A vulnerability in the Linux kernel's iio gyro driver for the adis16136 sensor allows unprotected debugfs reads. The issue arises because the serial_number file operations do not call debugfs_file_get(), which is required by debugfs_create_file_unsafe(). This causes debugfs_remove_recursive() to not wait for ongoing reads, potentially leading to use-after-free conditions when the device is unbound. The flaw has been fixed by replacing debugfs_create_file_unsafe() with debugfs_create_file().
A NULL pointer dereference vulnerability exists in the Linux kernel's max30102 driver interrupt handler. The interrupt remains enabled for the device's lifetime, but the handler may dereference a NULL active_scan_mask when no buffer is enabled, causing a kernel NULL pointer dereference. The issue is fixed by checking the FIFO sample readiness early in the interrupt handler and returning if no data is available.
A vulnerability in the Linux kernel's iio: imu: adis16400 driver allowed unprotected debugfs reads due to improper handling of debugfs file operations. This could lead to a use-after-free condition when unbinding the device, as debugfs_remove_recursive() did not wait for ongoing reads to complete. The issue was fixed by switching to debugfs_create_file() for safer file creation and protecting debugfs reads properly.
A vulnerability in the Linux kernel's iio imu adis16480 driver allowed unprotected debugfs reads due to improper use of debugfs file operations. The issue was that firmware_revision and firmware_date file operations did not call debugfs_file_get(), causing debugfs_remove_recursive() to not wait for ongoing reads before freeing the device, potentially leading to use-after-free conditions. This flaw has been fixed by replacing debugfs_create_file_unsafe() with debugfs_create_file().
CVE-2026-98662 is a use-after-free vulnerability in the Linux kernel's iio light sensor driver for gp2ap020a00f. The issue occurs because the irq_work queued by the threaded IRQ handler may run after free_irq() is called, leading to a use-after-free when accessing freed trigger data. This was fixed by adding irq_work_sync() after free_irq() to ensure queued work is drained before cleanup.
A vulnerability in the Linux kernel's iio light driver for the rohm-bu27034 sensor caused an infinite delay when reading the integration time failed. The issue was due to using the error code to compute sleep time, which has been fixed by defaulting to the smallest integration time if reading fails. This flaw affects multiple specific Linux kernel versions used in Ubuntu distributions and is rated with low severity.
A vulnerability in the Linux kernel's bmp280 pressure sensor driver caused an out-of-bounds access due to incorrect indexing of the sampling frequency lookup table. This flaw was fixed by correcting the calculation of the number of rows in the frequency table before iteration.
A vulnerability in the Linux kernel's iio pressure sensor driver for rohm-bm1390 causes the data reading function to ignore cached error values and always return 0, even when a read operation fails. This issue was resolved by modifying the function to return the cached error value after stopping the measurement, allowing users to detect read failures and avoid using invalid data.
A vulnerability in the Linux kernel's AW96103 proximity sensor firmware parser allows improper validation of firmware data length. This can cause the parser to read beyond the allocated firmware buffer if the firmware image is truncated or malformed, potentially leading to memory corruption. The issue arises from underflow and incorrect length calculations in the firmware header processing.
A vulnerability in the Linux kernel's iio proximity pulsedlight driver caused the iio_device to remain registered after a power management setup failure during device probe. This left sysfs and character device nodes active, pointing to freed memory, potentially leading to use-after-free conditions. The issue has been fixed by ensuring the device is properly unregistered on error paths.
A use-after-free vulnerability exists in the Linux kernel's Industrial I/O (IIO) trigger subsystem. The issue arises because a deferred work item (reenable_work) is not canceled before the trigger is freed, allowing a worker to access freed memory. This flaw was identified via static analysis and fixed by canceling the work before freeing the trigger.
A vulnerability in the Linux kernel perf subsystem allowed unprivileged tasks to access kernel text poke events without proper kernel access permissions. This could reveal the runtime kernel text base address despite Kernel Address Space Layout Randomization (KASLR). The issue was resolved by requiring kernel access for text poke events regardless of exclude_kernel settings.
A vulnerability in the Linux kernel's KVM subsystem for the s390 architecture was fixed by correcting the _gaccess_shadow_fault() function. The issue involved nested guest memory pages that might not be present in the parent guest's gmap, causing erroneous error propagation to userspace. This flaw has been addressed by ensuring proper linking of the nested guest memory when missing.
A vulnerability in the Linux kernel's KVM s390 subsystem was fixed by adding a missing srcu lock in the kvm_s390_set_irq_state() function. This lock is necessary to safely perform the Store status operation, similar to the existing kvm_s390_inject_vcpu() function. The flaw could lead to issues in the kernel's handling of virtual CPU interrupt state.
A high-severity vulnerability in the Linux kernel's KVM s390 subsystem involves improper handling of NULL pointers in the dat_cond_set_storage_key() function. This flaw occurs when some callers pass a NULL oldkey pointer, leading to a potential NULL pointer dereference in page_cond_set_storage_key(). The issue has been fixed by adding a NULL check and assigning a dummy local variable to prevent crashes.
A race condition vulnerability in the Linux kernel's KVM s390 architecture implementation related to storage key functions has been fixed. The flaw involved potential concurrent splitting of large pages causing crashes due to improper handling of storage key operations. The fix involves safer pointer dereferencing and retry logic to avoid race conditions.
A race condition vulnerability in the Linux kernel's KVM s390 architecture implementation was fixed by using READ_ONCE() in the _destroy_pages_crste() function to prevent multiple dereferences of a pointer. This flaw could lead to inconsistent or unsafe memory operations during page destruction.
A vulnerability in the Linux kernel s390/uv subsystem could cause a potential out-of-bounds read when the system stores more than 85 secrets. This occurs because the uv_secret_list struct array holds only up to 85 items per page, but the code incorrectly loops over the overall count rather than the per sub-list count, leading to reading beyond the array bounds. The issue has been fixed by correcting the loop to use the per sub-list count of stored secrets.
CVE-2026-98647 is a vulnerability in the Linux kernel's BPF subsystem where a divide-by-zero error occurs in the btf_struct_walk() function. This happens when accessing a struct with a flexible array member and the element type size is zero, causing a division by zero at program load time. The issue arises specifically when the last member is a flexible array and the element type has no size, leading to a kernel crash during BPF program verification.
A medium-severity vulnerability in the Linux kernel's TCP stack involves an improper call to cond_resched() within inet_csk_listen_stop() when running under BPF context. This occurs during socket destruction of a listening socket with children in its accept queue, leading to a debug check failure due to a sleeping function being called in an invalid context. The issue arises because the cond_resched() call is not properly guarded against BPF context, causing kernel warnings or potential instability.