A runtime PM (power management) reference leak occurs in the Linux kernel's gpio: zynq driver due to improper handling of pm_runtime_get_sync() failure. This causes the controller's clock to remain enabled as it cannot runtime-suspend, potentially impacting power efficiency.
A runtime power management (PM) reference leak was fixed in the Linux kernel's amdgpu driver in the function amdgpu_debugfs_test_ib_show(). The issue occurred when the function resumed the device but failed to release the PM reference if acquiring a write lock was interrupted, causing the GPU to remain awake unnecessarily.
A low-severity vulnerability in the Linux kernel's nouveau DRM driver causes a runtime power management (PM) reference leak in the nouveau_connector_detect() function. If nvif_outp_edid_get() fails, the function returns early without releasing the runtime PM reference, causing the device to remain powered on unnecessarily until the next successful detection. This issue has been fixed by balancing the PM reference on the error path.
A vulnerability in the Linux kernel's huge page memory management subsystem was resolved. The flaw involved improper handling of gigantic huge pages without runtime support, leading to potential corruption of the free list during memory management operations. This issue affects specific versions of the linux-hwe-edge kernel and has been assigned CVE-2026-98506. The severity is considered low.
A race condition in the Linux kernel's memory management subsystem involving huge page table entries (PTEs) was fixed. The damon_hugetlb_mkold() function previously read and updated PTEs without properly synchronizing with hardware-driven updates, risking loss of hardware-set bits such as the dirty bit. The fix involves clearing the PTE atomically during the read to prevent parallel hardware updates from being lost. Because huge pages are in-memory and not reclaimable, no critical impact is expected.
CVE-2026-98503 is a vulnerability in the Linux kernel's packet TX_RING handling where improper management of skb destructors and zero-copy completion can cause ring slots to be reused prematurely. This flaw could lead to inconsistent state and missing packet timestamps during transmission. The issue has been resolved by switching to standard zero-copy completion and improving reference management to ensure slots are only released after all references are freed or copied.
A use-after-free race condition in the Linux kernel's drm/xe virtual memory management subsystem could lead to a NULL pointer dereference. The flaw occurs because page tables (PTs) were destroyed before contested virtual memory areas (VMAs) were unlinked, causing a NULL pointer dereference when concurrent threads evict shared buffer objects. This vulnerability has been fixed by deferring PT destruction until after all contested VMAs are unlinked and destroyed.
CVE-2026-98507 is a high-severity vulnerability in the Linux kernel's memory management subsystem related to a missing memory barrier between anon_vma initialization and its publication to a virtual memory area (VMA). This flaw can cause a use-after-free (UAF) condition and lead to deadlocks where anon_vma locks are never released, resulting in hung tasks on affected systems. The issue arises from concurrent faults on adjacent VMAs that are anon_vma-compatible but not merged, allowing race conditions due to reordered memory stores. The vulnerability affects specific Linux kernel versions listed and has been addressed by fixing the memory barrier to ensure proper synchronization.
A use-after-free vulnerability was identified and fixed in the Linux kernel's NFC subsystem, specifically in the nfc_get_local_general_bytes function. The issue arose from improper reference counting and memory management, which could lead to accessing freed memory. The fix involved refactoring the functions to use caller-provided buffers, ensuring safe memory handling without ownership transfer issues. Multiple NFC drivers were updated accordingly.
CVE-2026-98467 is a vulnerability in the Linux kernel's KVM module for arm64 architecture involving a null pointer dereference during nested stage 2 page table unmapping and write-protection operations. The flaw arises from a race condition between concurrent teardown and invalidation operations on nested guest memory management structures, potentially causing a kernel null pointer dereference. This issue has been fixed by adding a check to ensure the page table pointer is non-null before dereferencing during invalidation.
A vulnerability in the Linux kernel's Bluetooth subsystem related to connection ownership handling in the hci_conn component has been fixed. The issue involved improper management of connection holds during CIS (Connected Isochronous Stream) reuse, which could lead to inconsistent connection states. The fix ensures that connection holds are correctly taken and dropped to maintain proper ownership and state consistency.
CVE-2026-98459 is a high-severity vulnerability in the Linux kernel's Bluetooth ISO subsystem. It involves improper reference counting in the hci_bind_bis() function, which can lead to premature disconnection of a Bluetooth socket while still in use. This flaw has been resolved by ensuring proper hold management on the parent connection before linking. The vulnerability affects specific Linux kernel versions used in various Ubuntu releases.
A vulnerability in the Linux kernel SMB client related to handling cached directory opens has been resolved. The issue involves improper cleanup of failed cached directory opens where the CREATE request succeeds but subsequent commands fail, potentially causing resource management errors. The fix ensures proper validation of CREATE responses, correct handling of file identifiers (FIDs), and improved reconnect handling to avoid hidden errors.
A vulnerability in the Linux kernel's SMB client handling causes improper management of compound request message IDs (mids) on send failure. This leads to double decrementing of in-flight credits and kernel warnings during SMB2 negotiation when socket send fails.
A high-severity vulnerability in the Linux kernel's KVM module for arm64 architecture involves improper handling of hyp stack pages in the host stage-2 memory management. The fix addresses an issue where the hyp stack pages were not properly walked and transferred out of the host stage-2, potentially leading to serious security impacts.
A race condition vulnerability in the Linux kernel Bluetooth management code (read_unconf_index_list()) can cause an out-of-bounds write due to improper synchronization of device flags during asynchronous controller setup. This flaw affects specific linux-aws kernel versions and has been resolved by allocating response space for every device on the hci_dev_list to prevent buffer overflows.
A high-severity vulnerability in the Linux kernel's SMB client handling allows improper management of non-regular inodes such as symlinks during file creation operations. This can lead to resource leaks and improper inode handling, potentially impacting system stability and security.
CVE-2026-98866 is a use-after-free (UAF) vulnerability in the Linux kernel scheduler. It was fixed by introducing a new pointer task_struct->sched_cache_grp to decouple scheduler hot-path accesses from the memory management structure mm_struct. This change prevents the scheduler from accessing freed memory when switching memory contexts, addressing a reported UAF condition.
A null pointer dereference vulnerability in the Linux kernel's pfcp module occurs due to improper socket lifetime management on netdevice registration failure. This flaw happens when pfcp_newlink() creates a UDP socket before register_netdevice(), and if registration fails after pfcp_dev_init() succeeds, the socket is released twice, leading to a NULL pointer dereference.
A deadlock vulnerability in the Linux kernel's memory management subsystem was fixed by preventing the wake-up of kswapd within the __kfree_rcu_sheaf() function. The issue arises because kfree_rcu() can be called while holding pi_lock, and waking kswapd under this lock leads to a circular locking dependency and potential deadlock. The deadlock was verified using a modified kernel with lock dependency detection. This flaw affects Linux kernel version 6.18 and was resolved in specific commits.