A use-after-free vulnerability was identified and fixed in the Linux kernel's GPIO shared proxy handling. The issue involved the GPIO lookup table outliving the kobject whose name string address was assigned to lookup->dev_id, potentially causing a use-after-free condition. The fix involved duplicating the string to prevent this condition.
A vulnerability in the Linux kernel's ring-buffer interface causes a NULL pointer dereference when accessing buffer_meta files for CPUs that never came online. This occurs because buffer_meta files exist for all possible CPUs, but the underlying buffer is only allocated when the CPU is online. Attempting to read the file for an offline CPU leads to a NULL dereference in rbm_start(). The issue has been resolved by failing the open operation with -ENODEV for CPUs without buffers.
A vulnerability in the Linux kernel's ring-buffer implementation was fixed to correct an off-by-one error in the sub-buffer array base calculation within rb_meta_subbuf_idx(). This flaw caused an index to be one sub-buffer too high, leading to improper initialization of sub-buffer IDs and potential dereferencing of a NULL pointer when userspace maps trace_pipe_raw. The issue affected multiple specific Linux kernel versions and could cause trace data from the previous boot to be discarded on the next boot.
A vulnerability in the Linux kernel's ring-buffer implementation caused false warnings in the ring_buffer_map_get_reader() function. This occurred when the mmap reader caught up with a writer still committing events, leading to a NULL return from rb_get_reader_page() that was incorrectly treated as an error. The issue has been fixed by properly handling the NULL case without warning and removing redundant checks.
A vulnerability in the Linux kernel's SCSI bsg interface causes a buffer overflow when handling UFS ARPMB replies. The allocated reply buffer is smaller than the actual reply structure, leading to an 8-byte overflow past the buffer boundary. This issue has been resolved by passing the correct reply buffer size to the bsg_setup_queue() function for UFS bsg requests.
A vulnerability in the Linux kernel's SCSI Xen front-end driver (scsifront) allows a malicious or buggy backend to cause a NULL pointer dereference. This occurs because the driver does not check if a shadow entry is NULL before dereferencing it when processing backend responses, potentially crashing the guest system.
A NULL pointer dereference vulnerability in the Linux kernel's drm/amd/display USB4 bandwidth functions was fixed. The issue arises because ASSERT checks on stream->sink are compiled out in production, allowing a NULL stream->sink to cause a NULL pointer dereference. Proper NULL checks were added to prevent this. This affects specific Linux kernel versions used in various Ubuntu releases.
A vulnerability in the Linux kernel's amdgpu driver causes a runtime power management reference count to be dropped twice in the amdgpu_gpr function. This occurs when copying wave register data to userspace fails, leading to an underflow of the runtime PM usage count or stealing a reference. The issue affects specific Linux kernel versions and has been resolved by ensuring the hardware access completes before copying data with a single copy_to_user() call.
A vulnerability in the Linux kernel's amdgpu driver causes a GEM object leak when the userptr ioctl encounters an ENOMEM error. Specifically, when amdgpu_hmm_range_alloc() fails, the cleanup steps are skipped, leading to resource leaks including the GEM object and associated references.
CVE-2026-99148 is a vulnerability in the Linux kernel's AMDGPU driver where the eviction fence is prematurely removed when closing any handle to a buffer object (BO), even if other handles remain open. This can lead to the BO being evicted while still in use, potentially causing issues with GPU memory management and stability. The flaw was observed on Navi31 with an SDMA user queue. The fix ensures the eviction fence remains until the last handle to the BO is closed.
A vulnerability in the Linux kernel's drm/exec component involves improper handling of prelocked objects in the array of locked objects. Specifically, a prelocked object that is about to be destroyed may be held with the last reference by drm_exec without being explicitly locked or reserved for a dma_fence object. This can lead to warnings or kernel BUG_ON() triggers, potentially causing memory corruption. The issue is fixed by delaying the addition of the prelocked object to the locked objects array until explicitly referenced again by the driver.
A vulnerability in the Linux kernel's drm/i915/dmc component was addressed by adding a sanity check for the DMC firmware load address. The flaw involved the lack of validation for the firmware load address stored in dmc_info->start_mmioaddr for DMC firmware header version 3, which could lead to improper usage by dmc_load_program().
A vulnerability in the Linux kernel's drm/xe component involves improper handling of pinned buffer object (bo) pages during purgeable state changes. This flaw causes underflow and inflation of shrinkable and purgeable page counts, potentially leading to resource accounting inconsistencies.
A use-after-free vulnerability in the Linux kernel's sched_ext subsystem was fixed. The flaw involves a deferred reenqueue operation that can access a destroyed user Deferred Scheduling Queue (DSQ). This occurs because the grace period used to synchronize freeing the DSQ does not wait for pending deferred reenqueue operations, potentially allowing access to freed memory.
A vulnerability in the Linux kernel tracing subsystem was fixed by separating the predicate limit from the program capacity. The flaw involved improper handling of predicate counts, which could cause out-of-bounds access during predicate parsing.
A vulnerability in the Linux kernel tracing subsystem allows an operator stack overflow due to improper capacity checks before pushing entries. The flaw occurs because the check permits writing beyond the last allocated entry in the operator stack, potentially causing memory corruption. This issue has been resolved by rejecting pushes when the stack reaches its capacity.
A vulnerability in the Linux kernel tracing subsystem could cause a kernel crash due to a NULL pointer dereference when switching tracers that have no flags defined. This occurs because the ring buffer is not cleared when switching tracers, and printing entries from the previous tracer can dereference a NULL pointer. The issue affects certain Linux kernel versions and has been fixed by ensuring a fallback to a static empty flags structure when no flags are defined.
A vulnerability in the Linux kernel tracing subsystem caused a WARN_ON_ONCE warning due to incorrect handling of hist trigger timestamps for buffered events. The issue arises when an event file has a filter attached but the hist trigger is not yet attached, leading to a zero committing count and a warning during event processing. The flaw was fixed by using a dedicated API to correctly timestamp buffered events, preventing bogus timestamps and warnings.
A use-after-free vulnerability exists in the Linux kernel's TCP implementation in the do_tcp_getsockopt() function when handling TCP_CONGESTION. The flaw arises because the code reads a pointer to congestion control operations without proper locking, leading to potential use of freed memory. This issue was introduced after a commit that allowed dynamic allocation of BPF struct_ops, which can be freed concurrently. The vulnerability has been fixed by adding appropriate locking and memory access safeguards.
A use-after-free vulnerability exists in the Linux kernel's TCP implementation in the do_tcp_getsockopt function when handling TCP_CC_INFO. The flaw arises because the function dereferences a pointer to congestion control operations without proper synchronization, which can lead to accessing freed memory. This issue has been fixed by adding appropriate locking and atomic pointer access.