A vulnerability in the Linux kernel SMB client causes improper handling of compound wait errors during remote file operations. Specifically, if a later wait is interrupted or fails, an earlier remote file create operation may leave a handle open without proper cancellation, potentially causing resource leaks. The issue has been resolved by marking earlier operations as cancelled when synchronization aborts and ensuring proper cleanup of remote handles.
A vulnerability in the Linux kernel's XFS filesystem code allows memory allocation failures in the function xrep_newbt_add_blocks to cause block leaks and disrupt filesystem repairs. The issue arises because the code cannot both undo transactions and return errors properly, leading to filesystem instability during repair operations. The fix involves changing the allocation to a NOFAIL type, preventing the problem.
A vulnerability in the Linux kernel's netfilter ip6t_rt module allows an out-of-bounds read when processing IPv6 routing addresses with zero address count in non-strict match mode. This flaw can cause kernel panics or memory corruption due to reading beyond allocated structures. The issue is fixed by rejecting invalid rules and correcting loop termination logic.
A vulnerability in the Linux kernel's RISC-V KVM implementation allows race conditions during IMSIC attribute access with vCPU migration. This can cause stale interrupt file references to be accessed, potentially leading to incorrect interrupt handling and denial of service. The issue is fixed by serializing IMSIC attribute operations with the target vCPU mutex to prevent concurrent migration and access conflicts.
A race condition vulnerability in the Linux kernel Bluetooth management code (read_unconf_index_list()) can cause an out-of-bounds write due to improper synchronization of device flags during asynchronous controller setup. This flaw affects specific linux-aws kernel versions and has been resolved by allocating response space for every device on the hci_dev_list to prevent buffer overflows.
CVE-2026-98454 is a high-severity vulnerability in the Linux kernel's SMB client implementation. It involves out-of-bounds reads in the create context parsing logic, where malformed create-context chains can expose unintended memory areas. The flaw arises because the parser does not properly limit each context record to its declared size before dispatching handlers, leading to potential information exposure. The vulnerability affects specific Linux kernel versions and has been addressed by validating context boundaries and rejecting malformed chains.
A high-severity vulnerability in the Linux kernel's SMB client handling allows improper management of non-regular inodes such as symlinks during file creation operations. This can lead to resource leaks and improper inode handling, potentially impacting system stability and security.
A vulnerability in the Linux kernel's module loading process was fixed where the function codetag_load_module() failed to properly set an error code upon failure. This caused load_module() to incorrectly return success (0) even after the module teardown. Additionally, a memory leak issue was addressed for livepatch modules where allocated memory was not freed on error paths. The issue affects Linux kernel versions 6.15.4 through 6.16 and was resolved in version 6.16.
In the Linux kernel, the following vulnerability has been resolved:
vt: skip screen update for DEC alignment test on backgroup consoles
[BUG]
Recently, we encountered a KASAN warning as follows:
BUG: KASAN: slab-out-of-bounds in fb_pad_aligned_buffer+0x11f/0x140
Read of size 1 at addr ff1100015fd9f6a4 by task tty_fbcon_oob/1239
CPU: 7 UID: 0 PID: 1239 Comm: tty_fbcon_oob Not tainted 7.3.0-rc1 #100 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014
Call Trace:
<TASK>
...
kasan_report+0xf0/0x120
fb_pad_aligned_buffer+0x11f/0x140
ccw_putcs+0x86c/0xa80
fbcon_putcs+0x338/0x410
do_update_region+0x21d/0x450
do_con_write+0x1e0e/0x4880
con_write+0x13/0x80
n_tty_write+0x374/0x1010
file_tty_write.isra.0+0x404/0x7a0
...
reproduce:
1) open /dev/tty0, set a KDFONTOP ioctl with op.op = KD_FONT_OP_SET,
op.width = 8 and op.height = 16 (visible VC1)
2) open /dev/tty1, set a KDFONTOP ioctl with op.op = KD_FONT_OP_SET,
op.width = 28 and op.height = 24 (invisible VC2)
3) echo 3 > /sys/devices/virtual/graphics/fbcon/rotate_all
4) write EShash8(esc hash8) to tty1
[CAUSE]
All VCs render to the framebuffer. setfont only modifies the target VC's
font without resizing the framebuffer backing buffer (par->rotated.buf);
the buffer is only resized for the visible VC
(fbcon_do_set_font -> ... -> vc_do_resize -> update_screen). This relies on
the con_should_update() check performed before every update_region().
However, the ESC # 8 path (do_con_trol -> do_update_region) omits the
con_should_update() check. After changing the font size of an invisible VC,
do_update_region() fills using the new font size against a buffer that was
never resized, causing an out-of-bounds access.
