A vulnerability in the Linux kernel's ADE9000 ADC driver caused Phase C dip events to be unreported due to an off-by-one error in scanning event bits. The issue was fixed by adjusting the scanning range to include the highest event bit, ensuring proper handling of Phase C dip events.
A NULL pointer dereference vulnerability exists in the Linux kernel's max30102 driver interrupt handler. The interrupt remains enabled for the device's lifetime, but the handler may dereference a NULL active_scan_mask when no buffer is enabled, causing a kernel NULL pointer dereference. The issue is fixed by checking the FIFO sample readiness early in the interrupt handler and returning if no data is available.
A vulnerability in the Linux kernel's iio pressure sensor driver for rohm-bm1390 causes the data reading function to ignore cached error values and always return 0, even when a read operation fails. This issue was resolved by modifying the function to return the cached error value after stopping the measurement, allowing users to detect read failures and avoid using invalid data.
A vulnerability in the Linux kernel's AW96103 proximity sensor firmware parser allows improper validation of firmware data length. This can cause the parser to read beyond the allocated firmware buffer if the firmware image is truncated or malformed, potentially leading to memory corruption. The issue arises from underflow and incorrect length calculations in the firmware header processing.
A vulnerability in the Linux kernel's iio proximity pulsedlight driver caused the iio_device to remain registered after a power management setup failure during device probe. This left sysfs and character device nodes active, pointing to freed memory, potentially leading to use-after-free conditions. The issue has been fixed by ensuring the device is properly unregistered on error paths.
A use-after-free vulnerability exists in the Linux kernel's Industrial I/O (IIO) trigger subsystem. The issue arises because a deferred work item (reenable_work) is not canceled before the trigger is freed, allowing a worker to access freed memory. This flaw was identified via static analysis and fixed by canceling the work before freeing the trigger.
A vulnerability in the Linux kernel perf subsystem allowed unprivileged tasks to access kernel text poke events without proper kernel access permissions. This could reveal the runtime kernel text base address despite Kernel Address Space Layout Randomization (KASLR). The issue was resolved by requiring kernel access for text poke events regardless of exclude_kernel settings.
A vulnerability in the Linux kernel's KVM subsystem for the s390 architecture was fixed by correcting the _gaccess_shadow_fault() function. The issue involved nested guest memory pages that might not be present in the parent guest's gmap, causing erroneous error propagation to userspace. This flaw has been addressed by ensuring proper linking of the nested guest memory when missing.
A vulnerability in the Linux kernel's KVM s390 subsystem was fixed by adding a missing srcu lock in the kvm_s390_set_irq_state() function. This lock is necessary to safely perform the Store status operation, similar to the existing kvm_s390_inject_vcpu() function. The flaw could lead to issues in the kernel's handling of virtual CPU interrupt state.
A high-severity vulnerability in the Linux kernel's KVM s390 subsystem involves improper handling of NULL pointers in the dat_cond_set_storage_key() function. This flaw occurs when some callers pass a NULL oldkey pointer, leading to a potential NULL pointer dereference in page_cond_set_storage_key(). The issue has been fixed by adding a NULL check and assigning a dummy local variable to prevent crashes.
A race condition vulnerability in the Linux kernel's KVM s390 architecture implementation related to storage key functions has been fixed. The flaw involved potential concurrent splitting of large pages causing crashes due to improper handling of storage key operations. The fix involves safer pointer dereferencing and retry logic to avoid race conditions.
A vulnerability in the Linux kernel s390/uv subsystem could cause a potential out-of-bounds read when the system stores more than 85 secrets. This occurs because the uv_secret_list struct array holds only up to 85 items per page, but the code incorrectly loops over the overall count rather than the per sub-list count, leading to reading beyond the array bounds. The issue has been fixed by correcting the loop to use the per sub-list count of stored secrets.
CVE-2026-98641 is a vulnerability in the Linux kernel's BPF implementation on arm64 architectures. It involves improper setup of the frame pointer for the exception callback, which can cause stack pointer mismanagement. This flaw allows a helper function to write over its own return address, potentially leading to kernel panic or other memory corruption issues. The issue arises because the frame pointer register (x25) is not correctly set during exception callbacks, resulting in invalid stack frame references.
A vulnerability in the Linux kernel's SCSI block subsystem allows an out-of-bounds write in the zone report handling code. This occurs because the zones_cond array is sized based on disk capacity and zone size, but the index used to write into this array is not properly checked against its size. Disks reporting more zones than the array can hold, especially those exceeding 32-bit zone counts, can cause memory corruption. The issue is fixed by validating the index before writing and refusing to revalidate if the zone count exceeds 32 bits.
CVE-2026-98625 is a use-after-free vulnerability in the Linux kernel's netfilter flowtable subsystem. It occurs because the HW_DEAD flag is published before the worker clears the HW_PENDING flag, allowing concurrent garbage collection to free a flow object prematurely. This flaw has been resolved by reordering the flag updates to ensure safe object lifecycle management.
A vulnerability in the Linux kernel's fbnic driver related to mailbox flushing has been resolved. The issue involved improper flushing of staged write requests during teardown of the firmware mailbox Rx ring, which could cause the flush operation to never complete. The fix involves setting both AW_FLUSH and AW_FLUSH_MODE bits to ensure staged writes drain correctly without affecting the read path.
A vulnerability in the Linux kernel's drm/bridge samsung-dsim driver involves incorrect handling of TE GPIO lifetime during host attach and detach operations. The issue arises from improper use of managed and non-managed GPIO descriptor functions, potentially causing resource mismanagement when the DSI host is detached and reattached without device destruction.
CVE-2026-98599 is a high-severity vulnerability in the Linux kernel's BPF subsystem where non-negative offsets are not properly rejected in the stack_slot_obj_get_spi() function. This flaw allows a pointer to the stack frame pointer plus zero offset (fp+0) to be incorrectly validated against a stack slot at a negative offset (fp-8), potentially enabling a kernel function to read memory outside the intended BPF stack region. The issue arises from incorrect handling of offset calculations leading to unsafe memory access.
A vulnerability in the Linux kernel's IPv6 implementation allows a reference cycle and resource leak when handling dying fib6_info structures. This occurs because a flag preventing new exceptions from being inserted is not properly set during removal, causing stalled network device unregistration.
A vulnerability in the Linux kernel's USB network driver for the sr9700 device involves improper length checking of received packets. The flaw arises because the receive fixup subtracts the Ethernet CRC from the packet length but compares the payload length against the entire remaining receive buffer, potentially causing incorrect memory handling. This issue was identified by static analysis and has been resolved.