A use-after-free (UAF) and memory leak vulnerability exists in the Linux kernel's LLC (Logical Link Control) code related to skb handling in llc_mac_hdr_init() failure paths. Incorrect freeing of socket buffers (skb) can lead to leaks, double frees, and reads from freed memory. This flaw affects specific Linux kernel versions and has been assigned CVE-2026-98555 with a high severity rating.
CVE-2026-98550 is a vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) protocol where invalid or unexpected GRP_ACK_MSG messages can cause an underflow of the bc_ackers counter. This underflow leads to a wraparound that causes the system to permanently report congestion and block future group broadcasts on the affected socket. The flaw arises from incomplete checks on acknowledgment messages, allowing duplicate or stale ACKs to decrement the counter improperly. The issue affects specific Linux Azure kernel versions and has been addressed by rejecting invalid ACK messages under certain conditions.
CVE-2026-98549 is a critical vulnerability in the Linux kernel's TCP implementation that allows improper collapsing of socket buffers (skbs) across encryption boundaries in the retransmission queue. This flaw can cause encrypted data to be retransmitted in cleartext or cause connection stalls due to dropped packets in TLS device offload scenarios.
CVE-2026-98548 is a critical use-after-free vulnerability in the Linux kernel's SCTP implementation. It occurs when processing a bundled ERROR(Stale Cookie) and DATA packet from a non-primary address during the COOKIE-ECHOED state, leading to a dangling pointer dereference after the associated transport is removed but still referenced. This flaw can be triggered by any malicious SCTP peer or local unprivileged user without special privileges. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-98543 is a vulnerability in the Linux kernel related to BPF LSM programs and inode locking assumptions in the path_unlink and path_rmdir hooks. The issue arises because these hooks run before the victim inode's i_rwsem lock is taken, allowing a sleepable BPF LSM program to mutate extended attributes (xattrs) without holding the required lock. The fix involves dropping these hooks from the d_inode_locked_hooks list so that the verifier uses locking variants of BPF functions that take the lock themselves.
CVE-2026-98532 is a high severity vulnerability in the Linux kernel's IPv6 implementation where the function ipv6_find_hdr() can return an offset beyond the end of a packet. This flaw allows out-of-bounds memory access when the Open vSwitch component uses this offset as the transport header, leading to a use-after-free error and potential kernel memory corruption.
A use-after-free vulnerability in the Linux kernel's rds_ib module occurs when the scatterlist is not properly cleared after a failed DMA mapping in rds_ib_map_frmr(). This can lead to a dangling pointer in the MR pool, potentially allowing local privilege escalation. The flaw is detected by KASAN as a slab-use-after-free error during MR teardown.
CVE-2026-98520 is a use-after-free and multi-container mapping gap vulnerability in the Linux kernel's drm/amdkfd component. It affects the kfd_dev_mapping mechanism used for GPU reset handling under SRIOV with multiple containers. The flaw can cause a kernel hang due to a dangling pointer dereference and uninterruptible rwsem wait, as well as stale mappings that risk PCIe transaction timeouts and NMI panics. The issue is fixed by changing the inode mapping approach to a module-owned anonymous inode shared across all openers, preventing dangling pointers and ensuring all mappings are properly unmapped on GPU reset.
A vulnerability in the Linux kernel's nouveau DRM driver related to VRAM pinning was resolved. The issue involved the device-private region size growing without resizing the backing VRAM buffer object accordingly, causing address resolution errors beyond the first chunk. This could lead to unauthorized access or corruption of VRAM memory regions.
A use-after-free (UAF) vulnerability was identified and fixed in the Linux kernel's Nouveau DRM driver, specifically in the nouveau_uvmm_sm function when a buffer object (BO) is in the TTM_PL_SYSTEM memory placement. The flaw occurs because the code incorrectly treats a ttm_resource as a nouveau_mem structure, leading to an invalid memory read and potential kernel memory corruption. This issue was detected by Kernel Address Sanitizer (KASAN) and could cause system instability or crashes.
