CVE-2026-98853 is a vulnerability in the Linux kernel's network generic segmentation offload (GSO) implementation. It involves unbounded recursive IP-in-IP segmentation that can exhaust the kernel stack due to improper tracking of nested IP headers. The flaw affects IPv4 and IPv6 GSO handlers and is mitigated by limiting recursion depth using an existing recursion limit. The vulnerability has a medium severity with a CVSS score of 6.8.
CVE-2026-98852 is a medium severity vulnerability in the Linux kernel related to the handling of IPv6 extension headers in tunneled packets. The issue involves incorrect detection and processing of outer and inner IPv6 headers in certain tunneling scenarios, which can cause checksum offload processing errors and packet drops. The vulnerability affects specific Linux kernel versions and has been addressed by improving the detection logic for encapsulated IPv6 packets.
A vulnerability in the Linux kernel's netfilter nft_flow_offload component causes a reference leak on initialization error. Specifically, when nf_ct_netns_get() fails during nft_flow_offload_init(), the flowtable use count increment is not undone, leading to a leaked reference. This prevents the flowtable from being removed, causing NFT_MSG_DELFLOWTABLE to report -EBUSY despite no active references.
CVE-2026-98850 is a vulnerability in the Linux kernel's net/packet subsystem where the TX_RING byte count can overflow during packet transmission. This occurs because the signed integer tracking the total byte count can wrap into the negative range after many successful transmissions, causing a kernel BUG and potentially a system panic on configured systems. The flaw affects certain Linux kernel versions and is triggered by concurrent userspace recycling of completed frames. The issue has been fixed by preventing the byte count from exceeding INT_MAX, avoiding the overflow and subsequent kernel panic.
A vulnerability in the Linux kernel's pfcp subsystem causes a NULL pointer dereference due to improper socket lifetime management when netdevice registration fails. This occurs because the UDP socket is released twice if registration fails after initialization succeeds, leading to a kernel crash detected by KASAN. The issue affects specific Linux kernel versions used in Ubuntu HWE edge releases.
A vulnerability in the Linux kernel's rtc: ac100 driver involves accessing an array before properly initializing its size indicator. This triggers out-of-bounds warnings and potential traps when compiled with certain sanitizers and compiler versions. The issue is due to the .num member being assigned after array accesses instead of before. The fix involves initializing .num immediately after allocation to match the array size.
A vulnerability in the Linux kernel's rtc spear driver was fixed by ensuring the IRQ state is initialized before requesting the alarm IRQ. The issue involved the devm_request_irq() function enabling interrupts before the device probe completed initialization, potentially causing the interrupt handler to run prematurely. The fix initializes the MMIO address and spinlock prior to requesting the alarm IRQ.
CVE-2026-98846 is a high-severity vulnerability in the Linux kernel's SCTP implementation. It arises from improper handling of socket shutdown states during the sendmsg connect wait, which can lead to use-after-free conditions due to dangling pointers. This flaw affects specific Linux kernel versions and has been addressed by adding checks for RCV_SHUTDOWN to prevent continued use of freed associations.
A vulnerability in the Linux kernel TPM driver causes the TPM chip to remain enabled despite a null key name integrity check failure. This check is designed to protect against TPM reset attacks by disabling the TPM chip if a mismatch is detected. However, due to a logic flaw, the chip continues to serve commands even when the null key name check fails, potentially allowing misuse of TPM functions with uninitialized key handles.
CVE-2026-98844 is a medium-severity vulnerability in the Linux kernel's netfs subsystem. It involves improper clearing of the post-EOF pagecache when extending a file via write operations. This flaw could lead to stale data being exposed or inconsistencies in file content after writes that extend the file size. The issue affects specific Linux kernel versions and has been addressed by zeroing the tail of the folio straddling the EOF before extending writes.
CVE-2026-98843 is a medium severity vulnerability in the Linux kernel's netfs subsystem. It involves improper handling of gaps in the read-gaps folio during streaming writes, which can cause stale data to be written back to the server. The issue arises because netfs_read_gaps() leaves gaps unread around a dirty region, and a short or EOF response can leave stale folio content that later gets written back. The fix involves zeroing these gaps after the read completes to prevent stale data from being written back.
A vulnerability in the Linux kernel's module loading code was fixed to correctly handle error codes in codetag_load_module(). Previously, if codetag_load_module() failed, the error code was lost, causing load_module() to incorrectly return success after tearing down the module. Additionally, a memory leak occurred for livepatch modules due to mod->klp_info not being freed on this error path. This issue affects specific Linux kernel versions used in various Ubuntu releases.
A vulnerability in the Linux kernel's vmgenid driver occurs because driver_data is not set before registering notification handlers. This can lead to a NULL pointer dereference and kernel panic when an interrupt or notification triggers the handler before driver_data is assigned. The issue affects both devicetree and ACPI probe paths. The problem has been fixed by assigning driver_data before registering handlers.
CVE-2026-98840 is a use-after-free vulnerability in the Linux kernel's vc_screen component. The issue arises because the vc pointer is not reloaded before a conditional check in the vcs_write() function, leading to a stale pointer being used after the associated memory has been freed. This can cause a kernel slab-use-after-free error when vcs_notifier() reads from freed memory. The flaw was introduced due to improper ordering of pointer reload relative to error handling code paths.
CVE-2026-98839 is a vulnerability in the Linux kernel's virtual terminal (vt) selection code. It involves an unsigned integer underflow and slab-out-of-bounds read in the paste_selection() function. The issue arises when a concurrent ioctl call modifies the selection buffer while paste_selection() is sleeping, causing an underflow that leads to reading memory beyond the allocated buffer. This flaw has been fixed by adding a loop termination condition to prevent out-of-bounds access.
A medium severity vulnerability in the Linux kernel's virtual terminal (vt) subsystem causes an out-of-bounds memory access when updating the screen for invisible virtual consoles after a font size change. This occurs because the framebuffer backing buffer is not resized for invisible consoles, but the update routine is called without checking console visibility, leading to a slab-out-of-bounds read. The issue has been fixed by adding a visibility check before screen updates.
CVE-2026-98837 is a use-after-free vulnerability in the ALSA caiaq driver in the Linux kernel. The flaw occurs when the input device is registered during probe but not properly unregistered if subsequent initialization steps fail, leading to a dangling pointer. Accessing the input device's "uevent" attribute after this failure causes a kernel memory read of freed memory, triggering a KASAN slab-use-after-free error.
A vulnerability in the ALSA line6 driver in the Linux kernel allows oversized playback packets to be processed without proper size validation, leading to out-of-bounds memory writes. This occurs because the driver does not verify that the number of bytes written fits within the allocated buffer slice, potentially causing memory corruption. The flaw arises from a mismatch in packet size calculations between IN and OUT USB endpoints. This issue has been resolved by rejecting packets that exceed the allocated buffer size.
A boundary check flaw in the Linux kernel driver for the Kionix KX022A accelerometer was fixed. The driver incorrectly allowed an array index equal to the array size, which is out of bounds. This was corrected by ensuring the index is strictly less than the array size.
A double-free vulnerability in the Linux kernel's mtd core component related to the OTP NVMEM device registration and teardown has been resolved. The flaw occurs if factory OTP setup fails after user OTP NVMEM device registration, leading to multiple unregister attempts without clearing the pointer, causing a double-free condition.