CVE-2026-98223 is a vulnerability in the Linux kernel's memory management subsystem related to the handling of mapped dropbehind folios. The flaw involves the improper unmapping of these folios during writeback completion, which can cause a sleeping-in-atomic warning due to operations that may sleep in non-preemptible contexts. The issue has been resolved by retaining mapped dropbehind folios instead of forcibly unmapping them.
CVE-2026-98222 is a high-severity vulnerability in the Linux kernel's KEYS encrypted subsystem. It involves an integer overflow in the datablob_len parameter used in encrypted_key_alloc(), which stores this length in a 16-bit unsigned integer. If the computed length exceeds the maximum value for a u16, the allocation size is truncated, leading to a slab-out-of-bounds write when copying the master key description. This flaw can cause memory corruption. The vulnerability has been addressed by adding overflow checks and using safer memory allocation methods.
A vulnerability in the Linux kernel's KEYS subsystem related to TPM2 command processing was fixed by correcting boundary checks in the tpm2_load_cmd() function. The issue involved improper boundary checks against the ASN.1 size, which has been addressed by using the decoded blob size for validation.
A use-after-free vulnerability was fixed in the Linux kernel's i2c atr driver. The issue occurred when i2c_atr_add_adapter() failed to add an adapter but left a dangling pointer in the adapter slot, which could lead to use-after-free during cleanup and prevent reuse of the slot. This flaw was addressed by clearing the slot on error before freeing the channel.
A use-after-free vulnerability in the Linux kernel's IB/mlx4 driver was fixed. The issue occurs when pkey sysfs registration fails for a slave device, leading to stale pointers being used during device cleanup and causing a use-after-free condition. The fix clears parent pointers after releasing a failed slave tree and skips unregistered trees during cleanup to prevent double freeing.
A vulnerability in the Linux kernel's SELinux implementation caused incorrect user security identifier (SID) handling across nested backing files, such as overlayfs over overlayfs or FUSE passthrough backed by overlayfs. This flaw led to mprotect() calls incorrectly denying access or checking the wrong target SID, resulting in access denials under SELinux enforcing mode. The issue was fixed by preserving the user SID correctly across nested backing files.
CVE-2026-98214 is a vulnerability in the Linux kernel's SELinux implementation involving the mprotect() system call. The issue allows bypassing SELinux checks on intermediate backing files in nested stacked filesystems, specifically overlayfs mounts. While mmap() checks all backing layers, mprotect() only checks the top and bottom layers, skipping intermediate ones, potentially allowing unauthorized execution permissions. The flaw has been addressed by enhancing the security checks to include all intermediate layers during mprotect().
A use-after-free vulnerability in the Linux kernel's MMC core subsystem was fixed by ensuring that SDIO IRQ work is cancelled before the host is freed. The issue could cause a worker to run after the host is freed, potentially leading to a kernel crash or undefined behavior.
A use-after-free vulnerability in the Linux kernel's MMC subsystem was fixed. The issue involved retry work that could run after the associated memory was freed during driver removal, leading to potential dereferencing of freed memory. This was addressed by using devm_work_autocancel() to properly cancel and drain the retry work before releasing the allocation.
A use-after-free vulnerability in the Linux kernel's MMC driver (mmci) was fixed. The issue occurs because the busy-timeout work can be queued after the mmci device has been removed, leading to dereferencing freed memory. The fix involves masking controller interrupts and disabling delayed work during device removal to prevent this condition.
A use-after-free vulnerability in the Linux kernel's mmc mxcmmc driver was fixed by ensuring that asynchronous data work and watchdog timers are properly canceled during device removal. Without this fix, the watchdog timer and data work could fire after the host structure was freed, leading to potential kernel memory corruption.
A vulnerability in the Linux kernel's mmc sdhci-of-aspeed driver was fixed by ensuring that child devices are unregistered before releasing parent clock and managed resources. The issue involved probe failure and removal leaving SDHCI child devices registered after the parent resources were released, potentially causing resource management inconsistencies.
A vulnerability in the Linux kernel's mmc sdio_uart driver causes a memory leak of the transmit FIFO buffer when the port table is full. The function sdio_uart_add_port() allocates the transmit FIFO before securing a slot in the port table. If no slots are available, the function returns an error but fails to free the allocated FIFO, resulting in a resource leak.
A vulnerability in the Linux kernel's MMC SPI driver causes incorrect accounting of transferred bytes after retrying data block transfers that initially failed due to CRC errors. This can lead to the system reporting more bytes transferred than actually completed, potentially exceeding the requested transfer size. The issue occurs because the bytes transferred counter is not reset before retrying the data request, causing inaccurate completion reporting.
A vulnerability in the Linux kernel's cyttsp5 input driver involves improper handling of the HID report size before a memcpy operation. The size field, derived from the device, is used directly as the memcpy length into a fixed-size buffer, which could lead to memory corruption. This issue has been resolved in specific Linux kernel versions.
A vulnerability in the Linux kernel's evdev input subsystem allows partial copying of uninitialized stack memory in the EVIOCSABS ioctl handler. This occurs because the handler copies only the user-supplied size into a stack structure without zeroing it first, potentially leaking stale kernel stack data back to userspace via EVIOCGABS. The flaw was fixed by zeroing the structure before copying user data.
A vulnerability in the Linux kernel's rmi_smbus input driver causes an out-of-bounds read in the rmi_smb_write_block() function. The issue arises when chunking writes into SMBus blocks, where the length calculation incorrectly uses the total length instead of the remaining length, leading to reading beyond the input buffer. This flaw has been fixed by correcting the length calculation and pointer advancement.
A vulnerability in the Linux kernel's input subsystem related to soc_button_array was fixed by adding a check to ensure btns_desc->package.count is not zero before accessing btns_desc->package.elements[0]. This prevents potential invalid memory access.
A vulnerability in the Linux kernel's synaptics-rmi4 input driver can cause a General Protection Fault (GPF) during system suspend and resume if the driver is unbound. This occurs because transport drivers call suspend and resume functions on child devices even when the physical driver failed to bind, leading to a NULL pointer dereference when driver data is missing. The issue is fixed by adding checks to exit early if no driver data is attached.
A vulnerability in the Linux kernel's input subsystem involves uninitialized stack memory disclosure via the force feedback effect structure. The compat path input_ff_effect_from_user() copies only a smaller prefix of the native ff_effect structure, leaving the tail uninitialized. This uninitialized data can be leaked to userspace through a uinput-based force feedback daemon, potentially disclosing kernel stack memory.