A vulnerability in the Linux kernel's mlx5e driver related to AF_XDP zero-copy buffer management has been resolved. The issue involved stale XSK buffer releases during MPWQE refill retries, which could cause double freeing of buffers through stale pointers. The fix ensures that buffer release retries become idempotent by properly managing the release bitmap in error paths. Extensive testing showed no invalid descriptors, WQE errors, or kernel warnings after the fix.
A vulnerability in the Linux kernel IPv4 implementation was resolved by preventing an exception dump when a nexthop group shrinks during concurrent FIB dumps. The issue involved dereferencing a NULL pointer due to a race condition between fib_info_num_path() and fib_info_nhc() when nexthop groups are replaced with fewer paths.
A vulnerability in the Linux kernel's dm-integrity device was resolved that caused a NULL pointer dereference crash when the device was activated with the 'R' flag and the SB_FLAG_DIRTY_BITMAP flag was set. The issue occurred in the dm_integrity_resume function when it attempted to read the journal containing the bitmap. The fix prevents writes during resume if the device is activated in 'R' mode.
A vulnerability in the Linux kernel's KVM x86 implementation related to the per-vCPU MMIO cache has been resolved. The issue involved improper use of memslots in System Management Mode (SMM) address space, which could cause stale cache entries to remain valid after switching address spaces. This could lead to incorrect MMIO exits and bypass of KVM's write-tracking, potentially causing inconsistent nested EPT table states. The fix ensures the use of active memslots for caching and validation, preventing stale entries across address spaces.
A race condition vulnerability in the Linux kernel's brcmfmac WiFi driver caused a kernel crash when the driver was removed while a user space process that created a P2P device was still exiting. This double removal of the P2P device interface leads to a use-after-free fault and kernel oops. The issue occurs due to concurrent removal paths attempting to unregister and free the same device interface.
A type confusion vulnerability in the Linux kernel's ati_remote2 driver was resolved by correcting device attribute handlers. The issue arose because attribute callbacks incorrectly treated usb_interface pointers as usb_device pointers, leading to invalid pointer usage. This was fixed by updating the callbacks to use the correct usb_interface pointers.
A vulnerability in the Linux kernel related to IPv4 route notification size race conditions has been resolved. The issue involves asynchronous route notifications for hardware flag changes where concurrent modifications can cause legitimate size errors, leading to warnings that were not indicative of actual bugs. The fix removes these misleading warnings while maintaining proper error handling.
A vulnerability in the Linux kernel's sched_ext scheduler caused CPU hotplug operations to hang when tasks on a dying CPU were managed by the BPF scheduler. The issue arose because tasks on the dying CPU's runqueue (rq) were not properly re-enqueued, causing the hotplug thread to wait indefinitely. This was fixed by ensuring tasks are re-enqueued on the local dequeue and that dispatch operations continue until the runqueue goes offline.
A vulnerability in the Linux kernel's mlx5e driver related to XDP redirect to AF_XDP sockets could cause stale buffer pointers to be freed twice, leading to double publication of UMEM frames. This occurs when the RX ring is full and a refill retry partially succeeds, leaving some WQEs with stale buffer pointers. The issue was detected with high packet rates and causes silent failures without kernel warnings. A fix has been implemented to mark WQEs as released immediately after freeing buffers, preventing double free and stale pointer use.
Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).
A vulnerability in the Linux kernel's bnxt_en driver caused incorrect DMA mapping length for padded small packets, leading to potential DMA read overruns and Intel IOMMU faults. The issue arises when packets smaller than 52 bytes are padded but the DMA mapping length is not updated accordingly, causing the NIC to read beyond the mapped buffer. This was fixed by adjusting the padding method to ensure the DMA mapping length matches the padded packet size.
CVE-2026-114354 is a high-severity vulnerability in DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9. It involves missing authorization in the native binder service 'android.dji.server' (transaction code 1018), allowing a local application without permissions to execute arbitrary OS commands as root. This occurs because the handler passes a caller-supplied string to the root-privileged 'assistant' daemon's system() call without verifying caller identity or permissions.
A vulnerability in the Linux kernel's IPv6 route notification handling was addressed by removing an incorrect warning related to route notification size races. The issue involved fib6_info_hw_flags_set() sizing a socket buffer and later filling it, where concurrent changes could cause legitimate size errors that were previously misinterpreted as bugs. The fix removes the misleading warning while preserving the existing error handling path.
A long-standing memory leak issue involving xarray nodes in the Linux kernel's clear_inode() function has been resolved. The leak, difficult to trigger previously, has been made more accessible through recent techniques involving madvise. The fix involves calling xa_destroy() to free excess xarray nodes and cycle the i_pages lock, addressing the leak more comprehensively.
A vulnerability in the Linux kernel's rust_binder component was resolved that involved improper handling of node refcount updates when a thread exits. Specifically, when a thread exits via BINDER_THREAD_EXIT while holding a pending node refcount increment, the increment could be dropped due to no-op cancel functions. This caused desynchronization between the node's delivery and count states, potentially preventing the node from being freed properly. The fix implements cancellation logic to reschedule the refcount update on thread exit, ensuring proper delivery to userspace.
A reference leak vulnerability in the Linux kernel's Btrfs filesystem scrub functionality was fixed. The issue occurred in the scrub_print_warning_inode() function, where a reference obtained by btrfs_get_fs_root() was not properly released if paths_from_inode() failed, causing a local_root reference leak. This leak happened every time path resolution failed during scrub warning printing. The fix ensures the reference is dropped on the failure path to prevent the leak.
A vulnerability in the Linux kernel's IPv4 PMTU handling was resolved. The issue involved a null pointer dereference caused by a race condition when the nexthop group shrinks during a PMTU walk. This could lead to a kernel oops. Exploitation requires CAP_NET_ADMIN capability in the network namespace, which can be obtained by a local user in a new user and network namespace if unprivileged user namespaces are allowed.
A vulnerability in the Linux kernel's readdir implementation related to inode locking on immutable directories has been resolved. The issue involved iterate_dir() holding a shared lock on the directory's i_rwsem semaphore even when the directory was immutable and never changed, causing unnecessary blocking. This could lead to stalls in mount namespaces sharing the same nullfs directory inode, impacting multiple users. The fix adds a FOP_IMMUTABLE flag to skip locking for directories that never change or are never removed, preventing the described contention.
A missing authorization vulnerability exists in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9 on Android. This flaw allows a local application without any permissions to invoke privileged operations such as factory reset with user-data wipe, device shutdown, clock/timezone changes, and firmware update hand-off. The root cause is that the onTransact() method does not perform any caller-identity or permission checks.
A vulnerability in the Linux kernel's dm-integrity module was resolved involving improper validation of the superblock on resume. The dm_integrity_resume() function re-reads the superblock without validating it, allowing discrepancies if the superblock is modified while the device is suspended. This can lead to out-of-bounds memory writes during journal access. The fix involves snapshotting the validated superblock during construction and refusing to resume if critical fields have changed.