A slab-out-of-bounds read vulnerability in the Linux kernel's mac80211 wifi subsystem was fixed. The flaw occurs in ieee80211_monitor_select_queue() due to improper validation of skb data length, leading to out-of-bounds memory reads when handling non-linear skb buffers. This issue was addressed by validating the linear data length before accessing skb data pointers.
A vulnerability in the Linux kernel Bluetooth subsystem's hci_sync component causes a backlog of queued HCI commands to accumulate during device unregister, leading to potentially long hangs in user space when closing /dev/vhci. This occurs because queued commands wait for a timeout without being sent to the controller, and the backlog is unbounded. The issue has been fixed by preventing the worker from taking new entries once unregistering starts and waking waiting requests with an error before cancelling work.
A buffer overflow vulnerability in the Linux kernel's bcm_sysport_get_stats() function was fixed. The issue occurs when running on SYSTEMPORT Lite, where unsupported statistics are skipped but the code incorrectly writes beyond the allocated buffer bounds, causing memory corruption.
A slab-out-of-bounds vulnerability in the Linux kernel's mlx5 driver was fixed. The issue occurred when handling team device events, where bonding-specific APIs were incorrectly called on team_port structures, causing out-of-bounds memory access detected by KASAN. The fix adds checks to ensure bonding-specific functions are only called for bonding devices, preventing memory errors during event processing.
CVE-2026-98806 is a medium severity vulnerability in the Linux kernel affecting octeontx2-pf when CONFIG_DCB is enabled. The issue arises from an assumption that the queue_to_pfc_map is always initialized, which is not true for SDP VFs, leading to invalid memory access. The vulnerability has been fixed by adding a NULL check before dereferencing queue_to_pfc_map and simplifying the BPID assignment logic.
A critical vulnerability in the Linux kernel's TIPC subsystem allows reuse of AES-GCM nonces when peer keys change, breaking confidentiality and enabling trivial forgeries. The flaw arises because the nonce counter resets on peer key changes while the transmit key remains the same, causing nonce reuse. This issue has been fixed by changing the nonce counter to use the transmit key's atomic counter, preventing reuse across peer key changes without altering the nonce format or receiver compatibility.
A use-after-free vulnerability exists in the Linux kernel's page_pool subsystem in the function page_pool_recycle_ring_bulk() when CONFIG_PAGE_POOL_STATS=y. The issue arises because recycle stats are updated after releasing the producer lock, allowing a race condition where the pool may be freed before the stats update occurs. This flaw has been fixed by moving the stats update back under the lock.
A vulnerability in the Linux kernel's stmmac network driver affects the handling of received frames larger than the DMA buffer size when scatter-gather is used. The secondary RX buffer was not properly allocated for regular frames, causing DMA to write to an unmapped address and trigger an SMMU translation fault on IOMMU-based platforms. This issue has been fixed by enabling scatter-gather support for non-split-header frames on capable cores and properly allocating the secondary buffer. The fix also addresses frame trimming to avoid underflows and prepares for future multi-buffer XDP support.
CVE-2026-98802 is a vulnerability in the Linux kernel's segment routing (seg6) implementation where packet data is modified without ensuring it is writable. This can cause cloned packets to be altered unexpectedly, potentially leading to incorrect packet data being returned to applications. The issue occurs in the advance_nextseg() and seg6_next_csid_advance_arg() functions when modifying the SRH Segments Left field and the IPv6 destination address. The vulnerability has been fixed by adding calls to skb_ensure_writable() before modifying packet data, preventing writes to shared clones.
A vulnerability in the Linux kernel related to the SO_RESERVE_MEM socket option has been fixed. The issue involved improper handling of SO_RESERVE_MEM on UDP sockets, which are only supported for TCP, leading to potential memory corruption due to concurrent operations and lack of proper locking. Additionally, there was no upper bound on the value passed to SO_RESERVE_MEM, causing integer overflow and memory corruption risks. The fix restricts SO_RESERVE_MEM usage to TCP sockets and caps the maximum value to 1GB.
