CVE-2026-98556 is a vulnerability in the Linux kernel's gve driver related to TCP Segmentation Offload (TSO) packet handling. The driver fails to enforce the maximum segment size (MSS) limit of 9728 bytes for TSO packets, allowing packets with out-of-range MSS values to be processed incorrectly. This occurs because the device assumes MTU enforcement by the hypervisor and does not validate packets generated externally, such as from guests behind tap interfaces or packet socket users. The flaw can cause the MSS field to be set to zero due to silent truncation, potentially leading to unexpected behavior. The issue arises from skipped MTU checks for Generic Segmentation Offload (GSO) packets in the forwarding path and is addressed by dropping packets with invalid MSS values in the driver.
CVE-2026-98554 is a vulnerability in the Linux kernel's VLAN handling code where insufficient headroom in vlan_dev_hard_header() can cause skb_under_panic(). This occurs when callers reserve too little space for VLAN headers, potentially leading to kernel panics during packet transmission. The issue is addressed by ensuring sufficient headroom and safe concurrent access to device header length fields.
A file reference leak vulnerability exists in the Linux kernel's autofs component. The issue occurs when autofs_fill_super() fails before clearing a specific flag, leading to a pipe file reference not being released properly in autofs_kill_sb(). This causes a permanent leak of the pipe struct file reference.
A refcount leak vulnerability in the Linux kernel's perf/core subsystem was fixed in the attach_perf_ctx_data() function. The issue arises due to a race condition between global and non-global cases when attaching performance context data, potentially causing a reference count leak. This leak occurs because the global field may not be set correctly during the race, leading to improper cleanup later.
CVE-2026-98551 is a medium-severity vulnerability in the Linux kernel's perf subsystem affecting arm64 architectures. It involves improper initialization of certain fields in the perf_branch_entry structure, leading to potential leakage of uninitialized kernel memory data to userspace. The flaw arises because the bitfields new_type and priv were not properly cleared or assigned, causing stale or uninitialized data to be exposed. This issue does not affect x86 architectures. The vulnerability has been resolved by changing the code to assign the entire perf_branch_entry structure at once, ensuring all fields are properly initialized.
CVE-2026-98547 is a medium severity vulnerability in the Linux kernel's af_packet subsystem. It involves an integer overflow in the prb_calc_retire_blk_tmo() function, which calculates a timeout value using 32-bit arithmetic. When a user-controlled block size triggers this overflow, the function returns a negative timeout value that causes a high-resolution timer to fire continuously at maximum rate. This results in a CPU spinning in softirq context, holding a socket receive queue lock indefinitely, potentially causing a denial of service. The flaw was introduced with TPACKET_V3 and became more severe after changes in kernel version 6.18. The vulnerability affects specific Linux kernel versions listed and requires CAP_NET_RAW privileges to exploit. A fix involves computing the value in 64-bit arithmetic to avoid overflow.
CVE-2026-98546 is a medium-severity vulnerability in the Linux kernel affecting arm64 architecture. It involves improper handling of PMZR_EL0 writes to EL2, causing the host to crash without a panic message when certain conditions are met. The issue arises because the kernel does not properly set the trap bit for PMZR_EL0 writes, leading to unhandled traps and BUG() calls in the hypervisor. This vulnerability affects specific Linux kernel versions used in various Ubuntu releases.
CVE-2026-98545 is a vulnerability in the Linux kernel's ATA passthrough SCSI handling where improper bounds checking on the ATA PASS-THROUGH command's sense descriptor writes can lead to out-of-bounds memory access. This occurs when a faulty or malicious ATAPI device sends a malformed REQUEST SENSE reply, causing the kernel to read and write beyond the allocated 96-byte buffer. The issue has been fixed by bounding the sense descriptor writes properly.
CVE-2026-98544 is a vulnerability in the Linux kernel affecting certain versions where the IOC timer is not properly shut down during teardown. Specifically, the iocpf_timer is not deleted synchronously, which can lead to a timer callback accessing freed memory structures. This issue arises because sem_timer and iocpf_timer can rearm each other, and the existing timer deletion only waits for its own callback, leaving others active. The flaw was found during static analysis of kernel code.
