A vulnerability in the Linux kernel's sysctl interface was resolved by restoring a range check in the proc_dointvec_ms_jiffies_minmax function. The issue arose because a previous commit incorrectly removed this range check, potentially allowing improper values to be processed. This affects multiple specific versions of the linux-hwe-edge kernel. The vulnerability has a medium severity rating with a CVSS score of 4.8.
CVE-2026-98433 is a vulnerability in the Linux kernel's KVM PPC Book3S hypervisor that causes a secure device page leak when uv_page_in() fails. This leak occurs because allocated secure device pages are not properly released on failure, leading to permanent consumption of secure memory resources and rendering those pages unusable for the VM's lifetime. The issue affects certain Linux kernel versions used on POWER9/10 systems with Ultravisor/PEF.
A high-severity vulnerability in the Linux kernel's accel/amdxdna component has been addressed by disabling device buffer exporting, which was never intended to be supported. This fix prevents potential unauthorized access or manipulation of device buffers.
A critical vulnerability in the Linux kernel IPv4 stack allows malformed packets with bad checksum metadata to cause corruption of the network header. This can lead to severe impacts including confidentiality, integrity, and availability violations. The issue arises because the checksum_start value was not validated before completing the checksum calculation, allowing skb_checksum_help to corrupt packet data. A fix has been implemented to validate checksum_start before checksum completion as a defense-in-depth measure.
CVE-2026-98432 is a critical vulnerability in the linux-aws kernel versions 4.4.0-1002.2 through 4.4.0-1031.34 involving improper freeing of inet_opt and ireq_opt structures after an RCU grace period. This flaw can lead to severe impacts including complete confidentiality, integrity, and availability compromise of affected systems.
CVE-2026-98431 addresses a deadlock vulnerability in the Linux kernel's RDMA/uverbs subsystem caused by a circular locking dependency between mmap_lock and disassociation_lock. The issue was introduced by a commit that added disassociation_lock to protect mmap registrations but inadvertently created an ABBA deadlock scenario. The fix removes disassociation_lock and relies on the existing hw_destroy_rwsem lock to prevent deadlocks. This resolves the circular dependency and prevents potential kernel lockup conditions.
A vulnerability in the Linux kernel's RDMA/efa driver was addressed to ensure proper management of admin queues during IRQ registration. The issue involved the IRQ handler accessing queues that were not fully constructed or already destroyed, leading to potential use-after-free conditions. The fix involves initializing queues with interrupts masked, requesting IRQs before enabling interrupts, and properly resetting the device and freeing IRQs before destroying queues.
CVE-2026-98429 is a vulnerability in the Linux kernel's RDMA/efa driver where the event queue (EQ) resources were not properly managed during IRQ registration and teardown. The IRQ handler accessed EQ state and DMA buffers before they were fully initialized or after they were freed, leading to potential use-after-free conditions. The fix involves initializing the EQ before registering the IRQ and reversing the resource release order during teardown.
CVE-2026-98428 is a vulnerability in the Linux kernel's ALSA USB 6fire driver where embedded USB Request Blocks (URBs) are used improperly. This buggy implementation can lead to use-after-free (UAF) conditions due to asynchronous release of URBs managed with reference counting. The issue has been fixed by converting embedded URBs to dynamically allocated URBs using usb_alloc_urb(), eliminating the unsafe embedded structures.
CVE-2026-98427 is a vulnerability in the Linux kernel's CoDel (Controlled Delay) network scheduler. The flaw allows an unprivileged user to trigger a soft lockup by exploiting the dropping loop in the codel_dequeue() function, which can drain the entire backlog under the queueing discipline lock in one call. This occurs because the control law step can round down to zero for very small intervals, causing the loop to never advance. The issue is fixed by bounding the dropping loop to a maximum of 256 drops per dequeue call and ensuring the control law step is at least one tick.
A vulnerability in the Linux kernel's mwifiex driver causes an IRQ leak due to incorrect handling of MSI-X error paths. Specifically, on a request_irq() failure, the cleanup loop frees IRQ vectors but uses the wrong dev_id pointer, causing some IRQs not to be freed and generating warnings.
This vulnerability in the Linux kernel's mac80211 wireless subsystem involves an unnecessary warning triggered when an IBSS (ad-hoc) network has no channel to scan due to regulatory domain changes. The warning occurs because the regulatory domain can change while the IBSS is still operating during a grace period, causing ieee80211_request_ibss_scan() to warn incorrectly. The issue has been resolved by removing this warning in such cases.
A low-severity vulnerability in the Linux kernel's wifi cfg80211 subsystem involves improper handling of network namespace switching when renaming the wiphy device fails. This can cause inconsistent network namespace states and kernel warnings.
A low-severity vulnerability in the Linux kernel's mac80211_hwsim component was fixed to prevent frames from being handed to mac80211 while the radio is stopping. The issue involved a race condition where the radio could stop after a check but before frame delivery, triggering a warning in mac80211. The fix expands mutex protection to synchronize frame delivery with radio stopping, eliminating the warning and dropping a noisy error print.
A vulnerability in the Linux kernel's mac80211 wifi subsystem causes the AP_VLAN tailroom counter to not reset properly on interface down events. This can lead to a sanity check warning when the same AP_VLAN interface is brought up multiple times without the AP interface being brought down.
A vulnerability in the Linux kernel's mac80211 WiFi subsystem was addressed by requiring that a peer station must exist for TDLS setup confirm frames. Previously, the setup confirm could be sent to a non-existent station, causing warnings and potential issues. The fix ensures that WLAN_TDLS_SETUP_CONFIRM messages are only accepted if the station is already recognized as a TDLS peer.
CVE-2026-98420 is a high-severity vulnerability in the Linux kernel's ksmbd component related to SMB2 session expiration semantics. The flaw causes valid SMB2 sessions to be destroyed prematurely after ten seconds of inactivity when a client initiates another SessionSetup exchange, due to confusion between Session.IdleTime and Session.ExpirationTime. This behavior disrupts Windows clients by invalidating tree connects and causing mapped drives to fail with STATUS_NETWORK_NAME_DELETED. The fix aligns session expiration handling with Windows semantics, using a 45-second timeout and proper session state transitions to prevent premature session termination and memory exhaustion.
A vulnerability in the Linux kernel's xfrm subsystem related to ESP-in-TCP transport headers has been resolved. The issue occurs when the transport header offset becomes unrepresentable after the TCP stream parser trims the TCP envelope, causing a truncation and triggering a warning path. The fix involves rejecting such packets by dropping them through the existing XFRM error path.
A NULL pointer dereference vulnerability was fixed in the Linux kernel's dmaengine ti k3-udma-glue driver. The flaw occurs when memory allocation for rx_chn->flows fails, leading to a NULL dereference in the error handling path during channel release. This issue was identified and resolved to prevent potential kernel crashes.
A use-after-free vulnerability exists in the Linux kernel's Samsung Exynos PMU driver related to the interrupt generator node handling. The flaw occurs because the interrupt generator node pointer is prematurely released, leading to potential use of freed memory. This issue has been fixed by adjusting the reference counting and node handling in the kernel code.