A vulnerability in the Linux kernel's segment routing over IPv6 (seg6) implementation affects IPIP decapsulation when packets arrive on interfaces enslaved to a VRF. The issue involves the improper setting of the IPSKB_L3SLAVE flag during decapsulation, causing decapsulated packets to not be delivered to UDP sockets bound to the enslaved ingress interface as expected. This behavior contradicts documented VRF socket scope rules and affects socket lookup for decapsulated packets.
CVE-2026-98304 is a medium severity vulnerability in the Linux kernel's bcmgenet network driver. The issue causes user-configured hardware filter rules to be silently lost when the network interface is brought down and back up. This occurs because bcmgenet_hfb_init() clears the list of rules on each interface open, dropping all previously set rules. The fix involves initializing the lists once at probe time and restoring the rules on interface open, preventing loss of filter configurations.
CVE-2026-98303 is a vulnerability in the Linux kernel's IPv4 ICMP handling where input routes marked as RTN_UNREACHABLE are not properly rejected in the icmp_route_lookup function. This can cause the kernel to use an invalid route for output, triggering a kernel warning (WARN_ON_ONCE) in ip_rt_bug(). The issue arises because the existing check only rejects RTN_LOCAL routes but allows RTN_UNREACHABLE routes to be returned and used improperly. The fix involves rejecting input routes that are RTN_UNREACHABLE to prevent this condition.
A NULL pointer dereference vulnerability exists in the Linux kernel's skfp driver for FDDI devices when setting the MAC address on an interface that is down. The flaw occurs because the ResetAdapter() function is called unconditionally without checking if the network interface is running, leading to dereferencing NULL transmit queue pointers. This causes a kernel oops and crash. The issue was found via automated testing on kernel version 7.0.0 with KASAN enabled. The fix involves skipping the adapter reset when the interface is down, preserving the MAC address setting without causing a crash.
A vulnerability in the Linux kernel's network bridge MST implementation involves improper handling of switchdev calls inside an RCU read-side critical section. This can cause blocking operations that may sleep while holding RCU locks, violating kernel locking rules. The issue has been addressed by moving the switchdev call outside the RCU section and ensuring proper locking with rtnl. The vulnerability affects multiple Linux kernel versions used in various Ubuntu releases.
A race condition vulnerability in the Linux kernel's TCP IPv6 receive function (tcp_v6_do_rcv) can cause a kernel warning and potential instability. The issue arises when skb_clone_and_charge_r() is called for a socket that has been concurrently closed, leading to a splat (kernel warning) due to lockless access. The vulnerability affects certain linux-aws kernel versions and has been addressed by avoiding the problematic function call for closed TCP sockets.
A vulnerability in the Linux kernel TCP stack allows setting tcp_rmem values below 4096, which can cause a division-by-zero error leading to a kernel crash. This occurs because the receive buffer space can be initialized to zero, triggering a divide error in tcp_rcvbuf_grow(). The issue arises from tcp_rmem allowing arbitrarily small values, unlike other buffer settings that enforce minimums. The fix enforces a minimum tcp_rmem value of 4096 to prevent this condition.
A vulnerability in the Linux kernel's dmaengine mmp_pdma driver causes incorrect scatter-gather (sg) length handling in the mmp_pdma_prep_slave_sg() function. The code reads the length from the list head entry instead of the current scatterlist entry, leading to out-of-bounds reads and silent data loss for multi-entry scatter-gather lists with varying entry sizes.
A vulnerability in the Linux kernel Bluetooth hci_core component was fixed to address improper queuing of tx_work after the workqueue is drained. The flaw involved unconditional queuing of hdev->tx_work from socket send paths while the device workqueue was being drained, causing warnings and dropped work due to a race condition. The fix routes tx_work producers through a guard to prevent queuing during draining.
