Search: 18.8.3.2

CVE-2026-98473 addresses three related issues in the Linux kernel's s390/vfio-ap driver involving improper handling of KVM interrupt and page resources when a queue is removed from the host's AP configuration while assigned to a mediated device. The flaws cause resource leaks, including KVM GISC registration and pinned guest pages, and a potential double-free condition. These issues are fixed by improving response code handling and resource cleanup logic in the driver.

A vulnerability in the Linux kernel SMB client handling causes a server-side handle to remain open after a create-context parsing failure in SMB2_open(). This occurs because the handle is not closed when malformed context data is rejected, leading to resource leakage and an elevated count of remote opens. The issue has been resolved by ensuring the handle is closed on error paths after parsing failures.

A vulnerability in the Linux kernel's KVM subsystem for arm64 architecture involving incorrect handling of the AArch32 DBGBXVR<n> register has been fixed. The issue caused the VM to be marked dead when an AArch32 guest accessed DBGBXVR<n> due to improper mapping of Op2 values in debug register accessors. This flaw has been resolved by restoring correct mapping behavior.

CVE-2026-98464 is a critical vulnerability in the Linux kernel's RISC-V KVM implementation involving improper synchronization of hrtimer callbacks during vCPU teardown. This race condition can lead to use-after-free errors where a vCPU is freed while a timer callback is still running, potentially causing system crashes or arbitrary code execution. The issue arises when the teardown process observes the timer as not set and skips cancellation, allowing the vCPU to be destroyed prematurely. The vulnerability affects specific Linux kernel versions and has a high CVSS score of 9.3.

CVE-2026-98443 is a high-severity vulnerability in the Linux kernel's XFS filesystem code related to improper cursor and pointer handling during recovery of iunlink buckets. The flaw involves use-after-free and memory leak issues caused by not nulling pointers after release and incorrect handling of inode unlinking pointers, which can create loops in the unlinked inode list. These bugs were fixed to prevent potential corruption or denial of service during inode recovery.

A medium severity vulnerability (CVE-2026-98438) in the Linux kernel's multipath TCP (mptcp) implementation was fixed. The issue involved an uninitialized value in the mptcp_write_data_fin function when sending a DATA_FIN without data, which could lead to incorrect checksum computation due to changes in zeroing behavior of the ext_copy structure. This flaw affects multiple specific Linux kernel versions, including various 4.15.x, 5.0.x, and 5.3.x builds.

A high-severity vulnerability in the Linux kernel's SMB server component allows asynchronous requests to remain active when a connection is closed, potentially preventing the connection from closing properly. The issue is resolved by canceling active asynchronous requests before waiting for their completion.

A vulnerability in the Linux kernel's Qualcomm iris media driver caused runtime power management (PM) reference leaks. The issue was fixed by ensuring proper use of pm_runtime_resume_and_get() and always calling pm_runtime_put_sync() to maintain balanced runtime PM references.

A vulnerability in the Linux kernel's EDAC/altera driver was addressed by changing the device resource management in the altr_portb_setup() function to use the parent device for devres operations. This ensures proper anchoring of resource groups and IRQ requests to the long-lived parent device, preventing resource management inconsistencies.

A vulnerability in the Linux kernel's sysctl interface was resolved by restoring a range check in the proc_dointvec_ms_jiffies_minmax function. The issue arose because a previous commit incorrectly removed this range check, potentially allowing improper values to be processed. This affects multiple specific versions of the linux-hwe-edge kernel. The vulnerability has a medium severity rating with a CVSS score of 4.8.

CVE-2026-98433 is a vulnerability in the Linux kernel's KVM PPC Book3S hypervisor that causes a secure device page leak when uv_page_in() fails. This leak occurs because allocated secure device pages are not properly released on failure, leading to permanent consumption of secure memory resources and rendering those pages unusable for the VM's lifetime. The issue affects certain Linux kernel versions used on POWER9/10 systems with Ultravisor/PEF.

A high-severity vulnerability in the Linux kernel's accel/amdxdna component has been addressed by disabling device buffer exporting, which was never intended to be supported. This fix prevents potential unauthorized access or manipulation of device buffers.

A NULL pointer dereference vulnerability was identified and fixed in the Linux kernel's s390/cio subsystem in version 4.18. The issue occurs when the channel path registry entry for a CHPID is removed while the subchannel's PMCW still references that CHPID, causing a function to return NULL and leading to a NULL pointer dereference. The fix adds a missing NULL check before dereferencing the pointer.

A scheduling flaw in the Linux kernel versions 6.18.19 through 6.18.54, 6.19.9 through 6.19.x, and version 7.0 allows deferred actions to remain pending indefinitely under certain conditions. This occurs because the scheduler's wakeup flag is incorrectly set from remote enqueue flags, causing deferred tasks to outlive the scheduler and potentially reference freed memory areas. The issue has been fixed in Linux kernel versions 6.18.55, 6.20, and later.

libstrophe versions up to 0.14.0 contain a stack-based buffer overflow vulnerability. This flaw can lead to denial of service due to application crashes but does not impact confidentiality or integrity. The vulnerability requires network access with high attack complexity and user interaction, without privileges needed.

An out-of-bounds read and heap-related vulnerability exists in librtmp component of RTMPDump through version 2.6. This flaw can lead to information disclosure and denial of service conditions. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity level.

libLAS versions through 1.8.1 contain a heap out-of-bounds write vulnerability that can lead to denial of service or other impacts affecting availability. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity. It requires local access with low privileges and user interaction to exploit. No public exploits or known active exploitation have been reported.

smpeg versions up to 0.4.5+cvs20030824-9.1build2 contain an integer underflow vulnerability. This flaw can cause a denial of service by crashing the affected application. The vulnerability has a medium severity rating with a CVSS score of 5.5.

libmng versions through 2.0.3 contain a heap-based buffer overflow vulnerability. This flaw can lead to a denial of service due to application crashes but does not impact confidentiality or integrity. The vulnerability requires local access and user interaction to exploit.