A vulnerability in the Linux kernel cpuset cgroup subsystem allows conflicting exclusive CPU assignments when creating remote partitions under certain conditions. This occurs because remote_partition_enable() emits a warning but proceeds to enable remote partitions on CPUs already owned by ancestor local partitions, leading to multiple active root partitions claiming exclusive CPU resources. The issue has been fixed by changing remote_partition_enable() to return an error code (PERR_NOCPUS) when CPU conflicts are detected, preventing overlapping exclusive CPU claims.
A vulnerability in the Linux kernel's fou (foo-over-UDP) subsystem allows creation of a direct encapsulation socket without specifying the required IP protocol attribute. This omission causes the kernel to treat the protocol as zero, leading to a memory leak of socket buffers (sk_buffs) when packets are received. The flaw was fixed by rejecting such socket creation attempts without the IP protocol attribute, preventing the leak.
A low-severity vulnerability in the Linux kernel's NTFS3 filesystem driver involves improper inode instantiation during directory creation. The issue arises from using d_instantiate() instead of d_instantiate_new() in ntfs_create_inode(), leading to a race condition where inode locks become corrupted. This can cause warnings related to lock underflow and potentially hang inode_lock() calls during concurrent mount operations. The flaw has been addressed by switching to d_instantiate_new() and removing the trailing unlock_new_inode() call.
CVE-2026-98538 is a medium severity vulnerability in the Linux kernel's writeback subsystem. It involves the cleanup_offline_cgwb() function rescanning inodes inefficiently, causing a quadratic time complexity in draining inodes on a dying writeback context. This can lead to soft lockups with CPUs stuck for extended periods when many inodes are attached. The issue is resolved by changing the scanning order to make the drain operation linear in time.
CVE-2026-98537 is a vulnerability in the Linux kernel workqueue subsystem where a NULL pointer dereference occurs during a flush dependency check. This happens because the code dereferences worker->current_pwq without verifying that it is non-NULL, which can occur when a kworker thread is not executing a work item. The issue has been fixed by adding a guard to ensure worker->current_pwq is valid before dereferencing. The vulnerability affects specific Linux Azure kernel versions and has a medium severity rating with a CVSS score of 5.7.
CVE-2026-98536 is a vulnerability in the Linux kernel's writeback subsystem related to reporting Tasks-RCU quiescent states during cgroup writeback (cgwb) drain passes. On certain kernel configurations with preemption enabled, the drain loop fails to report quiescent states properly, causing long-running drain operations that can lead to system hangs and kernel panics. This issue affects specific Linux kernel versions and has been fixed by ensuring proper quiescent state reporting during the drain loop.
A clock reference leak vulnerability in the Linux kernel's fsl/fman component was fixed. The issue occurred because the read_dts_node() function called clk_get() to obtain a clock reference but did not call clk_put() to release it, causing a reference count leak. This fix ensures the clock reference is released after reading its rate, including error paths.
A use-after-free vulnerability in the Linux kernel's ipe component was fixed. The flaw occurred when auditing a newly loaded policy, where a concurrent delete could free the policy while it was still in use, potentially leading to memory corruption. The issue was resolved by auditing the policy load under the appropriate lock to prevent concurrent access.
A vulnerability in the Linux kernel's dm-verity implementation was addressed by protecting the root hash with Read-Copy-Update (RCU) synchronization. The issue involved the function ipe_bdev_setintegrity() freeing the old root hash while it could still be dereferenced during policy evaluation, potentially leading to use-after-free conditions. The fix ensures that the root hash is protected with RCU, aligning with the existing evaluation path that runs under rcu_read_lock().
A vulnerability in the Linux kernel's IPv6 Segment Routing (SR) implementation allows an out-of-bounds read of uninitialized kernel memory due to improper validation of the SEG6_ATTR_DST attribute length. This can lead to leakage of 16 bytes of kernel heap memory to userspace. The issue arises because the attribute length is only checked for maximum length, permitting shorter lengths that cause the out-of-bounds read. The vulnerability is fixed by enforcing exact attribute length validation.
A Linux kernel vulnerability in kprobes causes a permanent hang when flushing the kprobe optimizer by writing 0 to /proc/sys/debug/kprobes-optimization. This results in a process sleeping indefinitely in an uninterruptible state (D state) while holding a mutex, causing subsequent reads or writes to the sysctl to hang as well. The issue arises from improper synchronization and completion handling during optimizer flushing, leading to deadlock conditions.