A vulnerability in the Linux kernel's lan966x network driver was resolved involving improper restoration of RX state after a reload failure. Specifically, certain fields related to RX page geometry and page pool registration were not restored correctly if resource reallocation failed, causing inconsistencies in RX buffer handling. This could lead to the XDP path advertising incorrect frame sizes, potentially causing buffer mismanagement.
A resource management vulnerability in the Linux kernel's Microchip Sparx5 driver was resolved. The flaw involved improper cleanup of PSFP (Per-Stream Filtering and Policing) resources when the flower setup process failed, potentially leading to resource leaks. Specifically, allocated stream gate, flow meter, and stream filter resources were not released on error paths. Additionally, incorrect handling of flow meter IDs could cause erroneous deletion attempts and reference count inconsistencies.
A race condition vulnerability in the Linux kernel's imx mailbox driver was resolved by adding a channel shutdown field. The issue involved a timing window where the RX event could be re-enabled by an interrupt service routine while the shutdown process was waiting on free_irq(), potentially causing problems on shared interrupt handlers. This could lead to the irq-core shutting down the interrupt with a 'nobody cared' message if the removed channel triggered an interrupt.
A vulnerability in the Linux kernel's mac80211 WiFi component was resolved by validating the deauthentication frame length before accessing the reason code. The function ieee80211_rx_mgmt_deauth() previously read the deauthentication reason code without first confirming that the frame contained the expected fixed field, potentially leading to improper handling of malformed frames.
A vulnerability in the Linux kernel's 8250 serial driver related to the recognition of UPIO_AU (type 4) on MIPS Alchemy systems has been resolved. The issue caused warnings during the probe of the 8250 driver due to unsupported UART type 4. The fix involves recognizing UPIO_AU in the set_io_from_upio() function and taking no action since parameters are already set in the platform-specific setup. This fix has been tested on the Alchemy Au1300 platform.
CVE-2026-99079 is a critical vulnerability in the Linux kernel's mlx5e network driver affecting version 6.4. It involves improper handling of XSK buffers during refill retries when an XDP redirect to an AF_XDP socket fails due to a full RX ring. This can lead to double freeing of live buffers and double publication of UMEM frames, causing data corruption. The issue is silent with no kernel warnings. It has been fixed in specific commits.
A vulnerability in the Linux kernel's CAN network subsystem caused by missing initialization of socket buffer (skb) headers in the init_can_skb() function can lead to a kernel panic. This occurs because RX skbs carry an invalid mac_header value, which triggers an overflow in packet_rcv_spkt(), resulting in a kernel BUG and full machine panic. The issue was introduced by a commit that removed skb header resets and has been fixed in later kernel versions.
A vulnerability in the Linux kernel's vsock/virtio subsystem caused incorrect accounting of unread bytes in the read_skb() function. This led to underflow of the rx_bytes counter after partial stream receives, causing socket state inconsistencies such as negative byte counts reported by SIOCINQ, empty reads returning ELOOP, and poll indicating readability on empty sockets. The issue was fixed by adjusting the accounting to subtract only the unread portion of the packet from rx_bytes, ensuring accurate tracking of queued data.
CVE-2026-99046 is a high-severity vulnerability in the Linux kernel affecting version 6.17. It involves a buffer leak in the AF_XDP zero-copy (ZC) implementation when an error bit is set in the RX completion descriptor. Specifically, the XSK buffer was not freed on error, causing a resource leak. This issue has been fixed in specific commits of the Linux kernel.
A memory leak vulnerability in the Linux kernel's sparx5 network driver was fixed by ensuring that allocated matchall entries are properly freed upon destruction. The flaw caused memory allocated for offloaded matchall filters to be leaked when these filters were deleted. This issue was identified and confirmed through testing with kmemleak on specific hardware. The fix involves freeing the allocated entries after unlinking them from the internal list.
A vulnerability in the Linux kernel's mt76 wireless driver for the mt7915 device causes system instability when unloading and reloading the mt7915e module. The issue arises because the driver does not disable the receive NAPI (New API) before removing the device, leading to warnings and potential instability. This is particularly problematic for MT7916 devices that require module reloads with different parameters. The flaw has been fixed by properly disabling rx napi within the mt7915e driver during device removal.
A reference leak vulnerability was identified and fixed in the Linux kernel's thunderx network driver (nicvf_probe function). The flaw involved a failure to release a reference to the PTP PCI device if initialization failed after acquiring it, potentially causing resource leaks.
CVE-2026-98911 is a high-severity vulnerability in the Linux kernel's dpaa2-switch component. It involves an incorrect error handling path in the dpaa2_switch_rx() function, where the wrong function is called to free frame descriptors, potentially leading to improper memory management. The issue is fixed by adjusting the error handling to correctly unmap DMA pages and free memory depending on whether an SKB was created.