A memory leak vulnerability in the Linux kernel's drm/amdgpu driver was fixed. The issue occurs when kobject_add() fails during IP instance initialization, causing the allocated memory not to be freed properly. This leads to a leak of ip_hw_instance allocations. The fix ensures that the initial kobject reference is dropped on failure, allowing proper cleanup.
A resource leak vulnerability in the Linux kernel's AMDGPU driver was fixed. The issue involved ACP MFD child devices remaining registered after certain initialization failures, leading to device leaks. The flaw was addressed by ensuring proper cleanup of child devices on failure paths after registration.
CVE-2026-98778 is a medium severity vulnerability in the Linux kernel's binder driver. It involves incorrect handling of the is_failure flag during cleanup of superseded asynchronous transactions. This flaw can cause unrelated file descriptors to be closed improperly due to stale buffer contents being misinterpreted as valid file descriptor numbers.
A vulnerability in the Linux kernel binder driver causes file descriptor fixups to leak when a TF_UPDATE_TXN transaction supersedes a pending asynchronous transaction in a frozen process. This leak occurs because the outdated transaction is freed without properly releasing associated file references, leading to permanent memory consumption and potential exhaustion of file descriptors over time.
CVE-2026-98776 is a use-after-free (UAF) vulnerability in the Linux kernel's binderfs subsystem. The flaw occurs when binder_add_device accesses a freed device object due to a race condition involving directory entry removal and reference dropping. This vulnerability has been fixed in affected Linux kernel versions.
A use-after-free vulnerability exists in the Linux kernel's nitro_enclaves component triggered on SLOT_ALLOC failure in the ne_create_vm_ioctl() function. The error path improperly handles the freeing of ne_enclave, causing ne_enclave_release() to dereference a freed object, leading to a KASAN slab-use-after-free error. The issue is fixed by clearing enclave_file->private_data before fput() on the error path, preventing the unsafe dereference. Normal enclave operations are unaffected by this fix.
CVE-2026-98774 is a medium severity vulnerability in the Linux kernel's rust_binder component. The issue involves deferred work items on a thread's todo list not being cleaned up properly in the Thread::release() method if the thread dies during an active outgoing transaction. This flaw has been resolved by updating the code to ensure cleanup of deferred work items even if they remain deferred at thread exit.
CVE-2026-98773 is a use-after-free vulnerability in the Linux kernel's USB cdc-acm driver. It occurs when the acm_port_shutdown() function restarts USB Request Blocks (URBs) after the device has been disconnected, leading to access of freed DMA memory. The flaw is fixed by adding a check to prevent URB resubmission during disconnect. This vulnerability affects specific Linux kernel versions and has a medium severity rating with a CVSS score of 5.4.
A use-after-free vulnerability in the Linux kernel's USB serial driver has been fixed. The issue involves race conditions during port teardown, where completion handlers may access freed driver data. The fix reorders disconnect handling to ensure ports are not deregistered until all I/O operations have stopped and the driver disconnect callback has completed.
A vulnerability in the Linux kernel's usb storage driver for Sierra MS devices allows a malicious USB device to leak up to 5 bytes of stale kernel heap memory to unprivileged userspace via a short IN transfer in the GetSwocInfo request. This occurs because the driver does not properly reject short transfers, leaving uninitialized memory exposed through a world-readable sysfs attribute. The issue affects specific Linux kernel versions and has a low severity rating.
A vulnerability in the Linux kernel's USB gadget MIDI2 driver involves incorrect sizing of jack descriptor arrays. The arrays for jack inputs and outputs were sized based on MAX_CABLES, but since entries are added for both inputs and outputs, the arrays were undersized. This mismatch can lead to out-of-bounds (OOB) access when many jacks are configured via configfs. The issue has been fixed by adjusting the array sizes to twice MAX_CABLES.
A vulnerability in the Linux kernel's usb gadget driver f_uac1_legacy allows out-of-bounds access due to improper validation of the bRequest index in generic_set_cmd() and generic_get_cmd(). This can be triggered by a malicious USB host sending crafted SET_CUR or GET_CUR requests, causing heap memory corruption.
A vulnerability in the Linux kernel's usb typec anx7411 driver was fixed by ensuring the IRQ is stopped before destroying the workqueue. The IRQ is devm-managed and could queue work during removal, causing potential issues. This flaw affects multiple specific Linux kernel versions.
A vulnerability in the Linux kernel's USB DWC3 gadget driver causes an interrupt request (IRQ) storm due to improper handling of an invalid event buffer count. When the event count exceeds the buffer length, the interrupt line remains asserted, leading to a kernel panic triggered by spurious interrupts.
A use-after-free vulnerability exists in the Linux kernel's usb gadget driver for aspeed-vhub. The issue arises because a wake work item is not properly cancelled during device removal, allowing a queued work item to run after the device and its ports have been freed. This can lead to unsafe memory access. The fix involves cancelling the work item correctly and adding synchronization to prevent re-arming the work after cancellation.
A vulnerability in the Linux kernel's dummy-hcd USB gadget driver could allow a gadget driver's unbind routine to run before all outstanding request completions have finished. This flaw arises because the driver does not properly track request completion callbacks, potentially permitting the gadget driver's module to be unloaded while a completion handler is still running. The issue has been fixed by adjusting the callback usage counter to include request completion callbacks.
CVE-2026-98764 is a vulnerability in the Linux kernel's USB gadget FunctionFS driver where a NULL pointer dereference can occur. This happens when user space sets up FunctionFS with only full-speed descriptors but the gadget operates at a higher speed. The kernel attempts to access a descriptor index that does not exist, causing a kernel panic. The issue is fixed by implementing fallback logic to lower speed descriptors and safely returning an error if no valid descriptor is found.
A vulnerability in the Linux kernel USB core affects the handling of non-ep0 control endpoints. Specifically, when disabling such endpoints with reset_hardware set, only one direction's endpoint pointer is cleared, leaving the other pointing to a disabled or freed endpoint. This flaw has been fixed by ensuring both endpoint pointers (ep_in and ep_out) are cleared. The issue was tested and resolved in Linux kernel 7.3.0-rc3.
A vulnerability in the Linux kernel USB driver (dwc2) involves improper handling of the wakeup timer during host controller driver (HCD) state freeing. The wakeup timer is not shut down before freeing HCD state, which can lead to timer callbacks accessing freed memory. This issue has been resolved by ensuring the timer is stopped and shut down before HCD resources are freed.
CVE-2026-98761 is a vulnerability in the Linux kernel's USB Type-C Port Manager (tcpm) related to handling the FAST_ROLE_SWAP (FRS) Alternate Mode State (AMS). The flaw occurs when the tcpm fails to start the FRS AMS, leaving VBUS power sourcing enabled incorrectly after a cable disconnect event. This can cause the port to remain in an invalid state without proper reset, potentially leading to unexpected behavior in USB Type-C power role swapping.