CVE-2026-98736 is a use-after-free vulnerability in the Linux kernel's Bluetooth subsystem related to enhanced SCO (Synchronous Connection-Oriented) setup. The flaw occurs because the hci_enhanced_setup_sync() function accesses a parent connection object without holding the necessary lock, allowing a race condition where the parent can be freed while still in use. This can lead to a kernel memory corruption detected by KASAN. The issue affects specific Linux kernel versions and has a medium severity rating with a CVSS score of 5.7.
CVE-2026-98735 is a use-after-free vulnerability in the Linux kernel's Bluetooth hci_core component. It arises from improper synchronization when scheduling ACL transmissions and deleting channels, leading to potential memory corruption. The flaw was detected by KASAN and involves race conditions between channel selection and teardown. This vulnerability affects specific Linux kernel versions and has a high severity score.
CVE-2026-98734 is a use-after-free vulnerability in the Linux kernel's Bluetooth hci_core component. It arises from improper serialization of SCO and ISO scheduling with connection teardown, leading to potential access of freed memory. The issue is fixed by holding the device lock across connection selection and transmission, preventing unsafe concurrent access and queue purging races.
CVE-2026-98733 is a use-after-free vulnerability in the Linux kernel's Bluetooth hci_core component. It arises from improper serialization of fragmented ISO packet queueing, where concurrent operations on the packet queue can lead to memory corruption and use-after-free conditions. This flaw has been addressed by holding the queue lock across the entire fragment batch to ensure safe concurrent access.
A buffer over-read vulnerability in the Linux kernel Bluetooth component (btintel) was fixed. The issue involved the btintel_hw_error() function printing exception information using skb->data + 1 without ensuring the 12-byte payload was NUL-terminated, potentially reading beyond the buffer's end. The fix bounds the print operation to the actual length of the data to prevent over-read.
A vulnerability in the Linux kernel Bluetooth subsystem (btintel_pcie) allows an integer overflow in the plen calculation in the btintel_pcie_recv_frame() function. The plen variable is a 16-bit unsigned integer computed as HDR_SIZE plus dlen, where dlen is a 16-bit field. If dlen is >= 0xFFFC, the addition wraps around, bypassing a length check and causing skb_trim() to truncate the packet improperly. This issue has been fixed by widening plen to a 32-bit integer to prevent overflow.
A vulnerability in the Linux kernel Bluetooth driver btintel_pcie allows a user-space process with HCI_CHANNEL_USER access to inject oversized TX packets, causing a buffer overflow in the send_frame() function. This occurs because the function copies data into a fixed-size 4096-byte buffer without properly rejecting packets that exceed the buffer size minus the PCIe header length. The issue has been resolved by rejecting packets larger than the allowed size on entry.
CVE-2026-98729 is a vulnerability in the Linux kernel affecting x86 memory management on AMD F15h processors. The issue arises because the kernel incorrectly applies virtual address alignment (va_align) to hugetlb mappings, causing address misalignment and triggering a kernel bug during huge page teardown. This affects certain AMD processors such as Carrizo and FX-8370E. The flaw has been resolved by modifying the alignment logic to skip randomization for hugetlbfs mappings.
A vulnerability in the Linux kernel's TPM driver (tpm2_get_random function) allows an off-by-four bounds check error when processing TPM2_ST_SESSIONS tagged responses. This flaw can cause memcpy() to read up to 4 bytes beyond the response buffer, potentially leaking stale buffer contents into the caller's random bytes. The issue arises because the bounds check does not account for a skipped 4-byte parameter size field in the response. The vulnerability has been fixed by correcting the bounds check to validate against the correct response length.
A vulnerability in the Linux kernel's nvme-multipath subsystem causes incorrect handling of zoned block device features. The namespace head is marked as zoned prematurely based on the command set identifier, leading to a mismatch when zone info reports zero zone size. This results in the head advertising zoned capability with a zero zone size, causing errors in zone reporting or writing operations due to invalid shifts. The fix involves setting the BLK_FEAT_ZONED feature only after the zone information is confirmed.
