A vulnerability in the Linux kernel's xen/netfront driver causes a memory leak when the function xennet_fill_frags() fails due to response chains exceeding the skb's fragment capacity. The error handling path fails to free the socket buffer (skb), resulting in leaked memory and attached pages.
CVE-2026-99056 is a race condition vulnerability in the Linux kernel's strparser component. It occurs because the code did not ensure that the __strp_recv function had completed before tearing down the parser, potentially leading to use-after-free (UAF) conditions. The issue affects only the espintcp user of strparser, but the patch prevents future users from encountering this bug. A reproducer has been published that demonstrates turning the UAF into an exploit. The vulnerability has a high severity score of 7.8 CVSS 3.1.
A vulnerability in the Linux kernel's skb_copy_and_csum_bits() function could cause stale memory bytes to be sent in network packets. When unreadable fragments are encountered, the function copies only the linear part of the buffer and leaves the rest unchanged, potentially leaking leftover memory contents in packets such as ICMP errors or driver TX bounce buffers. The issue has been fixed by zeroing the unfilled parts of the buffer to prevent unintended data leakage.
A vulnerability in the Linux kernel regulator driver for the LTC3676 chip involves improper reading of write-only HRST and CLIRQ registers. Reading these registers triggers unintended hardware actions, such as a hard reset or interrupt clear, causing the board to reboot unexpectedly during register dumps.
CVE-2026-98993 is a high-severity vulnerability in the Linux kernel related to namespace mount handling. It involves improper inheritance of the MNT_UMOUNT flag in the clone_mnt() function, which can lead to mounts being incorrectly detached or leaked within mount namespaces. This flaw can cause mounts to remain referenced after unmounting, potentially leading to resource leaks and inconsistent namespace states.
A Linux kernel vulnerability (CVE-2026-98996) involves the improper handling of busy mounts during synchronous unmount operations. The flaw allows a mount that is still in use to be silently unmounted due to insufficient checks in the propagate_mount_busy() function. This can occur in container environments where mount trees are shared and manipulated, leading to mounts being detached while still referenced by file descriptors.
A vulnerability in the Linux kernel's namespace handling allows recursive copying of an unmounted mount tree, which is unintended behavior. The issue arises because the function may_copy_tree() accepts mounts whose root is an nsfs or pidfs file before verifying if the mount is actually mounted. This can lead to copying an entire unmounted stack of mounts when using recursive bind mounts, which is a bug. The fix prevents walking an unmounted tree recursively, causing such operations to fail with EINVAL, while still allowing copying the root alone.
A vulnerability in the Linux kernel related to namespace handling has been resolved. The issue involves pseudo dentries, which are special directory entries for pipes, sockets, and other files that are not part of the normal filesystem hierarchy. These pseudo dentries should not become the root of a mount, but bind mounting /proc/self/fd/<fd> can cause this to happen. This leads to a race condition where a dentry can be freed while still being accessed, potentially causing instability. The fix prevents cloning a mount whose root is a pseudo dentry with the DCACHE_NORCU flag.
A vulnerability in the Linux kernel's dcache subsystem allows a mountpoint to be placed on a dentry that is in the process of being removed. This occurs due to a race condition between detach_mounts() and d_delete(), where a bind mount of a directory being removed can be moved beneath an existing mount, causing the mount to remain attached to a removed directory indefinitely.
A use-after-free (UaF) vulnerability in the Linux kernel's cgroup cpuset subsystem was addressed by avoiding direct access to a potentially stale pointer in the is_in_v2_mode() function. The fix introduces a new flag to safely indicate cpuset v2 mode, preventing unsafe memory access during cgroup filesystem rebinding.
CVE-2026-98980 is a vulnerability in the Linux kernel's namei subsystem where refwalk can reveal overmounted entries due to improper handling of unlinked mountpoints during path traversal. This flaw allows a narrow timing window where a refwalk may expose underlying filesystem entries that should be hidden after a mountpoint is unlinked. The issue arises because refwalk does not revalidate dentries after taking references, unlike rcuwalk, leading to potential information disclosure. The vulnerability has been addressed by adding checks for dentries marked as DCACHE_CANT_MOUNT to prevent revealing unlinked mountpoints during refwalk.
A vulnerability in the Linux kernel's unshare system call was resolved. The issue involved dropping active namespace references that were never taken, leading to reference count inconsistencies. This could cause namespaces the caller lives in to no longer be listed by listns(). The problem occurred when set_cred_ucounts() failed during ksys_unshare(), causing improper reference decrementing. The fix involved properly freeing nsproxy structures that were prepared but never installed.
A vulnerability in the Linux kernel's btrfs filesystem involving io_uring encoded data handling has been resolved. The issue occurs when returning -EAGAIN while leaving btrfs_uring_encoded_data in the command PDU, potentially causing data leaks if requests are cancelled or the ring exits before reissue. The vulnerability relates to improper freeing of driver PDU allocations on cleanup in io_uring operations. The fix ensures that allocations are freed appropriately on error returns to prevent leaks.
A vulnerability in the Linux kernel ext4 filesystem allows a crash due to a NULL pointer dereference when large folios are enabled on encrypted inodes. This occurs because enabling the encrypt feature on a mounted filesystem bypasses a check that disables large folios, leading to a kernel crash during encrypted data writes. The issue affects Linux kernel versions from 6.19 up to but not including 7.3, where the code was refactored to prevent this. The vulnerability has been resolved by disabling large folios on encrypted inodes, similar to the handling of inodes using data journaling.
CVE-2026-99063 is a Linux kernel vulnerability in the device mapper ioctl interface where a buffer over-read can occur due to improper bounds checking of the data_start pointer relative to the buffer size. This flaw can cause a small out-of-bounds read of up to seven bytes past the allocated buffer. The issue arises because the struct dm_ioctl has trailing padding, and the kernel code does not clamp data_start to the actual buffer size. The vulnerability can only be triggered by root privileges and has been fixed by clamping data_start to the buffer size.