A low-severity vulnerability in the Linux kernel's mac80211_hwsim component was fixed to prevent frames from being handed to mac80211 while the radio is stopping. The issue involved a race condition where the radio could stop after a check but before frame delivery, triggering a warning in mac80211. The fix expands mutex protection to synchronize frame delivery with radio stopping, eliminating the warning and dropping a noisy error print.
A NULL pointer dereference vulnerability was fixed in the Linux kernel's dmaengine ti k3-udma-glue driver. The flaw occurs when memory allocation for rx_chn->flows fails, leading to a NULL dereference in the error handling path during channel release. This issue was identified and resolved to prevent potential kernel crashes.
A vulnerability in the Linux kernel's SELinux component was fixed by ensuring the avc_has_perm_noaudit() function always fills the AVC decision structure. Previously, if the requested permission set was empty, the function returned early without initializing the decision buffer, leading to uninitialized data being used by callers. This could cause inconsistent or undefined behavior in access control decision handling.
A vulnerability in the Linux kernel watchdog driver da9063 causes improper suspend/resume handling when the hardware watchdog is running but userspace never opens the device. This leads to the watchdog continuing to count during system suspend, potentially causing unexpected system resets.
A vulnerability in the Linux kernel s390 boot code could cause an out-of-bounds write when appending IPL parameters to the command line if the command line occupies all but the terminating byte of the buffer. This issue has been resolved by changing how the IPL parameter is converted and appended to the command line buffer.
A NULL pointer dereference vulnerability in the Linux kernel's s390 architecture IPL (Initial Program Load) code was fixed. The issue occurs when kdump attempts to access a re-IPL parameter block that may not be provided by certain IPL types, leading to a NULL dereference. The fix ensures that kdump skips updating os_info when no re-IPL parameter block is available, preventing the NULL dereference and allowing the system to collect a crash dump and reboot properly.
A NULL pointer dereference vulnerability in the Linux kernel's s390 architecture IPL (Initial Program Load) handling was fixed. The issue occurs when the stand-alone dump process attempts to dereference a NULL re-IPL parameter block pointer if no re-IPL parameter block is provided by certain IPL types. This could cause the stand-alone dumper to enter a disabled wait state after completing the dump. The fix explicitly stores zero values for the IPL parameter block address and checksum when no re-IPL parameter block is available, preventing the NULL dereference.
CVE-2026-98398 is a vulnerability in the Linux kernel's lockdep subsystem where stale class_cache entries for zapped lock classes are not properly invalidated. This can cause lockdep to reference invalid or unrelated lock classes, leading to warnings and potential ABA issues during lock acquisition and validation.
A medium severity vulnerability in the Linux kernel's af_unix socket implementation causes a busy-wait condition when recv(0, MSG_PEEK) is called under specific conditions involving out-of-band data. This issue has been resolved by returning immediately when manage_oob() returns NULL for a zero-length buffer.
A vulnerability in the Linux kernel's IPv4 UDP implementation allows a UDP length overflow when Path MTU Discovery (PMTU) is set to IP_PMTUDISC_PROBE and the network device MTU is set larger than IP_MAX_MTU + 20. This overflow triggers a warning due to the 16-bit UDP length field wrapping around. The issue arises from improper bounding of the fragment size used in packet construction. This flaw has been fixed by bounding the fragment size to IP_MAX_MTU.
A bounds off-by-one vulnerability in the Linux kernel Bluetooth driver btintel_pcie was fixed by correcting the guard condition in the tx_handle function. The issue involved an out-of-range index access in the txq data structure, which could lead to improper memory handling. This flaw affects multiple specific Linux kernel versions used in various Ubuntu LTS releases.
CVE-2026-98391 is a vulnerability in the Linux kernel's drm/xe driver related to runtime power management (PM) during virtual machine (VM) teardown. The flaw allows the device to autosuspend while stale page faults from a torn-down VM are still queued, causing an assertion failure when the page-fault worker attempts to acknowledge these faults on a suspended device. The issue is addressed by holding a runtime PM reference across the entire page-fault queue worker to prevent autosuspension during fault acknowledgment.
CVE-2026-98390 is a vulnerability in the Linux kernel affecting virtualized systems, specifically involving a divide-by-zero error in the x86/amd_node topology code. On Xen PVH dom0 virtualized environments, the calculation of roots_per_node can be zero, causing a crash due to division by zero. The issue is mitigated by setting roots_per_node to 1 in these cases, with a firmware bug warning for non-virtualized systems.
CVE-2026-98389 is a vulnerability in the Linux kernel's AMDGPU driver where the gfx switch_power_profile function is invoked during GPU reset before the reset completes. This improper timing causes an assertion error due to register access without releasing the GPU reset semaphore. The issue has been resolved by skipping the switch_power_profile call during GPU reset.
A vulnerability in the Linux kernel's s390/crypto module was fixed by correcting the handling of return codes from skcipher_walk_virt() in the aes_s390 implementation. Improper checking of these return codes before processing loops could lead to undefined behavior or access to uninitialized memory. This issue affects specific versions of the linux-hwe-edge kernel and has a low severity rating.
A vulnerability in the Linux kernel's qla2xxx SCSI driver was fixed by changing how the QLAFX00 request ring slot is cleared. The issue involved using a plain memset() on device I/O memory, which can cause synchronous external aborts on architectures like ARM64. The fix replaces memset() with memset_io() to properly clear the I/O memory region.
CVE-2026-98388 is a Linux kernel vulnerability involving the improper ordering of the do_close_on_exec() function call relative to the exec_update_lock. The issue could cause blocking or deadlock scenarios, especially with hung filesystems or FUSE filesystems that inspect the calling process. The vulnerability has been addressed by moving the do_close_on_exec() call before acquiring the exec_update_lock, preventing potential deadlocks.
A vulnerability in NSD allows tokens of text in RDATA fields (such as TXT records) under 32 bytes to overflow the reserved space, causing out-of-bounds stack writes. This can overwrite a callback function pointer that is invoked immediately after parsing. The issue arises when zone files are fed directly to NSD, for example from an operator-controlled provisioning system, rather than those written out by NSD itself.
A vulnerability in NSD allows a HIP resource record that nearly fills the RDATA limit and includes another dname RDATA field to overwrite the stack with up to 191 bytes of attacker-controlled data. This issue arises when zone files are fed directly to NSD, such as from an operator-controlled provisioning system, rather than those written out by NSD itself. The vulnerability affects multiple specific NSD versions.
A vulnerability in NSD allows an attacker to overwrite the stack when a SVCB or HTTPS resource record (RR) fills the wire format RDATA completely, enabling the base64 decoder to write attacker-controlled data of unlimited size. This issue arises when zone files are fed directly to NSD, such as those from operator-controlled provisioning systems, but not for zone files written out by NSD itself for secondary zones.