CVE-2026-99054 is a high-severity vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) component. It involves a race condition during the teardown of topology server connections where workqueues were destroyed improperly, leading to use-after-free and reference count errors. The flaw could cause socket callbacks and subscription events to queue work on already destroyed workqueues, resulting in potential kernel crashes or memory corruption. The issue has been fixed by changing the teardown order, refusing lookups after shutdown, and properly destroying workqueues before closing connections.
CVE-2026-99053 is a use-after-free vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem. The flaw occurs because tipc_node_find_by_name() returns a node pointer after dropping its RCU read lock without taking a reference, leading to a race condition where handlers may access a freed node. This can cause memory corruption and potentially allow privilege escalation or denial of service. The issue has been fixed by acquiring a reference to the node before leaving the RCU read lock and releasing it properly after use.
CVE-2026-99052 is a vulnerability in the Linux kernel's SELinux implementation affecting the handling of NATIVE_LABELS on already-initialized superblocks during mount operations. Specifically, when an NFSv4 filesystem exported with security_label is mounted a second time, SELinux fails to preserve the SECURITY_LSM_NATIVE_LABELS flag, causing the kernel to silently disable per-file security labeling on both the new and original mounts. This issue was fixed by ensuring the flag is set correctly on reused superblocks during mount option processing.
CVE-2026-99051 is a use-after-free vulnerability in the Linux kernel's fsverity subsystem. The issue arises because the freeing of struct fsverity_info is not properly synchronized with concurrent lookups, potentially leading to use-after-free conditions when different inodes access fsverity_info concurrently. This vulnerability has been fixed by introducing RCU-delayed freeing of the struct after removal from the rhashtable.
CVE-2026-99050 is a high-severity use-after-free vulnerability in the Linux kernel's gpio mpsse driver. It occurs due to a race condition when arming the IRQ poll worker, allowing the USB core to free memory while the worker still accesses it. The flaw is fixed by synchronizing worker publication and arming within a critical section and introducing a dying flag to safely manage teardown. The vulnerability affects Linux kernel versions from 6.18.6 up to but not including 6.18.57, and version 6.19. A fix is available in version 6.18.57.
A vulnerability in the Linux kernel's Xilinx GPIO driver causes a runtime power management (PM) reference leak when the gpio request function fails. This leak prevents the controller from runtime-suspending, leaving its clock enabled unnecessarily. The issue is fixed by changing the PM usage counter increment to occur only on success.
A deadlock vulnerability in the Linux kernel's GVE driver occurs when disabling XSK pools due to improper use of unlocked napi_disable and napi_enable calls while holding the netdev lock. This causes the thread to attempt to re-acquire a lock it already holds, resulting in a deadlock. The issue has been fixed by updating the NAPI calls to their locked versions.
A vulnerability in the Linux kernel's GVE driver causes a buffer leak of XSK buffers when rings are stopped. Specifically, the driver fails to free XSK buffers when resetting ring state during queue stoppage, leading to resource leakage. This issue has been encountered in production environments and has been fixed in certain commits.
CVE-2026-99046 is a high-severity vulnerability in the Linux kernel affecting version 6.17. It involves a buffer leak in the AF_XDP zero-copy (ZC) implementation when an error bit is set in the RX completion descriptor. Specifically, the XSK buffer was not freed on error, causing a resource leak. This issue has been fixed in specific commits of the Linux kernel.
A vulnerability in the Linux kernel's ibmveth driver was resolved involving improper cleanup of logical LAN resources on failure during the open operation. Specifically, if buffer pool allocation fails after registering the logical LAN, the driver fails to free the logical LAN resource before unmapping the buffer list, potentially leaving the hypervisor owning the buffer list page improperly. This issue was fixed by moving the logical LAN free operation to a shared cleanup path ensuring deregistration occurs before unmapping.
CVE-2026-99044 is a use-after-free vulnerability in the Linux kernel's ice driver related to dynamic port cleanup. The function ice_dealloc_dynamic_port() frees a VSI object before using its index to erase the dynamic port, causing a use-after-free condition. This flaw has been fixed by changing the order of operations to erase the xarray entry before freeing the VSI.
A vulnerability in the Linux kernel's ice driver involves improper reference count handling of metadata_dst during representor teardown. The flaw causes metadata_dst to be freed prematurely while references are still held, potentially leading to use-after-free conditions. This issue is fixed by replacing metadata_dst_free() with dst_release(), which correctly manages reference counts and memory cleanup.
CVE-2026-99042 is a vulnerability in the Linux kernel's io_uring networking code where a mismatch in address length checks allows bypassing of IPv6 connect filters. Specifically, the filter fields for connect.port and connect.v6_addr are not populated correctly for 24-byte sockaddr_in6 structures, causing filters that deny certain IPv6 ports or addresses to be bypassed. This issue has been fixed by adjusting the threshold to use SIN6_LEN_RFC2133 (24 bytes) as the correct length check.
A vulnerability in the Linux kernel's ip6_gre module involving obsolete ERSPAN Path MTU (PMTU) update handling has been resolved. The issue caused a null pointer dereference when processing metadata IP tunnel destinations without output devices, leading to kernel panic. The obsolete code was removed to align ERSPAN with IPv6 GRE PMTU handling.
A race condition vulnerability in the Linux kernel's key management subsystem was fixed. The flaw allowed a writer with write permission on a destination keyring to bypass keyring restrictions by exploiting a timing issue in add_key() operations. This could result in keys being linked despite a reject-all restriction. The issue was confirmed through extensive testing and was resolved by reordering the restriction check to ensure proper synchronization.
CVE-2026-99039 is a use-after-free vulnerability in the Linux kernel's memstick subsystem. It occurs because the subsystem frees the memstick_dev structure after a timeout without aborting in-flight asynchronous requests, leading to writes to freed memory. This flaw was fixed by replacing wait_for_completion_timeout() with wait_for_completion() to ensure requests complete before freeing memory.
A vulnerability in the Linux kernel memstick subsystem (rtsx_usb_ms driver) causes requests to be dropped silently after eject instead of being properly completed. This leads to a hang during device removal, as the memstick core waits indefinitely for request completion. The issue is fixed by ensuring all requests are completed with an error once eject is set, preventing hangs during removal.
A vulnerability in the Linux kernel's dm-crypt subsystem involving the lmk IV mode with AEAD ciphers has been resolved. The issue causes a kernel oops due to out-of-bounds memory access when pairing an AEAD cipher with the lmk IV mode. This memory corruption can only be triggered by root privileges and is not considered a security bug. The fix rejects the use of the lmk IV mode with AEAD ciphers to prevent the issue.
A race condition in the Linux kernel device mapper (dm) subsystem was fixed where reading free memory could occur during the do_resume operation. This happens because dm_table_get_mode is called without holding locks, allowing a concurrent ioctl to swap the table and cause dm_table_get_mode to read freed memory. The issue was triggered by syzbot and fixed by reading the mode before swapping the table. This is not considered a security bug since only root can trigger it and common tools do not invoke the relevant ioctls concurrently.
A use-after-free vulnerability in the Linux kernel's mtk-sd MMC driver was fixed by ensuring that the request timeout work is properly canceled on driver removal. The flaw involved a race condition where a timeout callback could access freed host resources, leading to potential memory corruption.