A stack out-of-bounds read vulnerability exists in the Linux kernel's iptfs_skb_reset_frag_walk() function within the IP-TFS (AGGFRAG) implementation. The function advances through fragment data without properly checking array bounds, potentially reading beyond the allocated stack buffer. This flaw can be triggered by a crafted IP-TFS payload delivered to an IPTFS Security Association, causing a stack memory read beyond intended limits. The issue is addressed by adding a guard condition to prevent out-of-range offsets before entering the fragment walk loop.
A vulnerability in the Linux kernel's xfrm iptfs component can cause a kernel panic (denial of service) due to improper handling of runt packet reassembly when the inner IP packet length is shorter than expected. This occurs when an inner packet is split across two outer packets with fewer than 4 bytes at the end of the first packet, leading to an underflow and out-of-bounds memory write during reassembly. The issue affects specific Linux kernel versions and can be triggered locally or remotely against IPTFS VPN gateways under certain conditions.
CVE-2026-98370 is a use-after-free vulnerability in the Linux kernel's xfrm subsystem related to the compat ALLOCSPI request handling. The issue arises from redundant conversion calls that cause the kernel to read beyond the intended payload and free memory prematurely, potentially leading to memory corruption.
A vulnerability in the Linux kernel's arm_scpi firmware interface allows an out-of-bounds read due to improper validation of the DVFS OPP count returned by SCP firmware. The function scpi_dvfs_get_info() did not properly reject counts exceeding MAX_DVFS_OPPS, leading to potential over-read of the shared-memory reply buffer and incorrect sizing of the OPP table.
A vulnerability in the Linux kernel's SCPI clock driver allows an out-of-range DVFS index to be used due to missing upper bound checks. This can cause the driver to treat invalid data as a clock rate, potentially leading to out-of-bounds memory access or incorrect frequency reporting. The issue arises if the SCP firmware is buggy or returns stale values. The flaw has been fixed by adding proper upper bound validation.
CVE-2026-98358 is a vulnerability in the Linux kernel's IB/iser subsystem where a remote invalidation of an unregistered direction can cause a general protection fault. This occurs because certain write commands with immediate data are deliberately left unregistered, but the kernel mishandles remote invalidations for these unregistered directions, leading to a null pointer dereference and kernel crash.
A vulnerability in the Linux kernel's RDMA bnxt_re driver occurs because the function bnxt_re_init_dcb_wq() does not properly handle a failed allocation of a single-threaded workqueue. This leads to the async DCB handler calling queue_work() on a NULL pointer, which can cause kernel instability or crashes.
A null pointer dereference vulnerability was identified and fixed in the Linux kernel's RDMA/rtrs component. The issue occurs when the client-side function init_path() fails and cleanup code attempts to access a null kobj name, leading to a potential crash. A guard was added to prevent copying from a null pointer. The server side has a similar pattern. The severity is low.
A vulnerability in the Linux kernel's RDMA subsystem causes a receive buffer leak when PKey enforcement fails. This occurs because the buffer is not properly freed on failure, leading to a memory leak of approximately 300 bytes per InfiniBand port MAD or about 2 KB for OPA. Remote nodes can exploit this by repeatedly sending MADs with incorrect PKeys, causing resource exhaustion.
A vulnerability in the Linux kernel's RDMA/rtrs-clt component causes a completion queue (CQ) pool leak when a connection attempt is interrupted. This occurs due to improper handling of shared CQ credits during connection teardown, leading to potential resource leaks and kernel warnings during device unregister.
A vulnerability in the Linux kernel's virt_wifi component causes a memory leak when the simulated Wi-Fi link is disconnected. Specifically, the function virt_wifi_start_xmit() returns NET_XMIT_DROP without freeing the socket buffer (skb), leading to leaked memory for each packet sent while disconnected. This issue has been resolved by ensuring the skb is freed before returning the drop status.
A vulnerability in the Linux kernel's brcmfmac wifi driver related to handling PMKID in firmware was resolved. The issue involved uninitialized auth_status leaking stack data to firmware and improper handling of PMKID, causing the firmware to cache garbage PMKID and deny valid association requests. This was fixed by zeroing auth_status on initialization and correctly passing PMKID to the firmware.
A race condition in the Linux kernel's IB/IPoIB driver could cause a deadlock during device shutdown due to improper flag handling after a multicast flush operation. The issue arises when the IPOIB_FLAG_OPER_UP flag is restored after being cleared, conflicting with device down operations and causing a workqueue retry loop to hang indefinitely. This vulnerability has been resolved by introducing a dedicated flag to manage multicast flush state separately from the operational state flag.
A vulnerability in the Linux kernel's wifi cfg80211 component causes a crash when the function cfg80211_calculate_bi_data() calls rdev_get_radio_mask() with a NULL netdev pointer. This occurs for netdev-less wireless devices (wdevs). The issue has been fixed by changing the order of checks to ensure wdev->netdev is valid before use.
A vulnerability in the Linux kernel's wifi subsystem (cfg80211) was fixed by adding a check on the IP header size in the function cfg80211_classify8021d(). The issue involved processing frames that appeared to be IP packets but were too short, causing incorrect reading of the DS field and resulting in uninitialized value usage.
A reference count underflow vulnerability in the Linux kernel's dmaengine subsystem was fixed. The issue occurs in dma_chan_put() where device references are dropped unconditionally, causing a kref underflow when certain client usage patterns occur. This can lead to dma_find_channel() returning NULL despite the provider module still being loaded.
A use-after-free vulnerability exists in the Linux kernel's dmaengine subsystem in the functions dma_chan_put() and dma_release_channel(). This occurs when dma_device_put() drops the last reference on chan->device->ref, leading to dma_device_release() freeing the dma_device and its channels. Subsequent access to freed memory in dma_chan_put() causes a use-after-free error detected by KASAN. The fix involves caching the module owner before releasing references to avoid accessing freed memory.
CVE-2026-98342 is a use-after-free vulnerability in the Linux kernel's dmaengine subsystem. It occurs because the dma_device structure can be freed while concurrent RCU readers are still accessing it, due to missing synchronization before freeing the device. This flaw was fixed by adding an unconditional synchronize_rcu() call to ensure all RCU readers complete before the device is freed.
A vulnerability in the Linux kernel's wifi cfg80211 subsystem involves improper grouping of hidden BSS entries when beacon elements are missing. This can cause warnings and potentially unstable behavior in the handling of probe responses and beacons for hidden SSIDs. The issue arises because entries without beacon elements are grouped prematurely, violating expected grouping logic.
A race condition vulnerability in the Linux kernel's wifi cfg80211 IBSS join event handling could cause a warning due to referencing a BSS entry after it has been removed by a scan flush. This issue arises because the BSS entry lookup was delayed until event processing, allowing the entry to be removed in the interim. The flaw has been resolved by performing the lookup earlier and maintaining a reference to the BSS entry.