CVE-2026-98284 is a medium-severity vulnerability in the Linux kernel's netlink subsystem where the nlk->groups bitmap can be freed while lockless readers still access it, leading to potential use-after-free conditions. The issue arises because netlink_realloc_groups() uses krealloc() which immediately frees the old bitmap if it moves to a different memory bucket, but some readers do not hold the netlink table lock and can access the freed memory. The fix involves allocating a new bitmap and deferring freeing the old one until after an RCU grace period, and adjusting the order of publishing the groups pointer and group count to ensure safe lockless reads.
A use-after-free (UAF) vulnerability in the Linux kernel's drm/xe/i2c driver was fixed by disabling the I2C IRQ before freeing the associated structure during the unbind process. The flaw allowed a potential UAF if the I2C IRQ was triggered after the structure was freed but before the IRQ was disabled.
A vulnerability in the Linux kernel's btrfs filesystem causes the entire filesystem to become read-only when enable_verity() hits the quota group (qgroup) limit or when there is a lack of space during verity item cleanup. This occurs because rollback_verity() requires its own metadata reservation, and failure to obtain it leads to the filesystem being forced read-only even if the qgroup limit applies only to one subvolume. Additionally, orphan cleanup at the next mount fails, leaving leftover items that prevent the subvolume from being accessible or the filesystem from mounting in read-write mode.
A vulnerability in the Linux kernel's network code involves the removal of a WARN_ON_ONCE() warning from the dev_fill_forward_path() loop check. The issue arises when a routing loop is configured by a user with CAP_NET_ADMIN privileges, causing the dev_fill_forward_path() function to repeatedly encounter the same device, triggering a warning. The kernel now treats this condition as a transmission error and fails the walk without warning, preventing unnecessary log noise.
A vulnerability in the Linux kernel's fbnic network driver causes the hardware transmit ring to stall when a burst of packets ends with a dropped packet. This happens because the driver skips ringing the doorbell hardware notification if the last packet in a burst is dropped, leaving preceding packets invisible to the hardware and causing the transmit ring to fill and stall. The issue was reproduced under QEMU with failure injection but has not been observed in real-world scenarios.
A vulnerability in the Linux kernel's Cortina Ethernet driver related to incorrect acknowledgment of RX overrun interrupts has been resolved. The issue involved the RX overrun interrupt being reported in one interrupt status register but acknowledged incorrectly using a different status register bit, causing improper handling of the interrupt for GMAC0 and GMAC1 ports.
A vulnerability in the Linux kernel's PSP (Packet Socket Protocol) subsystem involves conflicts with the skb->decrypted field and the sk_validate_xmit_skb() function, which are also used by the TLS ULP (Upper Layer Protocol). This conflict can cause issues because PSP was not designed to be used alongside ULPs. The fix makes PSP mutually exclusive with TLS ULP and includes checks to prevent conflicts with other TCP ULPs. The vulnerability affects multiple specific Linux kernel versions.
A vulnerability in the Linux kernel's x86 kprobes subsystem causes a crash when probing CS-prefixed CALL instructions using eBPF. The issue arises because the kprobe's single-step emulation incorrectly assumes the CALL instruction length is 5 bytes, while the CS CALL instruction is actually 6 bytes long. This leads to an incorrect exception return address and a kernel crash.
A buffer overflow vulnerability exists in the Linux kernel's mvpp2 network driver related to page_pool allocation. The issue arises when mvpp2_change_mtu() calls mvpp2_bm_switch_buffers() without verifying that the number of pools does not exceed the maximum allowed, potentially causing out-of-bounds access in the page_pool array. This vulnerability affects specific Linux kernel versions and has been resolved by adding checks for hardware version and pool count before switching to per-CPU mode.
A vulnerability in the Linux kernel's network buffer handling (skbuff) was fixed to prevent stale header offsets after the pskb_carve() operation. The flaw caused header pointers to reference invalid or uninitialized memory after packet data was carved, potentially leading to kernel crashes. The issue was addressed by resetting header offsets and invalidating inner header states to ensure no stale references remain.
CVE-2026-98270 is a vulnerability in the Linux kernel's AMDGPU driver where the functions handling RAS (Reliability, Availability, and Serviceability) interrupts do not properly check for NULL pointers before dereferencing. This can cause a crash in hard-IRQ context if an interrupt occurs during a specific initialization window. The issue was identified and fixed by adding proper NULL checks.
A vulnerability in the Linux kernel's btrfs filesystem handling can cause a transaction to commit despite failure to update the inode during hole punching and reflinking operations. This leads to persistent filesystem inconsistencies due to dropped or incorrectly inserted file extent items. The issue has been resolved by adding a transaction abort on such failures.
A null pointer dereference vulnerability in the Linux kernel's perf subsystem was fixed by adding a check in is_include_guest_event() to prevent accessing a null pmu pointer. This issue could cause a general protection fault and kernel crash during module unload events when an active perf connection exists.
A vulnerability in the Linux kernel's 9p filesystem implementation was fixed by correcting the v9fs_issue_write() function to properly update file size metadata (i_size and remote_i_size) after write operations. This fix ensures that if the server file grows due to a write, the new size is accurately reflected, accounting for partial writes such as those caused by ENOSPC (no space left on device) errors.
A use-after-free (UAF) vulnerability was identified and fixed in the ALSA core component of the Linux kernel related to asynchronous card release. The flaw occurs when a sound card is released asynchronously, potentially allowing in-flight tasks to access freed memory, leading to a UAF condition. The fix involves managing the reference count of the card's device to ensure its availability throughout the card's lifecycle.
CVE-2026-98265 is a medium severity vulnerability in the Linux kernel's ALSA usb-audio driver. It involves an out-of-bounds write caused by improper handling of implicit feedback packet counts in USB audio streaming. The flaw allows writing beyond allocated memory buffers during playback preparation, potentially leading to memory corruption. The issue has been resolved by clamping the packet count to the allocated URB capacity.
A vulnerability in the Linux kernel ALSA virtio driver involves improper device reset sequencing before deleting virtqueues. The device is not reset before virtqueues are deleted, which can leave enabled queues active and potentially accessing freed memory. This issue has been resolved by ensuring the device is reset before virtqueues are deleted, preventing access to released vring memory.
This vulnerability in the Linux kernel's ASoC codec driver for rt712-sdca-dmic involves an uninitialized stream_config->type field. The stream_config structure was not properly initialized before being passed to sdw_stream_add_slave(), which could cause the type field to contain garbage data. The issue was fixed by zero-initializing stream_config so that the type defaults to SDW_STREAM_PCM, and by using a helper function to set the configuration properly.
CVE-2026-98262 is a vulnerability in the Linux kernel's AHCI driver (libahci) related to handling 32-bit DMA addressing for certain JMicron controllers. The issue involves improper clearing of PxCLBU and PxFBU registers when the AHCI_HFLAG_32BIT_ONLY flag is set, which can cause the JMicron JMB585 controller to become unusable during driver initialization.
CVE-2026-98259 is a vulnerability in the Linux kernel's fs/dax subsystem where calling dax_to_folio() with an empty xarray entry can cause a kernel panic. This occurs during booting of a VM with DAX-enabled storage. The issue arises because the code does not check for zero or empty entries before converting xarray entries, leading to a kernel panic due to invalid memory access. The vulnerability affects multiple Linux kernel versions and has been addressed by adding checks before calling dax_to_folio() in relevant functions.