A vulnerability in the Linux kernel memstick subsystem (rtsx_usb_ms driver) causes requests to be dropped silently after eject instead of being properly completed. This leads to a hang during device removal, as the memstick core waits indefinitely for request completion. The issue is fixed by ensuring all requests are completed with an error once eject is set, preventing hangs during removal.
A vulnerability in the Linux kernel's dm-crypt subsystem involving the lmk IV mode with AEAD ciphers has been resolved. The issue causes a kernel oops due to out-of-bounds memory access when pairing an AEAD cipher with the lmk IV mode. This memory corruption can only be triggered by root privileges and is not considered a security bug. The fix rejects the use of the lmk IV mode with AEAD ciphers to prevent the issue.
A race condition in the Linux kernel device mapper (dm) subsystem was fixed where reading free memory could occur during the do_resume operation. This happens because dm_table_get_mode is called without holding locks, allowing a concurrent ioctl to swap the table and cause dm_table_get_mode to read freed memory. The issue was triggered by syzbot and fixed by reading the mode before swapping the table. This is not considered a security bug since only root can trigger it and common tools do not invoke the relevant ioctls concurrently.
A use-after-free vulnerability in the Linux kernel's mtk-sd MMC driver was fixed by ensuring that the request timeout work is properly canceled on driver removal. The flaw involved a race condition where a timeout callback could access freed host resources, leading to potential memory corruption.
A vulnerability in the Linux kernel's sdhci-sprd driver involves improper handling of runtime power management (PM) during device removal. The driver enables runtime PM on probe but does not correctly disable it on removal, potentially leading to clock management issues if the device is runtime suspended. The issue was identified through manual code inspection and has been fixed in specific commits.
A vulnerability in the Linux kernel's packet_rcv_spkt() function could cause a kernel panic when processing packets on devices without a visible link layer header, such as CAN interfaces. This occurs because the function attempts to restore the link layer header without verifying its presence, leading to an invalid memory operation and system crash. The issue affects Linux kernel versions 5.9.13 through 5.10. The flaw has been fixed in Linux kernel version 5.10 and later.
CVE-2026-99032 is a use-after-free vulnerability in the Linux kernel's SMC (Shared Memory Communications) subsystem, specifically in the smc_getname function. The flaw occurs because smc_getname dereferences a pointer to a CLC socket without properly holding a lock, allowing asynchronous release of the socket during a getsockname() syscall. This can lead to a use-after-free or NULL pointer dereference, potentially causing kernel crashes or privilege escalation. The vulnerability affects certain Linux kernel versions and has been fixed in version 4.20 and later commits.
CVE-2026-99031 is a vulnerability in the Linux kernel's network bridge code where recursive multicast port cleanup can lead to excessive kernel stack usage. The issue arises because the deletion of certain multicast port groups calls back into the cleanup function recursively, consuming one kernel stack frame per port and potentially hitting the stack guard page. This vulnerability has been fixed by suppressing the recursive cleanup during the traversal of the same entry while maintaining normal deletion behavior for other callers.
CVE-2026-99030 is a high-severity vulnerability in the Linux kernel's networking code where stale bytes may be left in buffers during skb_copy_and_csum_bits() operations. This occurs when unreadable fragments cause partial copying, leaving uninitialized memory in buffers sent on the network, potentially leaking sensitive data. The issue affects Linux kernel version 6.12 and has been fixed in subsequent commits.
A memory leak vulnerability in the Linux kernel's sparx5 network driver was fixed by ensuring that allocated matchall entries are properly freed upon destruction. The flaw caused memory allocated for offloaded matchall filters to be leaked when these filters were deleted. This issue was identified and confirmed through testing with kmemleak on specific hardware. The fix involves freeing the allocated entries after unlinking them from the internal list.
A vulnerability in the Linux kernel's Xilinx axienet driver causes DMA buffers to leak when the dmaengine is stopped. This occurs because outstanding DMA-mapped socket buffers (SKBs) are not freed properly on interface stop, potentially exhausting IOMMU resources. The issue is fixed by ensuring all DMA buffers are freed on stop and adding synchronization to prevent race conditions during teardown.
CVE-2026-99027 is a vulnerability in the Linux kernel's network team driver where the reuse of socket buffers (skb) after a queue override can lead to a use-after-free condition. This occurs because a nonzero return from dev_queue_xmit() does not relinquish ownership of the skb, causing the queue override helper to improperly reuse freed memory. The flaw can trigger kernel memory corruption and a kernel panic under certain conditions.
A vulnerability in the Linux kernel's network team driver was fixed where broadcast packets could be leaked when no transmitable port was available. The function bc_transmit() failed to consume the socket buffer (skb) in this case, causing the socket write-memory charge to be retained improperly. This was addressed by freeing the skb on the no-port path while maintaining existing drop accounting.
CVE-2026-55422 is a medium severity cross-site scripting (XSS) vulnerability in the conda-forge.github.io website. The issue arises because two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML without sanitization. These strings include raw output from build logs, patch outputs, and tracebacks generated by the conda-forge autotick bot. No patches are publicly available at the time of publication.
A vulnerability in the Linux kernel's openvswitch component caused a soft lockup during netlink flow dumps on production compute nodes with thousands of datapath flows. The issue arises from the way softirqs are handled during flow statistics retrieval, leading to the dumping thread monopolizing CPU softirq processing and causing a system hang. The fix involves holding bottom halves off across the entire callback to prevent unbounded softirq processing and ensure proper CPU scheduling.
CVE-2026-99024 is a vulnerability in the Linux kernel's optee driver where TEE devices were registered before full initialization. This premature registration allowed access to uninitialized structures and mutexes, potentially leading to dereferencing null pointers and race conditions. The issue was fixed by deferring device registration until after full initialization of the optee structure.
A memory leak vulnerability in the Linux kernel's power sequencing code for pcie-m2 was fixed. The function of_regulator_bulk_get_all() allocates an array that the caller must free, but the pwrseq-pcie-m2.c code did not free this array, causing a memory leak. The fix adds an explicit kfree() call to release the allocated memory.
A vulnerability in the Linux kernel regulator driver for the LTC3676 device allows reading from write-only registers HRST and CLIRQ. These registers are command strobes where writing HRST triggers a hard reset and writing CLIRQ clears interrupts. Reading these registers triggers the commands, causing unintended board resets during register dumps.
A vulnerability in the Linux kernel's regulator subsystem was fixed by ensuring supply names are properly filled in the of_regulator_bulk_get_all() function. Previously, this function returned an array with uninitialized supply name fields, leading to potential dereferencing of uninitialized memory when the array was used by regulator_bulk_enable(). The fix copies each supply name into the array's allocation to ensure proper memory handling and prevent use of uninitialized data.
A vulnerability in the Linux kernel's TPS65224 regulator driver caused out-of-bounds array access due to incorrect linear range count for BUCK2-4 descriptors. This flaw could lead to reading invalid memory during voltage constraint checks. The issue affects Linux kernel versions >=6.6.157 <6.6.160 and version 6.10. It has been fixed by correcting the count to match the actual array size.