A use-after-free vulnerability was discovered and fixed in the Linux kernel's hp-wmi-sensors hwmon driver. The issue occurs because the fungible_show() function reads a sensor state pointer after the lock protecting it has been released, allowing a race condition where the pointer may be freed and replaced concurrently. This can lead to a use-after-free read when multiple processes access the sensor's current_state simultaneously.
A vulnerability in the Linux kernel hwmon subsystem (pmbus/core) related to phase count handling has been fixed. The patch increases the number of supported phases to 16 and adds a new mask for controlling the output voltage source. This addresses a bug that could cause out-of-bounds writes when probing certain hardware devices with more than 10 phases, such as those supported by the mp2975 and mp2856 drivers.
A vulnerability in the Linux kernel's hwmon pwm-fan driver could cause a timer callback to access freed tachometer data, leading to potential kernel instability. The issue arises because the RPM timer is not stopped before the tach data arrays are freed during driver detach, causing use-after-free conditions. The flaw has been fixed by ensuring the timer is properly retired before releasing its backing data.
A use-after-free (UAF) vulnerability exists in the Linux kernel's brcmsmac wifi driver in the brcms_free_timer() function. The flaw occurs because cancel_delayed_work() does not wait for an in-flight timer callback to complete before freeing the timer structure, potentially leading to memory corruption. This issue has been fixed by adding cancel_delayed_work_sync() to ensure the callback finishes before freeing memory.
A vulnerability in the Linux kernel's iwlegacy wifi driver causes improper deallocation of broadcast stations when RF_KILL is toggled during driver startup. The issue arises because only part of the station's 'used' field is cleared on an error path, leading to double deallocation. This flaw has been fixed by clearing the entire 'used' field to prevent repeated deallocation.
CVE-2026-98194 is a use-after-free vulnerability in the Linux kernel's libertas_tf WiFi driver. The flaw occurs in the lbtf_free_adapter() function, where command buffers are freed before ensuring that any running timer callback has completed, leading to a potential dereference of freed memory. This issue has been fixed by changing the order of operations to wait for the timer callback to finish before freeing the buffers.
A vulnerability in the Linux kernel's wifi libipw component was fixed by rejecting TKIP frames that lack a full Michael MIC. The flaw involved the libipw_michael_mic_verify() function assuming an eight-byte MIC was always present, which could lead to reading beyond the buffer with short TKIP frames. The fix ensures the MIC is checked for presence before verification.
A use-after-free vulnerability was identified and fixed in the Linux kernel's wcn36xx WiFi driver. The issue involved improper teardown of the TX ack timer, where the timer_delete() function did not wait for any running callbacks to complete, potentially allowing a callback to access freed memory. The fix replaced timer_delete() with timer_shutdown_sync(), ensuring callbacks complete before teardown. This vulnerability affects specific Linux kernel versions and was found via static analysis.
A flaw in the Linux kernel's wlcore wifi driver causes a runtime power management reference to not be released on regulatory domain configuration failure. This can lead to resource mismanagement in affected kernel versions.
A vulnerability in the Linux kernel's wifi wilc1000 driver allows an out-of-bounds read in P2P public action frames. The flaw occurs because the code incorrectly assumes frames are long enough when parsing, leading to reading beyond the buffer boundary. This can cause the kernel to access invalid memory and potentially crash when processing frames from unauthenticated nearby devices in P2P listen mode.
A vulnerability in the Linux kernel's wilc1000 WiFi driver allows an out-of-bounds write to the RX buffer due to improper size validation of device-reported RX transfer sizes. This can cause memory corruption by writing up to approximately 32KB beyond the allocated buffer. The issue is fixed by dropping any RX transfer whose size exceeds the buffer and properly re-arming the RX engine to discard bogus frames.
A vulnerability in the Linux kernel's wifi p54 driver allows an out-of-bounds read due to improper validation of calibration curve data length. The p54_convert_rev0() and p54_convert_rev1() functions read calibration data from EEPROM using counts that are not validated against the actual data length, potentially causing memory access beyond the buffer. This flaw was fixed by rejecting entries where the counts do not fit the entry data.
A vulnerability in the Linux kernel's wifi p54 driver involves improper validation of exp_if records in the PDR_INTERFACE_LIST. The code reads a struct exp_if without ensuring the entire record fits within the entry, allowing reads beyond the EEPROM buffer boundary. This can lead to information leakage and potentially influence front-end selection behavior.
A vulnerability in the Linux kernel's mwifiex driver allows an out-of-bounds read when processing crafted RSN or WPA information elements in beacon or probe-response frames. The flaw arises because the pairwise-cipher OUI count from the information element is not properly bounded by the element's length, enabling reads beyond the allocated buffer.
A vulnerability in the Linux kernel's mwifiex driver involves improper validation of scan response extents. The function mwifiex_ret_802_11_scan() subtracts fixed response fields and firmware-provided BSS length from the response size without verifying that these extents fit, potentially causing an underflow and allowing the TLV parser to read beyond the intended buffer. This issue has been addressed by validating the fixed fields and BSS data before parsing the TLV data.
CVE-2026-98184 is a vulnerability in the Linux kernel's mwifiex wireless driver where improper handling of authentication frame length can lead to a heap buffer overflow. The flaw arises because the combined length of authentication data can exceed the maximum value storable in a 16-bit field, causing truncation and subsequent buffer overflow during data copy. Exploitation requires CAP_NET_ADMIN privileges and a suitable network environment. The issue has been resolved by validating length values before assignment.
A vulnerability in the Linux kernel's mac80211 wireless subsystem allows a monitor interface to be made active without a transmit queue, leading to a NULL pointer dereference in the ath9k driver. This occurs when the monitor interface is set active while down, causing the driver to dereference a NULL pointer and potentially crash the kernel. The issue is triggered by commands requiring CAP_NET_ADMIN privileges. The severity is low.
CVE-2026-98181 is an out-of-bounds write vulnerability in the Linux kernel's drm/gud component, specifically in the gud_plane_atomic_check() function. The flaw arises from incorrect indexing in a loop that writes plane properties, causing writes beyond the allocated array bounds. A USB device can trigger this vulnerability by advertising the maximum number of properties. The issue is fixed by correcting the indexing logic to prevent out-of-bounds writes.
A vulnerability in the Linux kernel's AMDGPU driver caused a memory mapping leak during device removal. The issue was due to the iounmap call being skipped, leading to a resource leak when the device is hot-unplugged or the module is removed. This has been fixed by unconditionally unmapping the memory region if it is not NULL.
A race condition vulnerability in the Linux kernel ALSA bcd2000 driver was resolved. The issue involved a use-after-free (UAF) scenario during USB disconnect handling when rawmidi trigger callbacks accessed URBs concurrently without proper synchronization. The fix introduced a spinlock to serialize rawmidi operations and URB clearance, preventing concurrent access issues.