A vulnerability in the Linux kernel Bluetooth L2CAP implementation allows out-of-bounds reads due to improper validation of frame length before accessing control and FCS fields. This flaw affects certain Linux kernel versions and can lead to memory access errors when processing short ERTM or streaming-mode frames.
CVE-2026-98455 is a medium severity vulnerability in the Linux kernel's Bluetooth RFCOMM implementation. It involves a NULL pointer dereference in the RFCOMM_CONNINFO getsockopt handler when deferred setup is enabled and a socket is not properly connected. This occurs because the session pointer can be cleared while the deferred setup flag remains set, leading to an unconditional dereference of a NULL session pointer. The flaw can cause a kernel crash (general protection fault) when getsockopt is called on the affected socket after a disconnect (DISC) event. The issue affects specific Linux kernel versions listed and was reproduced under QEMU with KASAN enabled.
A vulnerability in the Linux kernel SMB client handling causes a server-side handle to remain open after a create-context parsing failure in SMB2_open(). This occurs because the handle is not closed when malformed context data is rejected, leading to resource leakage and an elevated count of remote opens. The issue has been resolved by ensuring the handle is closed on error paths after parsing failures.
A vulnerability in the Linux kernel SMB client related to handling cached directory opens has been resolved. The issue involves improper cleanup of failed cached directory opens where the CREATE request succeeds but subsequent commands fail, potentially causing resource management errors. The fix ensures proper validation of CREATE responses, correct handling of file identifiers (FIDs), and improved reconnect handling to avoid hidden errors.
A vulnerability in the Linux kernel SMB client causes improper handling of compound wait errors during remote file operations. Specifically, if a later wait is interrupted or fails, an earlier remote file create operation may leave a handle open without proper cancellation, potentially causing resource leaks. The issue has been resolved by marking earlier operations as cancelled when synchronization aborts and ensuring proper cleanup of remote handles.
A vulnerability in the Linux kernel's XFS filesystem code allows memory allocation failures in the function xrep_newbt_add_blocks to cause block leaks and disrupt filesystem repairs. The issue arises because the code cannot both undo transactions and return errors properly, leading to filesystem instability during repair operations. The fix involves changing the allocation to a NOFAIL type, preventing the problem.
A vulnerability in the Linux kernel's netfilter ip6t_rt module allows an out-of-bounds read when processing IPv6 routing addresses with zero address count in non-strict match mode. This flaw can cause kernel panics or memory corruption due to reading beyond allocated structures. The issue is fixed by rejecting invalid rules and correcting loop termination logic.
A vulnerability in the Linux kernel's RISC-V KVM implementation allows race conditions during IMSIC attribute access with vCPU migration. This can cause stale interrupt file references to be accessed, potentially leading to incorrect interrupt handling and denial of service. The issue is fixed by serializing IMSIC attribute operations with the target vCPU mutex to prevent concurrent migration and access conflicts.
A race condition vulnerability in the Linux kernel Bluetooth management code (read_unconf_index_list()) can cause an out-of-bounds write due to improper synchronization of device flags during asynchronous controller setup. This flaw affects specific linux-aws kernel versions and has been resolved by allocating response space for every device on the hci_dev_list to prevent buffer overflows.
CVE-2026-98454 is a high-severity vulnerability in the Linux kernel's SMB client implementation. It involves out-of-bounds reads in the create context parsing logic, where malformed create-context chains can expose unintended memory areas. The flaw arises because the parser does not properly limit each context record to its declared size before dispatching handlers, leading to potential information exposure. The vulnerability affects specific Linux kernel versions and has been addressed by validating context boundaries and rejecting malformed chains.
A high-severity vulnerability in the Linux kernel's SMB client handling allows improper management of non-regular inodes such as symlinks during file creation operations. This can lead to resource leaks and improper inode handling, potentially impacting system stability and security.
A vulnerability in the Linux kernel's module loading process was fixed where the function codetag_load_module() failed to properly set an error code upon failure. This caused load_module() to incorrectly return success (0) even after the module teardown. Additionally, a memory leak issue was addressed for livepatch modules where allocated memory was not freed on error paths. The issue affects Linux kernel versions 6.15.4 through 6.16 and was resolved in version 6.16.
CVE-2026-98834 is a vulnerability in the Linux kernel's memory technology device (mtd) core subsystem involving a double-free of the OTP NVMEM device. The issue occurs when the factory OTP setup fails after the user OTP NVMEM device has been registered, leading to multiple unregister attempts without clearing the pointer, which can cause memory corruption. This flaw has been fixed in Linux kernel versions 5.16, 6.2, 6.3, and 6.4.
A vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem allows oversized fragmented frames to cause an overflow in a 16-bit length field, leading to a kernel crash. The issue arises because the sum of fragment lengths can exceed the maximum value of a 16-bit unsigned integer, causing an integer overflow and buffer overflow during packet reassembly. This flaw has been fixed by dropping oversized fragments to prevent the overflow.
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) JIT constant blinding logic could cause an overflow of the jump offset, leading to a kernel crash when running certain BPF programs with hardened JIT enabled. This issue arises from improper handling of backward jump offsets that wrap around the signed 16-bit integer limit.
A vulnerability in the Linux kernel Bluetooth subsystem (btintel_pcie) was fixed to address a plen overflow in the btintel_pcie_recv_frame() function. The issue involved a 16-bit plen value that could wrap around when adding header size and data length, allowing packet truncation checks to be bypassed. The fix involved widening plen to 32 bits to prevent overflow.
A NULL pointer dereference vulnerability was identified and fixed in the max30102 interrupt handler within the Linux kernel version 4.16. The issue occurs when an interrupt is triggered while no buffer is enabled, causing the handler to dereference a NULL active_scan_mask pointer. The fix involves checking the FIFO sample readiness early in the interrupt handler and returning immediately if no data is available, preventing the NULL dereference.
libLAS versions up to 1.8.1 have a heap out-of-bounds write vulnerability in the point record reader. This occurs due to truncation of the schema byte size to 16 bits when sizing the point buffer. Maliciously crafted .las files with a LASSchema variable length record exceeding 65535 bytes can cause memory corruption and crashes in tools like lasinfo, las2las, or las2txt.
CVE-2026-98570 is a vulnerability in the Linux kernel's IPv6 networking code where insufficient headroom is reserved for the MAC header in the dst_dev_overhead() function. This can cause a negative offset calculation and an out-of-bounds memory write during MAC header rebuilding when the MAC header is longer than expected, such as with VLAN devices with reorder_hdr off. The issue affects multiple seg6 encapsulation modes and related inline paths. The vulnerability has been fixed in Linux kernel versions 5.11, 5.16, 6.2, 6.7, 6.13, and 6.14.
A vulnerability in the Linux kernel cgroup cpuset subsystem allows conflicting exclusive CPU assignments between remote and local partitions. This occurs when remote_partition_enable() enables a remote partition on CPUs already claimed by an ancestor local partition, leading to inconsistent CPU exclusivity states. The issue was identified in Linux kernel version 6.16 and fixed by returning an error code (PERR_NOCPUS) to prevent such conflicts.