A double-free vulnerability exists in the Linux kernel's drm/nouveau driver in the function nvif_vmm_dtor. This occurs because the nouveau_cli_fini() function is called twice during error handling, leading to an unconditional free of the same memory twice without clearing the pointer. This flaw was discovered through fuzzing and can cause kernel memory corruption.
CVE-2026-98512 is a use-after-free vulnerability in the Linux kernel's drm/nouveau driver scheduler. The flaw arises because the nouveau_sched object is freed with kfree() instead of kfree_rcu(), leading to a race condition where userspace can access freed memory via sync_file interfaces. This can cause a kernel memory corruption and potential denial of service. The vulnerability affects specific Linux kernel versions including several 4.15.x, 5.0.x, and 5.3.x builds.
A use-after-free race condition in the Linux kernel's drm/xe virtual memory management subsystem could lead to a NULL pointer dereference. The flaw occurs because page tables (PTs) were destroyed before contested virtual memory areas (VMAs) were unlinked, causing a NULL pointer dereference when concurrent threads evict shared buffer objects. This vulnerability has been fixed by deferring PT destruction until after all contested VMAs are unlinked and destroyed.
CVE-2026-98507 is a high-severity vulnerability in the Linux kernel's memory management subsystem related to a missing memory barrier between anon_vma initialization and its publication to a virtual memory area (VMA). This flaw can cause a use-after-free (UAF) condition and lead to deadlocks where anon_vma locks are never released, resulting in hung tasks on affected systems. The issue arises from concurrent faults on adjacent VMAs that are anon_vma-compatible but not merged, allowing race conditions due to reordered memory stores. The vulnerability affects specific Linux kernel versions listed and has been addressed by fixing the memory barrier to ensure proper synchronization.
A use-after-free vulnerability exists in the Linux kernel's HID alps driver due to improper handling of input device registration failures. Specifically, if input2 registration fails, a freed input device pointer remains referenced, which can be dereferenced during certain input events, leading to potential memory corruption.
A vulnerability in the Linux kernel's mlx5e driver causes swapped IPv6 IPsec policy masks, leading to incorrect hardware rules that may miss or incorrectly match traffic. This affects specific kernel versions and can impact confidentiality, integrity, and availability of network traffic.
CVE-2026-98489 is a vulnerability in the Linux kernel's atl1c network driver that causes a soft lockup due to an out-of-range tpd_cons read. The hardware can report a tpd_cons value of 0xffff during PCIe link or MAC reset, which the driver loop interprets incorrectly and spins indefinitely. This issue has been reproduced on systems with Qualcomm Atheros AR8151 v2.0 NICs, triggered by rebooting a Mikrotik CCR2004 PCIe card. The problem leads to a CPU soft lockup detected by the watchdog, causing system instability.
A vulnerability in the Linux kernel s390/cmf subsystem involved confusion between virtual and physical addresses when storing extended format channel measurement data. The issue affected kernels built with CONFIG_RANDOMIZE_IDENTITY_BASE=y, causing firmware to use incorrect addresses. This has been fixed by defining certain fields as dma64_t and adding the missing virt_to_dma64() translation to ensure correct address usage.
CVE-2026-98459 is a high-severity vulnerability in the Linux kernel's Bluetooth ISO subsystem. It involves improper reference counting in the hci_bind_bis() function, which can lead to premature disconnection of a Bluetooth socket while still in use. This flaw has been resolved by ensuring proper hold management on the parent connection before linking. The vulnerability affects specific Linux kernel versions used in various Ubuntu releases.
A medium-severity vulnerability in the Linux kernel Bluetooth ISO layer involves improper release of unused CIS holds after channel attachment. The flaw occurs when iso_chan_add() returns success or -EBUSY without creating a new association, leaving a hold unused. This can lead to resource mismanagement in the ISO connection handling.