function returns without powering down the device, leaving the device in an unintended powered-on state. This can cause unbalanced power references and improper device state management. The fix ensures that trf7970a_power_down() is called on error to properly deassert enable GPIOs and restore the powered-off state. The vulnerability was found during static analysis of kernel code.
A use-after-free vulnerability in the Linux kernel's NFC subsystem was resolved by refactoring functions to safely copy data into caller-provided buffers before releasing references. The issue involved improper lifetime management of a local pointer leading to potential use-after-free conditions.
A vulnerability in the Linux kernel's XFS filesystem was resolved involving a resource leak when changing ownership (chown) of the orphanage directory inode fails. The issue caused the kernel to leak a grabbed reference to the orphanage directory inode, potentially leading to resource management problems.
A vulnerability in the Linux kernel's Bluetooth subsystem related to CIS (Connected Isochronous Stream) ownership handling has been resolved. The issue involved improper management of connection holds during reuse, which could lead to inconsistent state handling in Bluetooth ISO layer connections.
A vulnerability in the Linux kernel related to KVM on arm64 architecture has been resolved. The issue involved improper handling of the hyp stack pages in the host stage-2 memory management. The fix ensures that the hyp stack's virtual address range is properly walked and accounted for during host ownership checks.
A race condition vulnerability in the Linux kernel's Bluetooth management subsystem was resolved. The flaw involved the read_unconf_index_list() function, which could cause an out-of-bounds write due to inconsistent counting and filling of unconfigured Bluetooth controllers during asynchronous setup. The fix involves allocating space for every device on the hci_dev_list to prevent size mismatches caused by flag changes during the operation.
CVE-2024-4457 is a critical OS command injection vulnerability in WSO2 Enterprise Integrator's Management Console. It arises from improper validation of input related to JDBC user store configuration, allowing attackers to execute arbitrary code on the server with WSO2 product privileges. This can lead to full system compromise. The vulnerability affects multiple versions prior to specific fixed releases. A high-severity CVSS score of 9.1 reflects the potential impact. Fixed versions are available, and no known exploits are reported in the wild.
CVE-2026-98866 is a use-after-free vulnerability in the Linux kernel scheduler related to the sched_cache_grp pointer in task_struct. The flaw was addressed by introducing a dedicated sched_cache_grp pointer in each task_struct to decouple scheduler hot-path accesses from the mm_struct, preventing use-after-free conditions during memory management transitions such as fork and exec. This fix involves reference counting changes and scheduler code updates to safely manage cache group references.
A use-after-free vulnerability exists in the Linux kernel's HID winwing driver related to force feedback teardown. The issue arises because the driver's private data, allocated with devm_kzalloc(), is incorrectly freed twice: once by the force-feedback core and again by the device resource management, causing memory corruption. This can occur during device unbind, module removal, hot-unplug, or system suspend operations.
A vulnerability in the Linux kernel firewire cdev subsystem caused an incorrect state transition in the iso_resource_auto client resource. Concurrent access could cause the state to revert backwards, potentially leading to inconsistent resource management. This issue has been fixed by adding checks to prevent the back-transition.
A vulnerability in the Linux kernel's pfcp subsystem causes a NULL pointer dereference due to improper socket lifetime management when netdevice registration fails. This occurs because the UDP socket is released twice if registration fails after initialization succeeds, leading to a kernel crash detected by KASAN. The issue affects specific Linux kernel versions used in Ubuntu HWE edge releases.
CVE-2026-98818 is a Linux kernel vulnerability involving a deadlock risk in the memory management slab allocator. The issue arises because kfree_rcu() can be called while holding pi_lock, a raw spinlock, and it should not allocate memory with __GFP_KSWAPD_RECLAIM since waking up kswapd under pi_lock leads to a circular locking dependency and deadlock. This deadlock was confirmed using a modified kernel with lockdep instrumentation. The vulnerability affects specific Linux kernel versions including several 4.15.x, 5.0.x, and 5.3.x releases.
A vulnerability in the Linux kernel's ASoC SDCA component related to power management runtime error handling in the function probe has been addressed. The fix adds a common error path to properly balance the runtime PM reference during probe operations. This issue affects specific versions of the linux-hwe-edge kernel. The severity is rated low, and there are no known exploits in the wild.
A use-after-free vulnerability in the Linux kernel NVMe driver was fixed related to the character device (cdev) lifetime management. The issue occurs in multipath mode when the namespace head is torn down, causing open cdev file operations to reference freed memory, leading to a kernel crash detected by KASAN. This flaw allows referencing a freed nvme_ns_head structure after its reference count drops to zero.
CVE-2026-98789 addresses a memory management issue in the Linux kernel's BPF subsystem where objects can become stuck in the free_by_rcu_ttrace list due to improper handling of RCU callbacks. This can cause unbounded accumulation of such objects, potentially impacting system resource management. The vulnerability affects specific Linux kernel versions and has a medium severity rating with a CVSS score of 5.6.