CVE-2026-98800 is a vulnerability in the Linux kernel's BPF trampoline program handling. It involves improper synchronization when freeing trampoline programs, potentially leading to use-after-free bugs and kernel memory corruption. The issue arises because a preempted task can call a freed program, causing a kernel crash detected by KASAN. This vulnerability affects specific Linux kernel versions and has a CVSS 7.1 score, indicating high severity.
CVE-2026-98799 is a high-severity vulnerability in the Linux kernel's BPF trampoline handling. It involves improper handling of detached BPF programs in trampoline images that are still in use by running tasks. This can lead to kernel crashes due to execution of invalid instructions when tasks resume execution in freed program memory. The issue affects multiple Linux kernel versions and has been addressed by changing how trampoline images and program calls are patched and referenced to prevent premature freeing.
CVE-2026-98798 is a vulnerability in the Linux kernel's bcmgenet network driver where a NULL pointer dereference occurs when setting Rx coalescing parameters on an interface that has not been opened. This leads to a kernel oops and causes the networking stack to become unresponsive until a reboot. The issue arises because the Rx ring private data is only initialized during interface open, but the coalescing parameters can be set beforehand, causing a NULL dereference.
CVE-2026-98797 is a high-severity vulnerability in the Linux kernel related to the handling of skb->queue_mapping during packet transmission. The flaw arises when a nested transmit operation consumes a stale queue_mapping value, leading to out-of-bounds access in the taprio scheduler's child array. This can occur when a local user with CAP_NET_ADMIN in a network namespace redirects packets between devices with differing numbers of TX queues under specific kernel configurations. The issue has been resolved by properly capping skb->queue_mapping and managing the skip_txqueue flag to prevent stale values from affecting outer transmit operations.
CVE-2026-98796 is a vulnerability in the Linux kernel's MediaTek Ethernet driver (mtk_eth_soc) where the internal dummy network device is allocated too late during initialization. This timing issue creates a window where network devices become visible before the dummy device and shared NAPI are ready, leading to null pointer dereferences and failures when bringing up interfaces. The flaw affects certain Linux Azure kernel versions and has been resolved by allocating the dummy netdev earlier in the initialization sequence.
A vulnerability in the Linux kernel's sparx5 network driver causes a NULL pointer dereference during driver unbinding if the Precision Time Protocol (PTP) initialization was skipped. This occurs because sparx5_ptp_init() returns early without setting up PTP when certain features or interrupts are absent, but sparx5_ptp_deinit() does not check for this condition before cleanup. The issue has been fixed by adding an early return in sparx5_ptp_deinit() when PTP is not used.
A vulnerability in the Linux kernel's IP Virtual Server (IPVS) component allows certain malformed flags received by the backup server to cause issues. The flaw involves improper filtering of connection flags in the IPVS SYNC protocol, which is inherently insecure. The vulnerability is addressed by dropping messages with problematic flag combinations such as NO_CPORT+TEMPLATE and unexpected ONE_PACKET flags, preventing potential disruption caused by these messages.
A vulnerability in the Linux kernel netfilter subsystem allows invalid NAT manipulation types to be passed to nf_nat_setup_info(), causing a WARN_ON() and potential improper connection tracking cleanup. This issue arises because bpf_ct_set_nat_info() does not validate the NAT manipulation type before use. The fix involves validating the NAT manipulation type and dropping packets when invalid types are detected.
CVE-2026-98792 is a high severity vulnerability in the Linux kernel's netfilter flowtable component. It involves a race condition related to the handling of a pending status bit used to coordinate garbage collection (GC) and hardware offload work. The flaw could lead to improper synchronization between GC and hardware offload handlers, potentially causing instability or incorrect flowtable behavior. The issue has been resolved by generalizing the pending status bit and reverting a problematic commit to prevent race conditions.
CVE-2026-98791 is a vulnerability in the Linux kernel's net/mlx5e driver related to AF_XDP TX timestamp teardown. During teardown of the XSK TX queue, outstanding descriptors are completed without a completion queue entry (CQE). If a TX timestamp was requested, the code dereferences a NULL CQE pointer, causing a NULL pointer dereference. The issue has been fixed by returning zero when no CQE is available, preventing the NULL dereference.