A vulnerability in the Linux kernel's dm-pcache component allows a crafted kset to overrun its segment, causing a BUG_ON condition. This occurs because the cache_replay(), writeback worker, and GC worker read a kset size that can be manipulated to exceed the segment's remaining space. The issue is mitigated by rejecting any kset whose on-media size exceeds the remaining segment size before use.
A vulnerability in the Linux kernel's dm-pcache component allows an out-of-bounds write during replay due to improper bounding of a logical key offset from persistent memory. The flaw occurs when the offset plus length exceeds the device size, leading to a subtree pointer outside the valid array range. This issue has been resolved by rejecting keys of zero length or those whose offset plus length exceed the device size before use.
A vulnerability in the Linux kernel KVM x86 subsystem could cause stale, unpinned page frame numbers (PFNs) to be reused when nested virtualization pages fail to be retrieved. This occurs if the GET_NESTED_STATE_PAGES request is not properly re-pended before exiting to userspace, potentially leading to stale mappings in nested virtual machine control structures. The issue affects specific Linux kernel versions and has been resolved by ensuring the request is correctly handled on VM exit.
CVE-2026-98862 is a use-after-free vulnerability in the Linux kernel's audit subsystem affecting the kill_rules() function. This flaw occurs when removing audit rules that monitor executable files, leading to a race condition where the executable mark can be freed while still in use. The issue is fixed by changing the removal process to wait for an RCU grace period before freeing executable marks, preventing use-after-free errors.
CVE-2026-98861 is a high-severity vulnerability in the Linux kernel's fprobe subsystem. It arises because unregister_fprobe() and unregister_fprobe_async() rely on standard RCU grace periods that do not account for fprobe handlers executing when RCU is not watching, such as in idle or nohz_full states. This can lead to a use-after-free condition if the fprobe is freed immediately after unregistration. The issue is addressed by adding checks for rcu_is_watching() and using guard(rcu_sched_notrace) to avoid lockdep overhead and ensure safe synchronization.
A vulnerability in the Linux kernel's HID subsystem involving BPF programs was fixed by properly casting size to ssize_t when checking hid_bpf_hw_request. Without this fix, negative hardware error codes returned by transport drivers could be misinterpreted as large positive numbers, causing the kernel to treat hardware errors as successes and potentially allowing BPF programs to operate on uninitialized or stale data.
CVE-2026-98859 is a vulnerability in the Linux kernel's HID multitouch driver where the release timer can be rearmed after it has been deleted during device removal. This leads to a use-after-free condition when the timer callback dereferences freed memory. The issue arises because timer_delete_sync() does not prevent the timer from being rearmed by incoming reports, causing a timer callback to access freed data. The fix involves using timer_shutdown_sync() to ensure the timer cannot be rearmed after deletion, preventing the use-after-free.
A use-after-free vulnerability in the Linux kernel's io_uring subsystem with SQPOLL mode has been fixed. The issue occurs when the sqpoll thread frees the ring context while another function still accesses it, leading to a kernel slab use-after-free error detected by KASAN. The fix involves holding an RCU read lock during the add operation and waiting for a grace period before freeing the context.
A vulnerability in the Linux kernel's IP Virtual Server (ipvs) component related to unbounded growth of LBLCR and LBLC cache entries has been resolved. The functions ip_vs_lblcr_new() and ip_vs_lblc_new() previously created cache entries for every new destination address without effectively limiting cache size, allowing potential resource exhaustion. The fix introduces a rejection of new cache entries once the cache size reaches 1.5 times the configured max_size, preventing uncontrolled growth while maintaining serviceability.
A vulnerability in the Linux kernel kprobes subsystem involves improper handling of disarmed probes when checking for optimized probe overlaps. This flaw can cause execution to jump to an incorrect address due to an INT3 instruction overwriting part of a jump displacement in optimized probes. The issue affects specific Linux kernel versions and has been resolved by skipping disarmed probes during overlap checks.
A use-after-free vulnerability in the Linux kernel's device tree overlay handling was fixed. The issue occurs when a property is linked into a node's dead property list before a changeset add operation succeeds. If the add operation fails, the property is freed but remains linked, leading to a double free when the node is released. The fix ensures the property is linked only after the changeset add succeeds, preventing the double free.
A flaw in the Linux kernel's of/overlay subsystem causes improper handling of negative changeset IDs during error conditions. This can lead to a NULL pointer dereference when free_overlay_changeset() is called with a negative ID, potentially causing a kernel crash. The issue arises because the function treats any non-zero ID as registered, including negative values returned on allocation failure. The fix ensures only strictly positive IDs are considered registered, preventing the erroneous cleanup path.
CVE-2026-98853 is a vulnerability in the Linux kernel's network generic segmentation offload (GSO) implementation. It involves unbounded recursive IP-in-IP segmentation that can exhaust the kernel stack due to improper tracking of nested IP headers. The flaw affects IPv4 and IPv6 GSO handlers and is mitigated by limiting recursion depth using an existing recursion limit. The vulnerability has a medium severity with a CVSS score of 6.8.
CVE-2026-98852 is a medium severity vulnerability in the Linux kernel related to the handling of IPv6 extension headers in tunneled packets. The issue involves incorrect detection and processing of outer and inner IPv6 headers in certain tunneling scenarios, which can cause checksum offload processing errors and packet drops. The vulnerability affects specific Linux kernel versions and has been addressed by improving the detection logic for encapsulated IPv6 packets.
A vulnerability in the Linux kernel's netfilter nft_flow_offload component causes a reference leak on initialization error. Specifically, when nf_ct_netns_get() fails during nft_flow_offload_init(), the flowtable use count increment is not undone, leading to a leaked reference. This prevents the flowtable from being removed, causing NFT_MSG_DELFLOWTABLE to report -EBUSY despite no active references.
CVE-2026-98850 is a vulnerability in the Linux kernel's net/packet subsystem where the TX_RING byte count can overflow during packet transmission. This occurs because the signed integer tracking the total byte count can wrap into the negative range after many successful transmissions, causing a kernel BUG and potentially a system panic on configured systems. The flaw affects certain Linux kernel versions and is triggered by concurrent userspace recycling of completed frames. The issue has been fixed by preventing the byte count from exceeding INT_MAX, avoiding the overflow and subsequent kernel panic.
A vulnerability in the Linux kernel's pfcp subsystem causes a NULL pointer dereference due to improper socket lifetime management when netdevice registration fails. This occurs because the UDP socket is released twice if registration fails after initialization succeeds, leading to a kernel crash detected by KASAN. The issue affects specific Linux kernel versions used in Ubuntu HWE edge releases.
A vulnerability in the Linux kernel's rtc: ac100 driver involves accessing an array before properly initializing its size indicator. This triggers out-of-bounds warnings and potential traps when compiled with certain sanitizers and compiler versions. The issue is due to the .num member being assigned after array accesses instead of before. The fix involves initializing .num immediately after allocation to match the array size.
A vulnerability in the Linux kernel's rtc spear driver was fixed by ensuring the IRQ state is initialized before requesting the alarm IRQ. The issue involved the devm_request_irq() function enabling interrupts before the device probe completed initialization, potentially causing the interrupt handler to run prematurely. The fix initializes the MMIO address and spinlock prior to requesting the alarm IRQ.
CVE-2026-98846 is a high-severity vulnerability in the Linux kernel's SCTP implementation. It arises from improper handling of socket shutdown states during the sendmsg connect wait, which can lead to use-after-free conditions due to dangling pointers. This flaw affects specific Linux kernel versions and has been addressed by adding checks for RCV_SHUTDOWN to prevent continued use of freed associations.