A vulnerability in the Linux kernel Bluetooth subsystem (btintel_pcie) involves an unchecked memcpy operation that can overflow a fixed-size DMA buffer. The flaw occurs because the length of the data copied (skb->len) is not validated in the send_sync function, potentially allowing buffer overflow if oversized packets are processed. The issue was addressed by adding a bounds check before the DMA copy operation.
A vulnerability in the Linux kernel Bluetooth coredump handling allows use-after-free conditions during device unregister. The issue arises because dump work items remain active after unregister, potentially accessing freed device structures. The fix involves shutting down coredump processing properly during unregister to prevent access to freed memory.
CVE-2026-98294 is a vulnerability in the Linux kernel's Bluetooth hci_qca driver where the driver writes to a serial port after it has been closed. This occurs due to improper handling of port closure and power state flags, leading to a use-after-free condition and potential kernel NULL pointer dereference. The issue affects certain Linux kernel versions and is triggered by unbinding the driver after a controller failure.
A vulnerability in the Linux kernel Bluetooth ISO subsystem causes a parent socket reference leak in the iso_conn_ready() function. This occurs when iso_sock_alloc() fails and the error path does not properly drop the reference, leading to a resource leak. The issue has been fixed by ensuring the reference is dropped on the error path.
A vulnerability in the Linux kernel Bluetooth drivers btmtksdio and btmtkuart allows improper validation of WMT event lengths before accessing structure fields. This can cause the drivers to read beyond the end of received data when processing malformed or short WMT events. The issue has been fixed by adding proper length validation and handling of short event forms. The flaw affects multiple Linux kernel versions used in various Ubuntu releases.
An off-by-one bounds check vulnerability in the Bluetooth btintel_pcie driver in the Linux kernel allows an out-of-bounds array access. The issue occurs because the check incorrectly permits an index equal to the array count, leading to a potential out-of-range access. This flaw has been fixed by changing the bounds check to reject all out-of-range indices.
CVE-2026-98289 is a medium-severity vulnerability in the Linux kernel's af_unix subsystem related to the handling of strongly connected components (SCC) in the __unix_walk_scc() function. The issue arises from inconsistent scc_index values within an SCC due to the order of depth-first search traversal, which can prevent proper garbage collection of SCCs. This flaw was fixed by unifying the scc_index across the SCC when finalizing it.
CVE-2026-98288 is a medium severity vulnerability in the Linux kernel's stmmac network driver. It involves a truncation issue in the TCP Segmentation Offload (TSO) header length handling, where the protocol header length is stored in an 8-bit unsigned integer, causing wraparound for headers longer than 255 bytes. This can occur with TCP over IPv6 sockets carrying large destination or hop-by-hop options. The flaw was fixed by widening the header length variable to an unsigned int to properly handle larger header sizes.
A vulnerability in the Linux kernel's pppoatm component was fixed by ensuring the socket buffer (skb) header is writable and linear before pushing the LLC header. The flaw involved insufficient checks for writable skb headers in pppoatm_send(), particularly when packets arrive via PPP channel bridging, which could lead to out-of-bounds reads or unbalanced skb operations. The fix includes using skb_cow_head() to guarantee writable headers, calling pskb_may_pull() to prevent out-of-bounds reads, and deferring protocol compression until after admission checks succeed.
A use-after-free vulnerability in the Linux kernel's drop_monitor module can cause a kernel panic. The issue arises from improper timer handling during module teardown, where a timer can be re-armed after it was deleted, leading to execution of freed memory. The fix involves switching from timer_delete_sync() to timer_shutdown_sync() to ensure no timer handlers run after teardown.
A vulnerability in the Linux kernel's network bridge VLAN handling was fixed to address bugs caused by switchdev deletion errors. The issue involved switchdev preventing VLAN deletion and causing errors in __vlan_del, which could lead to inconsistent state, memory leaks during flushing, and NULL pointer dereferences on bridge errors. The fix changes the behavior to log the error and continue VLAN deletion, aligning with 8021q behavior.