A vulnerability in the Linux kernel Bluetooth subsystem (btintel) was identified where the function parsing version TLV values did not properly validate the length of the value for specific TLV types. This flaw could lead to out-of-bounds reads when processing malformed Bluetooth responses. The issue has been fixed by rejecting TLV values shorter than the minimum required length and responses missing the Command Complete Status field.
A vulnerability in the Linux kernel Bluetooth subsystem (btintel) involves improper handling of the firmware ID string. The firmware ID is expected to be NUL-terminated, but the code only uses the TLV length as a boundary, which can cause snprintf() to read beyond the intended buffer if no NUL terminator is present. This issue has been fixed by limiting the conversion to the advertised TLV value length.
A vulnerability in the Linux kernel Bluetooth L2CAP implementation (version 5.7) allows an out-of-bounds write in the l2cap_ecred_connect function. This occurs due to improper counting of pending ECRED channels, leading to one __le16 value being written outside the bounds of the scid array and sending an invalid ECRED_CONN_REQ. The issue is fixed by adjusting the counting logic to include non-deferred pending channels and moving the counting under a critical section to prevent exceeding the limit.
CVE-2026-98104 is a vulnerability in the Linux kernel's net/sched cls_u32 module where duplicate handles can be created when the node ID pool is exhausted. This occurs because the function gen_new_kid() returns a fallback handle value instead of reporting an error when ID ranges are full, causing handle uniqueness to break. Similarly, gen_new_htid() can return 0 when the handle pool is full, leading to aliasing of root tables. This flaw can be triggered by adding a large number of u32 filters or proto entries, causing collisions and potential cross-protocol node manipulation.
Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component (`get_export_status` in `src/export_manager.py`), whereby the `export_id` value — an unvalidated MCP tool argument reaching the function via the `check_rapid7_export_status` and `download_rapid7_export` tools — is interpolated directly into the GraphQL query string. A crafted `export_id` containing quote and brace characters can terminate the intended `export(id: "...")` selection early and append attacker-controlled root-level selections (for example, schema introspection), producing a single well-formed GraphQL document that is then sent to the Rapid7 export API under the operator's own API key.
Notably, this issue does not grant an existing actor any access they do not already have: every injected query executes within the operator's own already-authenticated API scope, using the operator's own valid API key, and cannot cross a tenant or account boundary. A directly-malicious operator gains nothing they could not already do by calling the API directly; the realistic exposure is limited to a compromised or careless upstream MCP client, or indirect prompt injection forwarding an unvalidated identifier. This is fixed in version 0.6.2, which passes `export_id` as a parameterized GraphQL variable (`$exportId: ID!`).
CVE-2026-98043 is a vulnerability in the Linux kernel's BPF verifier where a pointer with an unbounded offset is incorrectly inferred as non-NULL. This can lead to a NULL pointer dereference at runtime when the verifier assumes a pointer is valid based on its type alone, despite the actual runtime offset potentially resulting in a NULL value. The issue is fixed by requiring the offset to be within a defined bound in the verifier logic.
A vulnerability in the Linux kernel's BPF subsystem involves improper handling of special fields in recycled rhtab elements. This flaw allows a BPF program to retain a pointer to a map value after deletion, potentially leading to a timer callback executing with pointers to freed memory. The issue arises because recycled elements have their special fields reinitialized incorrectly, preventing proper cancellation of timers. The vulnerability has been fixed by ensuring special fields are not reinitialized on insertion, preserving ownership state for the destructor.
A vulnerability in the Linux kernel's BPF verifier allowed an attacker to write arbitrary bits into a kernel pointer (kptr) field by exploiting imprecise zero-value tracking. This could lead to loading attacker-controlled data as a PTR_TO_BTF_ID. The issue was fixed by marking known-zero registers as precise, ensuring the verifier rejects invalid paths.
A vulnerability in the Linux kernel allowed unprivileged users to set an excessively large tx_queue_len value, leading to oversized ring buffer allocations and potential global memory exhaustion. This issue affected several subsystems that allocate ring buffers based on tx_queue_len without an upper bound. The vulnerability has been fixed by capping tx_queue_len at S16_MAX (32767), rejecting oversized values at set time across all relevant interfaces.