[FIX]
Only push the update when the console is visible and not blanked, add
the con_should_update() check in the do_con_trol() like every other call
site of do_update_region() (update_region(), invert_screen(), ...).
CVE-2026-98834 is a vulnerability in the Linux kernel's memory technology device (mtd) core subsystem involving a double-free of the OTP NVMEM device. The issue occurs when the factory OTP setup fails after the user OTP NVMEM device has been registered, leading to multiple unregister attempts without clearing the pointer, which can cause memory corruption. This flaw has been fixed in Linux kernel versions 5.16, 6.2, 6.3, and 6.4.
A vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem allows oversized fragmented frames to cause an overflow in a 16-bit length field, leading to a kernel crash. The issue arises because the sum of fragment lengths can exceed the maximum value of a 16-bit unsigned integer, causing an integer overflow and buffer overflow during packet reassembly. This flaw has been fixed by dropping oversized fragments to prevent the overflow.
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) JIT constant blinding logic could cause an overflow of the jump offset, leading to a kernel crash when running certain BPF programs with hardened JIT enabled. This issue arises from improper handling of backward jump offsets that wrap around the signed 16-bit integer limit.
A vulnerability in the Linux kernel Bluetooth subsystem (btintel_pcie) was fixed to address a plen overflow in the btintel_pcie_recv_frame() function. The issue involved a 16-bit plen value that could wrap around when adding header size and data length, allowing packet truncation checks to be bypassed. The fix involved widening plen to 32 bits to prevent overflow.
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
nvmet_auth_challenge() receives its output buffer as a void pointer.
sizeof(*d) therefore evaluates to one with GCC and undercounts the fixed
challenge header by 15 bytes. A short AUTH_RECEIVE buffer can pass the
check before the challenge is copied past the end of its allocation.
Use the typed challenge pointer when calculating the response size.
BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)
Write of size 32 by task kworker/1:1H/64
Workqueue: nvmet_tcp_wq nvmet_tcp_io_work
Call Trace:
nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:442 drivers/nvme/target/fabrics-cmd-auth.c:569)
nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1119 drivers/nvme/target/tcp.c:1243)
nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1350 drivers/nvme/target/tcp.c:1382 drivers/nvme/target/tcp.c:1445)
process_one_work (kernel/workqueue.c:3322)
worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
The buggy address is located 16 bytes inside of
allocated 33-byte region [ffff888000554e80, ffff888000554ea1)
Kernel panic - not syncing: KASAN: panic_on_warn set ...
A NULL pointer dereference vulnerability was identified and fixed in the max30102 interrupt handler within the Linux kernel version 4.16. The issue occurs when an interrupt is triggered while no buffer is enabled, causing the handler to dereference a NULL active_scan_mask pointer. The fix involves checking the FIFO sample readiness early in the interrupt handler and returning immediately if no data is available, preventing the NULL dereference.
libLAS versions up to 1.8.1 have a heap out-of-bounds write vulnerability in the point record reader. This occurs due to truncation of the schema byte size to 16 bits when sizing the point buffer. Maliciously crafted .las files with a LASSchema variable length record exceeding 65535 bytes can cause memory corruption and crashes in tools like lasinfo, las2las, or las2txt.
CVE-2026-98570 is a vulnerability in the Linux kernel's IPv6 networking code where insufficient headroom is reserved for the MAC header in the dst_dev_overhead() function. This can cause a negative offset calculation and an out-of-bounds memory write during MAC header rebuilding when the MAC header is longer than expected, such as with VLAN devices with reorder_hdr off. The issue affects multiple seg6 encapsulation modes and related inline paths. The vulnerability has been fixed in Linux kernel versions 5.11, 5.16, 6.2, 6.7, 6.13, and 6.14.
A vulnerability in the Linux kernel cgroup cpuset subsystem allows conflicting exclusive CPU assignments between remote and local partitions. This occurs when remote_partition_enable() enables a remote partition on CPUs already claimed by an ancestor local partition, leading to inconsistent CPU exclusivity states. The issue was identified in Linux kernel version 6.16 and fixed by returning an error code (PERR_NOCPUS) to prevent such conflicts.
CVE-2026-98509 is a memory leak vulnerability in the Linux kernel's drm/virtio driver. It occurs when an execbuffer operation fails, causing a DRM event to be reserved but never properly cancelled or freed. This results in a permanent memory leak as the event remains orphaned without being released. The issue was discovered through fuzzing with Syzkaller and affects Linux kernel version 5.16.