A vulnerability in the Linux kernel's TCP implementation allowed old ACK packets, which are either before the send unacknowledged pointer (SND.UNA) or after the next sequence to send (SND.NXT), to be processed in the fast path without proper validation. This could lead to old ACKs improperly advancing the receive next pointer (RCV.NXT), potentially modifying connection state incorrectly. The issue has been resolved by excluding such old ACKs from the fast path, ensuring they undergo proper validation in the slow path according to RFC5961.
A vulnerability in the Linux kernel arm64 hibernate implementation caused improper argument passing to the resume hypervisor call (hvc). This flaw could lead to a system hang when resuming from hibernation with specific kernel configurations related to page poisoning enabled.
A vulnerability in the Linux kernel arm64 architecture affects the handling of LSE operations on 8-bit and 16-bit types in percpu variables. The assembly code did not correctly use the size suffix for LSE instructions, causing 8- and 16-bit operations to incorrectly read and write 32 bits of memory. This flaw has been fixed by appending the correct size suffix to the LSE instruction in the kernel source.
A vulnerability in the Linux kernel Bluetooth hci_codec component allows improper validation of the vendor codec count length. This flaw occurs because the parser consumes the variable-sized standard codec array before validating the vendor codec count, potentially leading to out-of-bounds reads when the controller reply ends immediately after the standard codec array.
A use-after-free vulnerability exists in the Linux kernel's Bluetooth hci_sync component due to improper synchronization when cleaning up the local codec list. This flaw allows a race condition where a codec list entry can be accessed after it has been freed, potentially causing kernel memory corruption or crashes. The issue arises because hci_dev_close_sync() clears the codec list without holding the device lock, while other operations access the list under that lock. The fix involves taking the device lock during the clear operation to serialize access and prevent concurrent use-after-free.
A use-after-free vulnerability exists in the Linux kernel's btrfs filesystem due to improper locking when iterating over the commit root in the mark_block_group_to_copy() function. This flaw can lead to accessing freed memory during concurrent transaction commits. The issue has been fixed by adding proper semaphore protection during the commit root search.
CVE-2026-98244 is a vulnerability in the Linux kernel's btrfs filesystem where the free space tree creation state flag is not cleared on certain rebuild failure paths. This can cause delayed reference processing to be skipped on a live filesystem, potentially leading to inconsistencies. The issue occurs because the BTRFS_FS_CREATING_FREE_SPACE_TREE flag remains set after some error returns, while the BTRFS_FS_FREE_SPACE_TREE_UNTRUSTED flag remains set to indicate the free space tree is untrusted. The fix involves clearing the creation state flag on all failure paths and requiring callers to fall back to extent-tree caching.
A vulnerability in the Linux kernel's dma-buf subsystem caused a silent overflow when handling physical vector to scatter-gather table (sgt) conversions. This occurred when the MMIO size exceeded 4GB and peer-to-peer DMA passed through the host bridge, leading to a 32-bit unsigned integer overflow in the mapped_len variable. The issue was fixed by changing mapped_len to a 64-bit size_t and adding overflow checks in related functions.
A vulnerability in the Linux kernel's ip_tunnel module caused a kernel panic due to an uninitialized variable 'options_len' being referenced before assignment. This led to a buffer overflow detected by fortified memcpy() on kernels built with GCC 15+ and CONFIG_FORTIFY_SOURCE. The issue is fixed by initializing the counter before referencing options, preventing the buffer overflow and kernel crash.
A vulnerability in the Linux kernel's wwan t7xx driver allows out-of-bounds array access due to improper validation of the netif index in the t7xx_ccmni_recv_skb() function. The netif index is five bits wide but the array ccmni_inst[] only has 21 entries, leading to potential out-of-bounds reads when indexes 21 to 31 are used. This causes the driver to dereference invalid memory from a callback table, which can lead to undefined behavior. The issue is fixed by adding a bounds check that drops packets with out-of-range indexes.
CVE-2026-98237 is a vulnerability in the Linux kernel's mhi_wwan_mbim driver where a cyclic Neighbor Discovery Protocol (NDP) chain can cause an infinite loop in the mhi_mbim_rx() function. This occurs because the NDP traversal only stops when the next NDP index is zero, but a modem can point an NDP at itself or an earlier NDP, causing the loop to spin indefinitely on one CPU. The fix adds a check to break the loop when the next NDP offset is not larger than the current one, preventing CPU exhaustion.
A vulnerability in the Linux kernel's mhi_wwan_mbim driver occurs because it does not check the return value of skb_copy_bits() when copying datagrams from the NTB. This can lead to passing uninitialized kernel memory to the network stack, causing kernel heap memory leakage. The issue is fixed by properly handling the copy failure, freeing the skb, and counting the error.
A vulnerability in the Linux kernel's network scheduler (net/sched) component related to action deletion handling has been resolved. The flaw involves improper release of references when a batched RTM_DELACTION request fails to delete certain actions, causing reference leaks. This can lead to actions not being properly removed from internal data structures, potentially causing resource leaks or inconsistent state.
A vulnerability in the Linux kernel's net/sched subsystem (hhf qdisc) allows unbounded memory allocation due to an unchecked hh_flows_limit value during qdisc change operations. This can lead to excessive memory consumption under spoofed traffic conditions. The issue arises because the hh_flows_limit attribute was not properly bounded, allowing attackers with CAP_NET_ADMIN in a user namespace to set extremely high limits. The flaw has been addressed by bounding hh_flows_limit to twice the default value and ensuring the default is correctly applied during initialization.
A vulnerability in the Linux kernel's net/packet subsystem was fixed where the RX owner bit was not cleared on a VNET header conversion error. This could cause a ring slot to remain claimed and unavailable, leading to dropped packets in certain configurations. The issue affects specific Linux Azure kernel versions and has been resolved by ensuring the ownership bit is cleared on error paths.
A vulnerability in the Linux kernel's SCSI core component (scsi_cdl_enable function) allows a specially crafted USB storage device identifying as an ATA device to cause out-of-bounds reads from the kernel stack. This can lead to disclosure of kernel stack contents to the target device during automatic scanning without requiring filesystem mount or user access.
A use-after-free race condition vulnerability exists in the Linux kernel's xfrm subsystem related to state garbage collection and device state flushing. The issue arises because the lock protecting the device GC list is dropped before freeing state objects, allowing concurrent destruction of the same state. This can lead to kernel memory corruption and instability. The vulnerability affects specific Linux kernel versions used in various Ubuntu releases.
A memory leak vulnerability exists in the Linux kernel's memstick driver due to improper destruction of the io_queue workqueue during card removal. This causes kernel memory exhaustion over repeated card insert/remove cycles.
CVE-2026-98226 is a vulnerability in the Linux kernel's memory management swap subsystem. It involves a collision between the SWAP_USAGE_OFFLIST_BIT flag and the real usage count in the swap usage counter, causing underreporting of swap usage and potential loss of swapped-out pages during swapoff. This flaw can corrupt internal counters and data structures, leading to system instability or data loss on systems with large swap usage (4 TiB or more). The issue is fixed by redefining the flag based on a larger atomic type to avoid collision.
CVE-2026-98224 is a vulnerability in the Linux kernel's memory management subsystem where memory accounting is not correctly undone on mmap_prepare() failure. This flaw occurs because the kernel fails to unaccount memory when call_mmap_prepare() fails, potentially leading to incorrect memory accounting. The issue has been resolved by handling error cases separately to ensure proper unaccounting of memory.