A NULL pointer dereference vulnerability exists in the Linux kernel's usb: cdns3 driver during the PCI probe process. This occurs when the second function of the Cadence USBSS controller is probed before the first function has set its driver data, leading to a kernel crash. The issue is resolved by deferring the probe until the first function completes its initialization.
A vulnerability in the Linux kernel's tty vcc component involved a control packet structure that was not fully zero-initialized before being sent, potentially leaking kernel stack data to a peer. This issue has been resolved by ensuring the control packet is zero-initialized prior to use.
CVE-2026-98754 is a use-after-free vulnerability in the Linux kernel's tty vcc driver. The issue occurs because vcc_cleanup() clears the tty pointer without holding the required port lock, leading to a race condition with callbacks that access the tty pointer under the lock. This can cause a callback to dereference a freed tty port, potentially leading to memory corruption or system instability.
CVE-2026-98753 is a vulnerability in the Linux kernel's tty subsystem where the TTY_IO_ERROR flag is not restored on activation failure. This flaw can lead to kernel panics or NULL-pointer dereferences when accessing powered down or deregistered TTY ports due to race conditions between ioctl calls and port hangups. The issue occurs because the flag is only reset during tty_port_close(), leaving a window where drivers may mishandle ioctl-hangup races.
A race condition vulnerability in the Linux kernel's tty port handling was fixed by adding missing serialization to the tty_port_tty_vhangup() and tty_port_hangup() functions. The flaw could cause use-after-free and NULL-pointer dereferences during concurrent hangup operations, potentially leading to kernel instability or crashes.
CVE-2026-98751 is a vulnerability in the Linux kernel's tty subsystem involving a race condition between break signalling ioctls and hangup events. This race can cause calls into a tty driver for a device that may no longer be present or powered down. The issue has been addressed by requiring drivers to handle this race properly and abort break signalling to avoid unsafe callbacks after user-controlled timeouts or device reopenings.
A race condition vulnerability in the Linux kernel's TTY subsystem involving saved termios reset on device registration has been fixed. The issue arises when a minor device number is reused for a different device without properly resetting saved termios state, potentially causing a use-after-free condition. This can prevent the port from opening under certain settings. The fix introduces a new flag to ensure saved termios state is reset only when safe.
CVE-2026-98749 is a vulnerability in the Linux kernel's max3100 serial driver where a timer is not properly shut down before the port is freed. This can lead to a timer callback accessing freed memory, potentially causing instability. The issue arises during system suspend and resume sequences when the SPI device is unbound before resume. The fix involves proper timer teardown, freeing IRQs, and destroying workqueues to prevent race conditions and use-after-free scenarios.
A use-after-free vulnerability in the Linux kernel's serial driver for 8250_bcm7271 was fixed. The flaw occurs in the brcmuart_remove() function where a high-resolution timer callback can dereference freed memory due to improper timer cancellation order. This issue was identified by static analysis and affects specific Linux kernel versions.
A NULL pointer dereference vulnerability exists in the Linux kernel's serial core component within the serial_core_unregister_port() function. This occurs when the port device pointer is NULL due to no port device being installed or removed during teardown. The flaw can lead to a kernel crash when the function dereferences this NULL pointer. The issue has been fixed by adding checks to return early if no port device is present and properly clearing the port device pointer on error paths.
A clock reference leak vulnerability was identified and fixed in the Linux kernel's ma35d1 serial driver. The issue involved the ma35d1serial_probe() function failing to release clock references obtained via of_clk_get(), leading to resource leaks on error paths and during port removal.
CVE-2026-98745 is a vulnerability in the Linux kernel's arm64/fpsimd signal handling code affecting systems that support SME but not SVE. It occurs when restoring a crafted SVE signal context causes the task to have non-streaming SVE state, which is unsupported by the hardware. This can lead to fatal undefined instruction exceptions (EL1 UNDEF) and kernel panics during state restoration. The flaw arises because the kernel fails to reject signal contexts where the streaming mode flag is clear but an SVE payload is present. The issue has been resolved by correcting the context restoration logic to reject such invalid states.
CVE-2026-98744 is a medium severity vulnerability in the Linux kernel's ASoC codec max98363 driver. The issue arises because the stream_config structure is not properly initialized before being passed to sdw_stream_add_slave(), causing the type field to contain uninitialized (garbage) data. This uninitialized value is then copied to stream->type by sdw_config_stream(). The vulnerability has been fixed by zero-initializing stream_config so that the type defaults to SDW_STREAM_PCM.
CVE-2026-98743 is a medium-severity vulnerability in the Linux kernel's ASoC codec driver for rt1017-sdca-sdw. The issue arises because the stream_config->type field is uninitialized before being passed to sdw_stream_add_slave(), potentially causing it to contain garbage data. This field is later copied to stream->type by sdw_config_stream(). The fix involves zero-initializing stream_config so that type defaults to SDW_STREAM_PCM and using a helper function to set parameters correctly.
A concurrency vulnerability in the ALSA sequencer component of the Linux kernel allows improper serialization of compat port-info ioctl requests. This flaw can cause port index wrapping and duplicate port addresses, potentially leading to use-after-free conditions when subscribers are torn down.
CVE-2026-98741 is a vulnerability in the ALSA ua101 driver in the Linux kernel where mismatched capture and playback USB packet sizes are not properly validated. This can cause out-of-bounds memory writes during playback initialization, leading to potential kernel memory corruption. Genuine UA-101/UA-1000 hardware is unaffected due to proportional packet size declarations. The flaw was identified in specific Linux kernel versions and has a high severity rating.
A vulnerability in the Linux kernel's EDAC/altera driver involves the improper use of the __init attribute on ECC setup functions. These functions, which run during device probing, may be called after the __init memory is freed due to deferred probing or manual unbind/rebind operations. This can lead to dereferencing freed memory, causing potential instability or crashes. The issue affects specific Linux kernel versions used in various Ubuntu releases.
CVE-2026-98739 is a race condition vulnerability in the Linux kernel's Bluetooth RFCOMM implementation. It involves a race in managing the initial port reference between installation and release paths, which can lead to a use-after-free condition. This flaw was detected by KASAN and can cause kernel memory corruption. The issue affects specific linux-aws kernel versions. A fix has been implemented to use atomic bit operations to prevent double dropping of the reference.
CVE-2026-98738 is a high-severity vulnerability in the Linux kernel's Bluetooth subsystem. It involves a race condition in the handling of remote Out-Of-Band (OOB) data during Secure Manager Protocol (SMP) pairing. The flaw arises because SMP accesses remote OOB data without proper serialization, allowing concurrent removal of the data that can lead to use-after-free errors. This issue was detected by Kernel Address Sanitizer (KASAN) and could cause memory corruption. The vulnerability affects specific linux-aws kernel versions. A fix has been implemented by introducing a dedicated mutex to serialize access to remote OOB data, preventing concurrent modification and use-after-free conditions.
CVE-2026-98737 is a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem affecting the hci_sync component. The flaw arises from improper locking during inquiry cache lookups and updates, leading to potential access of freed memory. This issue has been fixed by ensuring proper locking and safe memory handling during Bluetooth inquiry cache operations.