A vulnerability in the Linux kernel's nvme-multipath component allows an underflow in ANA log bounds checks. This occurs because the parser subtracts untrusted object sizes from the ANA log buffer size without verifying the current offset first, potentially leading to out-of-bounds reads. The issue has been fixed by adding checks to ensure offsets and sizes are consistent before parsing ANA data.
CVE-2026-98725 is a critical vulnerability in the Linux kernel's nvmet-auth component, specifically in the nvmet_auth_challenge() function. The flaw is an out-of-bounds write caused by incorrect size calculation of the challenge header, leading to memory corruption. This can trigger kernel panics due to KASAN slab-out-of-bounds errors. The issue affects multiple Linux kernel versions and has a high CVSS score of 9.2.
A vulnerability in the Linux kernel's nvmet pci-epf driver allows out-of-bounds reads due to improper handling of too-short SGL segments. This occurs when the host provides an SGL segment length smaller than one descriptor, causing the kernel to read memory outside the allocated buffer. The issue has been identified and fixed by rejecting segments that cannot hold at least one descriptor.
A vulnerability in the Linux kernel's nvmet subsystem causes the host ID to be copied incorrectly during controller initialization, leading to improper handling of Preempt and Abort operations in namespace reservations. This results in the preempting host incorrectly believing it has aborted the victim's in-flight I/O, while the victim's I/O continues. The issue affects multiple specific Linux kernel versions and has a CVSS score of 6.9 (medium severity).
A divide error vulnerability in the Linux kernel's block2mtd module occurs when the erase_size parameter is set to zero, leading to a division by zero during device initialization. This issue has been fixed by rejecting zero erase_size values before the modulo operation.
A vulnerability in the Linux kernel's Cadence NAND interrupt handler was fixed by ensuring the IRQ state is initialized before requesting the IRQ. The issue involved a race condition where a pending interrupt could access uninitialized synchronization state due to the IRQ being registered before initialization of the IRQ lock and completion object.
CVE-2026-98720 is a vulnerability in the Linux kernel's KVM nested virtualization (nVMX) implementation. It involves a failure to refresh the MSR bitmap when runtime eVMCS controls are modified, which can lead to improper TPR virtualization handling. This flaw allows a nested guest (L2) or the intermediate guest (L1) to read and write the host's (L0) TPR register incorrectly. The issue has been resolved by forcing a refresh of the vmcs02 MSR bitmap during nested VM-Enter when runtime eVMCS controls are updated.
CVE-2026-98717 is a vulnerability in the Linux kernel's KVM x86 memory management unit (mmu) subsystem. It occurs when shadow page table walks continue despite the root being invalid or a dummy root, leading to a NULL pointer dereference and kernel crash. This happens if memslot creation races with a stage-2 page fault, causing KVM to use the zero page incorrectly. The issue has been resolved by terminating shadow walks immediately when encountering a dummy root, preventing the NULL pointer dereference.
A vulnerability in the Linux kernel's KVM SVM implementation was fixed by ensuring the active VMCB's MSR bitmap is used when checking if an MSR is intercepted. Previously, the code incorrectly assumed usage of a specific bitmap (vmcb02) when L2 was active, which could lead to improper MSR interception handling.
CVE-2026-98715 is a low-severity vulnerability in the Linux kernel's KVM SVM implementation. It involves improper handling of TLB control on a failed VMRUN instruction, which can cause the CPU to skip a required TLB flush. This flaw may lead to unnecessary flushing of all ASIDs on subsequent successful runs, potentially causing performance noise but no direct security compromise. The issue arises from clearing TLB control on failure, which drops the flush operation. The vulnerability affects specific Linux kernel versions listed explicitly. There is no indication of active exploitation or critical impact.