A vulnerability in the Linux kernel workqueue subsystem involving a NULL pointer dereference in the chained work check has been fixed. The issue occurs because current_wq_worker() indicates a kworker but does not guarantee that the worker is executing a work item, leading to a possible NULL dereference of worker->current_pwq. This flaw can cause a fault when is_chained_work() is called during queueing on a draining or destroying workqueue. The fix adds a guard to ensure worker->current_pwq is valid before the chained-work test proceeds.
A vulnerability in the Linux kernel's xen/netfront driver causes a memory leak when the function xennet_fill_frags() fails due to response chains exceeding the skb's fragment capacity. The skb buffer is not freed properly, leading to resource leakage. This issue affects multiple Linux kernel versions and has been fixed in later releases.
CVE-2026-99056 is a high-severity vulnerability in the Linux kernel's strparser component, specifically affecting version 5.6. It involves a race condition where the __strp_recv function may still be running when the parser is torn down, potentially leading to use-after-free (UAF) conditions. The issue primarily affects the espintcp user of strp_recv. A patch has been applied to add locking mechanisms to ensure that any in-flight __strp_recv calls complete before teardown, preventing crashes and exploitation. A reproducer and exploit have been published, highlighting the practical risk of this flaw.
A vulnerability in the Linux kernel TCP zerocopy receive path was fixed by rejecting net_iov fragments before page mapping. The flaw caused a null pointer dereference in can_map_frag() when processing unreadable net_iov fragments, leading to kernel panic under certain conditions. The issue affects Linux kernel version 6.12 and was resolved by adding a guard to reject net_iov fragments early.
CVE-2026-99054 is a high-severity vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) component. It involves a race condition during the teardown of topology server connections where workqueues were destroyed improperly, leading to use-after-free and reference count errors. The flaw could cause socket callbacks and subscription events to queue work on already destroyed workqueues, resulting in potential kernel crashes or memory corruption. The issue has been fixed by changing the teardown order, refusing lookups after shutdown, and properly destroying workqueues before closing connections.
CVE-2026-99053 is a use-after-free vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem. The flaw occurs because tipc_node_find_by_name() returns a node pointer after dropping its RCU read lock without taking a reference, leading to a race condition where handlers may access a freed node. This can cause memory corruption and potentially allow privilege escalation or denial of service. The issue has been fixed by acquiring a reference to the node before leaving the RCU read lock and releasing it properly after use.
CVE-2026-99052 is a vulnerability in the Linux kernel's SELinux implementation affecting the handling of NATIVE_LABELS on already-initialized superblocks during mount operations. Specifically, when an NFSv4 filesystem exported with security_label is mounted a second time, SELinux fails to preserve the SECURITY_LSM_NATIVE_LABELS flag, causing the kernel to silently disable per-file security labeling on both the new and original mounts. This issue was fixed by ensuring the flag is set correctly on reused superblocks during mount option processing.
CVE-2026-99051 is a use-after-free vulnerability in the Linux kernel's fsverity subsystem. The issue arises because the freeing of struct fsverity_info is not properly synchronized with concurrent lookups, potentially leading to use-after-free conditions when different inodes access fsverity_info concurrently. This vulnerability has been fixed by introducing RCU-delayed freeing of the struct after removal from the rhashtable.
CVE-2026-99050 is a high-severity use-after-free vulnerability in the Linux kernel's gpio mpsse driver. It occurs due to a race condition when arming the IRQ poll worker, allowing the USB core to free memory while the worker still accesses it. The flaw is fixed by synchronizing worker publication and arming within a critical section and introducing a dying flag to safely manage teardown. The vulnerability affects Linux kernel versions from 6.18.6 up to but not including 6.18.57, and version 6.19. A fix is available in version 6.18.57.
A vulnerability in the Linux kernel's Xilinx GPIO driver causes a runtime power management (PM) reference leak when the gpio request function fails. This leak prevents the controller from runtime-suspending, leaving its clock enabled unnecessarily. The issue is fixed by changing the PM usage counter increment to occur only on success.
A deadlock vulnerability in the Linux kernel's GVE driver occurs when disabling XSK pools due to improper use of unlocked napi_disable and napi_enable calls while holding the netdev lock. This causes the thread to attempt to re-acquire a lock it already holds, resulting in a deadlock. The issue has been fixed by updating the NAPI calls to their locked versions.
A vulnerability in the Linux kernel's GVE driver causes a buffer leak of XSK buffers when rings are stopped. Specifically, the driver fails to free XSK buffers when resetting ring state during queue stoppage, leading to resource leakage. This issue has been encountered in production environments and has been fixed in certain commits.
CVE-2026-99046 is a high-severity vulnerability in the Linux kernel affecting version 6.17. It involves a buffer leak in the AF_XDP zero-copy (ZC) implementation when an error bit is set in the RX completion descriptor. Specifically, the XSK buffer was not freed on error, causing a resource leak. This issue has been fixed in specific commits of the Linux kernel.
A vulnerability in the Linux kernel's ibmveth driver was resolved involving improper cleanup of logical LAN resources on failure during the open operation. Specifically, if buffer pool allocation fails after registering the logical LAN, the driver fails to free the logical LAN resource before unmapping the buffer list, potentially leaving the hypervisor owning the buffer list page improperly. This issue was fixed by moving the logical LAN free operation to a shared cleanup path ensuring deregistration occurs before unmapping.
CVE-2026-99044 is a use-after-free vulnerability in the Linux kernel's ice driver related to dynamic port cleanup. The function ice_dealloc_dynamic_port() frees a VSI object before using its index to erase the dynamic port, causing a use-after-free condition. This flaw has been fixed by changing the order of operations to erase the xarray entry before freeing the VSI.
A vulnerability in the Linux kernel's ice driver involves improper reference count handling of metadata_dst during representor teardown. The flaw causes metadata_dst to be freed prematurely while references are still held, potentially leading to use-after-free conditions. This issue is fixed by replacing metadata_dst_free() with dst_release(), which correctly manages reference counts and memory cleanup.
CVE-2026-99042 is a vulnerability in the Linux kernel's io_uring networking code where a mismatch in address length checks allows bypassing of IPv6 connect filters. Specifically, the filter fields for connect.port and connect.v6_addr are not populated correctly for 24-byte sockaddr_in6 structures, causing filters that deny certain IPv6 ports or addresses to be bypassed. This issue has been fixed by adjusting the threshold to use SIN6_LEN_RFC2133 (24 bytes) as the correct length check.
A vulnerability in the Linux kernel's ip6_gre module involving obsolete ERSPAN Path MTU (PMTU) update handling has been resolved. The issue caused a null pointer dereference when processing metadata IP tunnel destinations without output devices, leading to kernel panic. The obsolete code was removed to align ERSPAN with IPv6 GRE PMTU handling.
A race condition vulnerability in the Linux kernel's key management subsystem was fixed. The flaw allowed a writer with write permission on a destination keyring to bypass keyring restrictions by exploiting a timing issue in add_key() operations. This could result in keys being linked despite a reject-all restriction. The issue was confirmed through extensive testing and was resolved by reordering the restriction check to ensure proper synchronization.
CVE-2026-99039 is a use-after-free vulnerability in the Linux kernel's memstick subsystem. It occurs because the subsystem frees the memstick_dev structure after a timeout without aborting in-flight asynchronous requests, leading to writes to freed memory. This flaw was fixed by replacing wait_for_completion_timeout() with wait_for_completion() to ensure requests complete before freeing memory.