CVE-2026-98013 is a vulnerability in the Linux kernel's fq_pie queuing discipline where the quantum value accepted from userspace is not properly clamped. This allows a crafted configuration to cause a soft lockup or denial of service by making the deficit-refill loop spin excessively under the qdisc lock. The issue affects Linux kernel version 5.6 and requires the CONFIG_NET_SCH_FQ_PIE option enabled and CAP_NET_ADMIN privileges. The vulnerability has been fixed by adding a minimum quantum clamp of 256, matching the fq_codel_change() implementation.
A vulnerability in the Linux kernel's net/sched subsystem related to the sfq (Stochastic Fairness Queueing) queuing discipline allows a crafted quantum value to cause a denial of service via a soft lockup. The issue arises because sfq_change() accepts any non-negative quantum, enabling a crafted packet length to trigger a long spinning loop under the qdisc lock. This can cause a denial of service condition. The vulnerability affects specific Linux kernel versions and has been fixed by clamping the quantum value and rejecting excessively large values.
CVE-2026-98011 is a vulnerability in the Linux kernel's net/sched subsystem affecting the hhf queuing discipline. The flaw allows userspace to specify a quantum value as low as 1, which can cause the deficit-refill loop to spin excessively under the qdisc lock, leading to a soft lockup and denial of service. The issue is fixed by clamping the quantum value to a minimum of 256 in the change and init paths.
A vulnerability in the Linux kernel's net/sched drr (Deficit Round Robin) scheduler allows a crafted quantum value to cause a spin loop under the qdisc lock. This occurs because drr_change_class() rejects an explicit quantum of zero but falls back to a function with no minimum floor, enabling a crafted size table to cause the quantum to be effectively very large, leading to a spin loop. The issue requires the CONFIG_NET_SCH_DRR option enabled and CAP_NET_ADMIN privileges. The vulnerability has been fixed by clamping the quantum value within a safe range.
CVE-2026-97990 is a high-severity vulnerability in the Linux kernel's vdpa_sim_net component. It involves improper handling of the TX pull result, where a negative error value is incorrectly treated as a large unsigned length during RX processing. This flaw has been fixed by properly checking the TX pull result before using it and handling errors by completing the TX descriptor with zero bytes.
A vulnerability in the Linux kernel's vduse component caused incorrect handling of compat ioctl results, leading to leakage of file descriptors. The issue was due to the compat handler calling the native handler despite differences in command sizes, which caused native dispatch to return an error and overwrite the return value after a descriptor was installed. This flaw has been fixed in Linux kernel version 7.2.
A vulnerability in the Linux kernel's ethernet cortina driver was fixed by correcting the budget accounting in the gmac_rx() function. The function previously returned the remaining NAPI budget, but the caller incorrectly treated this value as the number of packets received, causing idle polls to report a full budget and remain scheduled unnecessarily. The fix returns the actual number of received packets and adjusts the free queue refill accounting accordingly.
A vulnerability in the Linux kernel tracing subsystem allows memory leaks when a histogram trigger is written with a value or variable modifier that is not allowed. The flaw occurs because certain error paths skip freeing allocated fields, leading to unreferenced memory objects. This issue has been fixed in Linux kernel versions 6.1.189, 6.4, and later commits.
A vulnerability in the Linux kernel's accel ethosu component related to the ethosu_job_open() function return value has been fixed. The issue involved a WARN_ON() macro returning 0 or 1 instead of the original negative errno, potentially causing incorrect error reporting. The fix removes the WARN_ON() to allow the file descriptor open operation to correctly pass the error code to userspace.
A vulnerability in the Linux kernel's netfs subsystem caused uninitialized return values in netfs_unbuffered_write() when preparation of the first subrequest fails. This could lead to returning unrelated errors instead of the actual write error. The issue was fixed by initializing the return value properly.
A vulnerability in the Linux kernel's XFS filesystem code causes the function xfs_defer_finish_one() to return an indeterminate error value when processing an empty work list. This can lead to a false fatal error during online repair operations, resulting in a SHUTDOWN_CORRUPT_INCORE error and interrupting the repair process.