A race condition vulnerability in the Linux kernel's perf subsystem was fixed. The issue occurs between perf_event_exit_task() and perf_pending_task() during the begin_new_exec() process, where the PF_EXITING flag is not set on the task, causing perf_sigtrap() to trigger a warning due to task context mismatches. The fix involves checking if event->ctx->task equals TASK_TOMBSTONE to avoid redundant checks.
CVE-2026-98789 addresses a memory management issue in the Linux kernel's BPF subsystem where objects can become stuck in the free_by_rcu_ttrace list due to improper handling of RCU callbacks. This can cause unbounded accumulation of such objects, potentially impacting system resource management. The vulnerability affects specific Linux kernel versions and has a medium severity rating with a CVSS score of 5.6.
CVE-2026-98788 is a use-after-free vulnerability in the Linux kernel's futex private hash resizing logic. The flaw occurs because the order of assignments during hash replacement allows a grace period to start between setting batches and the hash pointer, potentially leading to a reader accessing freed memory. The issue is fixed by reordering these assignments and removing an unnecessary scoped guard.
A vulnerability in the Linux kernel's AMD display driver allows unsafe dereferencing of a dc_sink pointer during MST mode validation. This occurs because the driver accesses dc_sink fields without checking for NULL, even though dc_sink can be asynchronously cleared during MST unplug events. This race condition can lead to invalid memory access. The issue affects specific Linux kernel versions and has been resolved by adding proper checks to avoid dereferencing a cleared sink.
A vulnerability in the Linux kernel's AMD display driver occurs when dc_state_create_copy() returns NULL due to allocation failure. The dm_suspend() function does not properly handle this NULL return and continues execution, leading to a NULL pointer dereference in dm_resume() during GPU reset recovery, which can cause a system crash. The issue is fixed by returning an error immediately if the copy fails, preventing the suspend operation from leaving a NULL cached state for resume.
A vulnerability in the Linux kernel's AMDGPU driver (gfx6) causes firmware resources to leak during teardown. The firmware requested in gfx_v6_0_init_microcode() is not released properly, leading to resource leakage. This issue has been fixed by adding a function to free the microcode during software finalization.
A vulnerability in the Linux kernel's drm/mediatek driver involves a missing IS_ERR check for the ovl_adaptor platform device. The platform_device_register_data() function can fail and return an ERR_PTR, but this return value was not checked, leading to an invalid pointer being stored and passed to other kernel functions. This flaw can cause a kernel crash. The issue has been resolved by adding the missing IS_ERR check to handle errors properly.
A resource leak vulnerability in the Linux kernel's drm/mediatek driver was fixed. The issue involved the OVL adaptor platform device not being unregistered properly during probe failure or driver removal, potentially leading to resource leaks. The flaw was identified via static analysis and manual review. The severity is low.
A reference leak vulnerability exists in the Linux kernel's drm/mediatek driver in the mtk_drm_bind() function. When the device is not the mmsys master, the function takes a reference on the disp-mutex device but returns early without releasing it, causing a reference leak. This issue has been fixed by ensuring the reference is dropped before returning from the non-master path.
A memory leak vulnerability in the Linux kernel's drm/amdgpu driver was fixed. The issue occurs when kobject_add() fails during IP instance initialization, causing the allocated memory not to be freed properly. This leads to a leak of ip_hw_instance allocations. The fix ensures that the initial kobject reference is dropped on failure, allowing proper cleanup.
A resource leak vulnerability in the Linux kernel's AMDGPU driver was fixed. The issue involved ACP MFD child devices remaining registered after certain initialization failures, leading to device leaks. The flaw was addressed by ensuring proper cleanup of child devices on failure paths after registration.
CVE-2026-98778 is a medium severity vulnerability in the Linux kernel's binder driver. It involves incorrect handling of the is_failure flag during cleanup of superseded asynchronous transactions. This flaw can cause unrelated file descriptors to be closed improperly due to stale buffer contents being misinterpreted as valid file descriptor numbers.
A vulnerability in the Linux kernel binder driver causes file descriptor fixups to leak when a TF_UPDATE_TXN transaction supersedes a pending asynchronous transaction in a frozen process. This leak occurs because the outdated transaction is freed without properly releasing associated file references, leading to permanent memory consumption and potential exhaustion of file descriptors over time.
CVE-2026-98776 is a use-after-free (UAF) vulnerability in the Linux kernel's binderfs subsystem. The flaw occurs when binder_add_device accesses a freed device object due to a race condition involving directory entry removal and reference dropping. This vulnerability has been fixed in affected Linux kernel versions.
A use-after-free vulnerability exists in the Linux kernel's nitro_enclaves component triggered on SLOT_ALLOC failure in the ne_create_vm_ioctl() function. The error path improperly handles the freeing of ne_enclave, causing ne_enclave_release() to dereference a freed object, leading to a KASAN slab-use-after-free error. The issue is fixed by clearing enclave_file->private_data before fput() on the error path, preventing the unsafe dereference. Normal enclave operations are unaffected by this fix.
CVE-2026-98774 is a medium severity vulnerability in the Linux kernel's rust_binder component. The issue involves deferred work items on a thread's todo list not being cleaned up properly in the Thread::release() method if the thread dies during an active outgoing transaction. This flaw has been resolved by updating the code to ensure cleanup of deferred work items even if they remain deferred at thread exit.
CVE-2026-98773 is a use-after-free vulnerability in the Linux kernel's USB cdc-acm driver. It occurs when the acm_port_shutdown() function restarts USB Request Blocks (URBs) after the device has been disconnected, leading to access of freed DMA memory. The flaw is fixed by adding a check to prevent URB resubmission during disconnect. This vulnerability affects specific Linux kernel versions and has a medium severity rating with a CVSS score of 5.4.
A use-after-free vulnerability in the Linux kernel's USB serial driver has been fixed. The issue involves race conditions during port teardown, where completion handlers may access freed driver data. The fix reorders disconnect handling to ensure ports are not deregistered until all I/O operations have stopped and the driver disconnect callback has completed.
A vulnerability in the Linux kernel's usb storage driver for Sierra MS devices allows a malicious USB device to leak up to 5 bytes of stale kernel heap memory to unprivileged userspace via a short IN transfer in the GetSwocInfo request. This occurs because the driver does not properly reject short transfers, leaving uninitialized memory exposed through a world-readable sysfs attribute. The issue affects specific Linux kernel versions and has a low severity rating.
A vulnerability in the Linux kernel's USB gadget MIDI2 driver involves incorrect sizing of jack descriptor arrays. The arrays for jack inputs and outputs were sized based on MAX_CABLES, but since entries are added for both inputs and outputs, the arrays were undersized. This mismatch can lead to out-of-bounds (OOB) access when many jacks are configured via configfs. The issue has been fixed by adjusting the array sizes to twice MAX_CABLES.