A vulnerability in the Linux kernel IPv6 implementation causes a memory leak of destination cache entries (dst) for uncached routes when devices are unregistered. This occurs due to a race condition in handling the uncached route list, leading to improper reference counting and resource leaks. The issue affects specific Linux kernel versions and has been assigned a medium severity score.
A vulnerability in the Linux kernel's UDP socket handling causes a disconnected UDP socket to remain in the 4-tuple hash table. This stale entry leads to continued processing of packets through the 4-tuple lookup, potentially causing resource inefficiencies and unexpected behavior. The issue affects both IPv4 and IPv6 sockets and was fixed by removing the socket entry from the hash table before disconnection completes.
CVE-2026-98594 is a low severity vulnerability in the Linux kernel's tg3 driver where PHYLIB resources are not properly cleaned up on probe failure. This can lead to resource leaks due to incomplete teardown of MDIO bus and PHY connections when tg3_init_one() fails. The issue was found during static analysis and fixed by ensuring proper disconnection and unregistration of PHYLIB resources in error paths.
A NULL pointer dereference vulnerability in the Linux kernel's s390/debug subsystem was fixed in debug_info_copy(). The flaw occurs when debug_register_static() fails and clears certain data structures but leaves area bounds unchanged, leading to dereferencing NULL pointers during copy operations. This issue affects specific Linux kernel versions and has been resolved by skipping the copy loop when no valid areas exist.
CVE-2026-98592 is a medium-severity vulnerability in the Linux kernel's spacemit network driver. It involves improper clearing of the TX descriptor on fragment mapping failure during packet transmission. This can lead to stale DMA addresses being used, potentially causing memory corruption or data integrity issues.
A vulnerability in the Linux kernel's BPF subsystem related to skb-backed dynamic pointers has been fixed. The issue involves an underflow in a bounds check within the skb_pointer_if_linear() function, which can cause invalid memory pointers to be returned. This flaw affects certain Linux kernel versions and has a high severity rating with a CVSS score of 8.4.
A vulnerability in the Linux kernel's BPF subsystem related to bpf_sock context code generation has been fixed. The issue involved incorrect handling of the rx_queue_mapping field size during context access, causing the verifier's assumptions about register values to be violated. This could lead to runtime values exceeding expected limits due to sign-extension of a special value. The fix ensures correct instruction usage and proper size reporting for the bpf_sock field.
CVE-2026-98589 is a vulnerability in the Linux kernel's BPF subsystem related to how packet (PTR_TO_PACKET) pointers are handled in mutating subprograms. The verifier did not properly reject BPF code passing PTR_TO_PACKET pointers to subprograms that may mutate packets, potentially leading to incorrect memory assumptions. This flaw has been resolved by enforcing rejection of such code unless the subprogram is guaranteed not to mutate the packet.
A vulnerability in the Linux kernel's BPF sockmap implementation allows creation of sockmaps with max_entries values exceeding INT_MAX, leading to out-of-bounds memory access during sockmap free operations. This can cause memory corruption or kernel crashes. The issue arises because sock_map_alloc() does not properly reject max_entries values greater than INT_MAX, causing a signed integer overflow in sock_map_free().
A race condition vulnerability in the Linux kernel SCTP implementation allows a reference count underflow due to improper ordering of timer rearming and reference holding in timer handlers. This can lead to use-after-free conditions when the timer's reference is taken after the timer is deleted, causing potential memory corruption.
CVE-2026-98585 is a vulnerability in the Linux kernel's fbnic Ethernet driver related to handling zero ring sizes. The issue arises because the rounding function roundup_pow_of_two() is undefined for zero, and ethtool allows a zero ring size to reach the driver. The fix ensures zero ring sizes are left unchanged so that the minimum-size check can deterministically reject zero values, preventing undefined behavior.
A potential stack information leak vulnerability was identified and fixed in the Linux kernel's net/sched subsystem in the em_text_dump() function. The issue arose because a struct allocated on the stack was not fully zero-initialized before being copied to a netlink response, potentially leaking uninitialized stack memory. The vulnerability was detected by Kernel Memory Sanitizer (KMSAN) in Linux kernel 7.2-rc6. The root cause was the replacement of strncpy() with strscpy(), which does not zero-pad the destination buffer, leaving some bytes uninitialized. The fix involves zero-initializing the struct to prevent leakage.
A vulnerability in the Linux kernel NFC driver (nfcmrvl) allows improper validation of helper command length before processing. This flaw occurs because the firmware download receive path removes the NCI data header and reads the helper command before verifying the remaining packet length, potentially allowing malformed short frames to be accessed before rejection. The issue has been resolved by validating the complete helper command length prior to stripping the NCI data header.
A vulnerability in the Linux kernel NFC driver for ST21NFCA devices allows malformed frames to bypass proper size validation, potentially causing out-of-bounds reads during frame processing. The issue arises from improper handling of frame truncation and byte unstuffing, which can lead to reading beyond the buffer boundary. This flaw has been addressed by enforcing minimum frame size checks before and after unstuffing and improving the byte-stuffing removal logic.
A vulnerability in the Linux kernel NFC subsystem's LLCP protocol handling can cause list corruption and reference count desynchronization in the nfc_llcp_recv_dm() function. This occurs when a socket is left linked on the connecting_sockets list but marked closed without proper locking and unlinking, leading to concurrent list mutations and memory leaks. An unprivileged local process can exploit this to exhaust kernel memory, causing a denial of service.
A race condition vulnerability in the NFC LLCP socket accept queue lifecycle in the Linux kernel was fixed. The flaw allowed concurrent unlinking and releasing of the same child socket, causing use-after-free or NULL pointer dereference. The fix involved changing socket locking mechanisms and deferring resource release to avoid sleeping in atomic context.
A memory leak vulnerability was fixed in the Linux kernel's NFC LLCP implementation. The issue involved failure paths in the nfc_genl_llc_sdreq() function where allocated TLV nodes were not freed properly on parse, allocation, or send failures, potentially causing resource leaks.
A low severity vulnerability in the Linux kernel's NFC subsystem (st21nfca driver) involves improper validation of the ISO15693 inventory length. The vulnerability occurs because the code removes a two-byte prefix without verifying its presence and accepts a one-byte remainder before reading data as the DSFID. This could lead to incorrect processing of NFC data. The issue has been resolved by requiring the prefix and at least two remaining bytes before copying UID data and reading the DSFID.
A vulnerability in the Linux kernel's NFC LLCP implementation allowed a WKS SAP hijacking due to improper prefix matching in the nfc_llcp_wks_sap() function. The function compared only the length of the service name, causing short names to match longer ones incorrectly. This was fixed by requiring an exact length match before string comparison.
A slab-out-of-bounds read vulnerability was fixed in the Linux kernel's NFC LLCP component. The issue occurred because non-null-terminated strings were passed to debug logging functions using %s format specifiers, causing reads beyond allocated buffers. The fix involved using length-limited string output to prevent out-of-bounds reads.