CVE-2026-98414 is a vulnerability in the Linux kernel's memory control group (memcg) subsystem where the root memcg can be incorrectly charged for memory usage due to asymmetric charging logic in obj_cgroup_charge_pages(). This leads to a memory charge leak in the root memcg's page counter, which is not user visible but can cause internal accounting issues. The flaw is triggered by reallocating anonymous memory in a child cgroup, migrating the task to the root cgroup, removing the child cgroup, and then triggering memory reclaim on the root. A patch has been developed to fix this by using try_charge() to avoid charging the root memcg improperly, restoring symmetry in charge and uncharge operations.
A vulnerability in the Linux kernel's SELinux component was fixed by ensuring the avc_has_perm_noaudit() function always fills the AVC decision structure. Previously, if the requested permission set was empty, the function returned early without initializing the decision buffer, leading to uninitialized data being used by callers. This could cause inconsistent or undefined behavior in access control decision handling.
A NULL-pointer dereference vulnerability was identified and fixed in the Linux kernel's power sequencing code in the function pwrseq_unit_new(). The issue occurs when memory allocation fails in pwrseq_unit_setup_deps(), leading to an uninitialized list pointer being used during cleanup, which can cause a kernel crash.
A NULL-pointer dereference vulnerability in the Linux kernel's power sequencing code (pwrseq_device_register) was fixed. The issue occurs if dev_set_name() fails before initializing pwrseq->targets, leading to an invalid pointer dereference in pwrseq_release().
A vulnerability in the Linux kernel watchdog driver da9063 causes improper suspend/resume handling when the hardware watchdog is running but userspace never opens the device. This leads to the watchdog continuing to count during system suspend, potentially causing unexpected system resets.
A vulnerability in the Linux kernel watchdog driver for rtd119x could cause a division by zero panic due to clk_get_rate() returning zero. This issue has been resolved to prevent such panics.
A vulnerability in the Linux kernel watchdog rzv2h driver could cause a division by zero panic due to clk_get_rate() returning zero. This issue has been addressed to prevent kernel panics caused by this division by zero condition.
CVE-2026-98407 is a heap out-of-bounds write vulnerability in the Linux kernel's wifi RSI driver that occurs during key removal. The flaw arises from an incorrect memset call that writes beyond the allocated buffer, corrupting unrelated heap objects. This issue triggers on every DISABLE_KEY callback, affecting normal operations such as disconnects, roams, and interface teardowns on real networks. The memset is redundant and was removed in the fix without affecting normal operation.
A vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem could cause a warning (WARN) in the set_bitrate_mask function when the network interface data (sdata) is marked as running but not yet fully registered in the driver. This occurs because ieee80211_set_bitrate_mask() checks if the interface is running but does not verify if it is present in the driver, leading to a failed internal check and a kernel warning. The issue arises during interface teardown or early interface bringup. The fix adds a check for the interface presence in the driver before proceeding, returning an error instead of triggering a warning.
A vulnerability in the Linux kernel's drm/virtio component was fixed to address a NULL versus ERR_PTR() bug in the virtio_gpu_user_framebuffer_create() function. The issue involved returning NULL where an error pointer was expected, which could lead to a NULL pointer dereference in drm_mode_addfb2(). This flaw was resolved by returning an error pointer instead of NULL.
A vulnerability in the Linux kernel s390 boot code could cause an out-of-bounds write when appending IPL parameters to the command line if the command line occupies all but the terminating byte of the buffer. This issue has been resolved by changing how the IPL parameter is converted and appended to the command line buffer.
CVE-2026-98402 is a vulnerability in the Linux kernel's ICMP implementation where the icmp_send tracepoint accesses an invalid transport header. This occurs because the code unconditionally calls udp_hdr(skb) without verifying if the packet is UDP, potentially triggering warnings under debug configurations. The flaw is fixed by ensuring transport header parsing only occurs for UDP packets and safely fetching the UDP header without assuming transport_header is set.
A NULL pointer dereference vulnerability in the Linux kernel's s390 architecture IPL (Initial Program Load) code was fixed. The issue occurs when kdump attempts to access a re-IPL parameter block that may not be provided by certain IPL types, leading to a NULL dereference. The fix ensures that kdump skips updating os_info when no re-IPL parameter block is available, preventing the NULL dereference and allowing the system to collect a crash dump and reboot properly.
A NULL pointer dereference vulnerability in the Linux kernel's s390 architecture IPL (Initial Program Load) handling was fixed. The issue occurs when the stand-alone dump process attempts to dereference a NULL re-IPL parameter block pointer if no re-IPL parameter block is provided by certain IPL types. This could cause the stand-alone dumper to enter a disabled wait state after completing the dump. The fix explicitly stores zero values for the IPL parameter block address and checksum when no re-IPL parameter block is available, preventing the NULL dereference.
CVE-2026-98398 is a vulnerability in the Linux kernel's lockdep subsystem where stale class_cache entries for zapped lock classes are not properly invalidated. This can cause lockdep to reference invalid or unrelated lock classes, leading to warnings and potential ABA issues during lock acquisition and validation.
A medium severity vulnerability in the Linux kernel's af_unix socket implementation causes a busy-wait condition when recv(0, MSG_PEEK) is called under specific conditions involving out-of-band data. This issue has been resolved by returning immediately when manage_oob() returns NULL for a zero-length buffer.
A vulnerability in the Linux kernel's IPv4 UDP implementation allows a UDP length overflow when Path MTU Discovery (PMTU) is set to IP_PMTUDISC_PROBE and the network device MTU is set larger than IP_MAX_MTU + 20. This overflow triggers a warning due to the 16-bit UDP length field wrapping around. The issue arises from improper bounding of the fragment size used in packet construction. This flaw has been fixed by bounding the fragment size to IP_MAX_MTU.
A bounds off-by-one vulnerability in the Linux kernel Bluetooth driver btintel_pcie was fixed by correcting the guard condition in the tx_handle function. The issue involved an out-of-range index access in the txq data structure, which could lead to improper memory handling. This flaw affects multiple specific Linux kernel versions used in various Ubuntu LTS releases.
CVE-2026-98391 is a vulnerability in the Linux kernel's drm/xe driver related to runtime power management (PM) during virtual machine (VM) teardown. The flaw allows the device to autosuspend while stale page faults from a torn-down VM are still queued, causing an assertion failure when the page-fault worker attempts to acknowledge these faults on a suspended device. The issue is addressed by holding a runtime PM reference across the entire page-fault queue worker to prevent autosuspension during fault acknowledgment.
CVE-2026-98390 is a vulnerability in the Linux kernel affecting virtualized systems, specifically involving a divide-by-zero error in the x86/amd_node topology code. On Xen PVH dom0 virtualized environments, the calculation of roots_per_node can be zero, causing a crash due to division by zero. The issue is mitigated by setting roots_per_node to 1 in these cases, with a firmware bug warning for non-virtualized systems.