A vulnerability in the Linux kernel's ASoC SDCA component related to power management runtime error handling in the function probe has been resolved. The fix adds a common error path to properly balance the runtime PM reference during probe initialization.
CVE-2026-98815 is a use-after-free vulnerability in the Linux kernel's NVMe subsystem related to character device (cdev) lifetime management. The flaw occurs in multipath mode when the NVMe namespace head is torn down, allowing open cdev file operations to reference freed memory. This can lead to kernel memory corruption and potential system instability or crashes. The issue was reported by the Sashiko bot and has been fixed in later kernel commits.
A vulnerability in the Linux kernel's TIPC encryption implementation could allow nonce reuse in AES-GCM encryption when peer keys change. This nonce reuse breaks confidentiality and exposes the authentication key, enabling trivial forgeries by attackers. The issue is fixed by changing the nonce counter management to prevent reuse across key changes.
A memory leak vulnerability was identified and fixed in the Linux kernel's amdgpu driver related to IP instance management during kobject add failure. The flaw occurs because the failure of kobject_add() is not properly handled, causing allocated memory to leak as the release function is never called.
A vulnerability in the Linux kernel version 6.13 affects x86 memory management on AMD F15h processors, specifically Carrizo and FX-8370E models. The issue involves incorrect application of virtual address alignment (va_align) to hugetlb mappings, causing vm_unmapped_area() to return addresses misaligned to huge page boundaries. This misalignment triggers a kernel BUG_ON during huge page teardown, potentially leading to system instability or crashes. The flaw has been fixed in specific commits addressing the alignment logic for hugetlbfs mappings.
A vulnerability in the Linux kernel's KVM SEV implementation involves improper handling of the "have run CPUs" mask pointer during freeing, which could lead to a double-free condition. The issue occurs when the mask is freed in the error path of __sev_guest_init(), causing potential memory management errors. The fix involves nullifying the pointer properly and adding helper functions to manage allocation and freeing safely.
CVE-2026-98717 is a vulnerability in the Linux kernel's KVM x86 memory management unit (MMU) code. It occurs when shadow page table walks proceed despite the root being invalid or a dummy root, potentially causing a NULL pointer dereference and kernel crash. The issue arises from a race condition during memory slot creation and stage-2 page faults. The Linux kernel has fixed this by terminating shadow walks early if the root is invalid or dummy, preventing the NULL dereference.
CVE-2026-98708 is a vulnerability in the Linux kernel's wifi mac80211 subsystem related to channel context (chanctx) management. The flaw involves premature freeing of an old channel context while its replacement still references it, potentially leading to use-after-free conditions. The issue arises because early free paths do not consider the replacement pairing, causing stale pointers to be dereferenced during later operations. This vulnerability has been addressed by ensuring the old channel context remains alive until the replacement pair is fully torn down.
A vulnerability in the Linux kernel's Thunderbolt driver causes a domain reference leak when a DisplayPort (DP) tunnel read operation is canceled. This leak can block driver unbinding indefinitely, leading to resource management issues. The flaw occurs if a DP tunnel is torn down before the DPRX read completes, such as unplugging within a timeout window. The issue has been fixed by adjusting reference ownership within the DPRX work scheduling logic.
A vulnerability in the Linux kernel's Thunderbolt driver allows access to a DisplayPort (DP) tunnel after its DPRX read operation was canceled. This occurs because the code checks a cancellation flag without proper locking, leading to callbacks on tunnels that have already been torn down during system suspend or disconnect. The issue has been fixed by adding proper locking and flag management to prevent accessing inactive tunnels.
A vulnerability in the Linux kernel's IIO core for the kxcjk-1013 accelerometer driver allows duplicate disable event requests to cause a runtime power management usage count underflow. This occurs because repeated disable requests drop a runtime PM reference that was not acquired, potentially triggering a warning. The issue has been fixed by adding a check to return early if the requested event enable state matches the current state.
A use-after-free vulnerability was identified in the Linux kernel's xilinx-xadc ADC driver. The issue involves freeing the IRQ before cancelling a delayed workqueue task during device unbinding, which could allow the IRQ handler to queue work after the associated data structure has been freed. This flaw was addressed by reordering resource management callbacks to ensure the IRQ is freed before the workqueue is cleared, preventing potential use-after-free conditions.
A vulnerability in the Linux kernel's iio proximity pulsedlight driver caused the iio_device to remain registered after a power management setup failure during device probing. This left sysfs and character device nodes pointing to freed memory, potentially leading to use-after-free conditions.
A vulnerability in the Linux kernel's Qualcomm iris media driver related to runtime power management (PM) reference leaks has been resolved. The issue involved improper handling of runtime PM usage counts, which could be leaked on failure conditions. The fix ensures that pm_runtime_resume_and_get() is used to avoid leaks and that pm_runtime_put_sync() is always called to keep runtime PM references balanced.
A vulnerability in the Linux kernel's EDAC/altera driver was resolved by changing the device resource management in the altr_portb_setup() function. The fix anchors the devres group and devm-managed IRQ requests to the actual parent device instead of an embedded device structure, ensuring consistent resource management and teardown.
A race condition vulnerability in the Linux kernel's KVM s390 architecture implementation was fixed by using READ_ONCE() in the _destroy_pages_crste() function to prevent multiple dereferences of a pointer. This fix addresses a concurrency issue that could potentially lead to unstable behavior in the kernel's memory management for this architecture.
CVE-2026-98632 is a use-after-free vulnerability in the Linux kernel's Bluetooth mesh management code. It occurs when pending mesh transmission objects are canceled but still referenced by queued work entries, leading to dereferencing freed memory. The flaw is fixed by properly dequeuing and completing these entries to avoid use-after-free conditions.
A vulnerability in the Linux kernel's fbnic network driver involves incorrect use of the Rx queue NAPI pointer to find the NAPI vector. The issue arises when standalone Tx vectors are present, causing the Rx queues to incorrectly point to Tx NAPI vectors. This can lead to improper queue management and potential instability. The flaw has been fixed by using the correct stored napi pointer in netdev_rx_queue.napi, ensuring proper queue handling under the netdev instance lock.
A vulnerability in the Linux kernel's fbnic network driver involves improper handling of the num_napi count when freeing napi vectors during power management suspend and resume operations. This can lead to a kernel NULL pointer dereference and crash when the driver attempts to access freed vectors during device removal or unbind.
A vulnerability in the Linux kernel's drm/bridge samsung-dsim driver related to improper management of TE GPIO lifetime during host attach has been fixed. The issue involved incorrect use of managed GPIO descriptor functions, leading to potential resource mismanagement when the DSI host is detached and reattached without device destruction. The fix reverts to non-managed GPIO acquisition and ensures explicit release of GPIO resources on error and unregister paths.