A Linux kernel vulnerability was fixed that prevented scheduling deferred kernel page table freeing during system boot. The issue caused kernel panics when using a boot-time function tracer with a filter, due to workqueue usage before initialization. The fix defers scheduling the freeing work until the system is fully booted.
CVE-2026-99092 is a vulnerability in the Linux kernel's riscv architecture related to the handling of bpf-jit execmem addresses. The issue arises because the patch_map() function incorrectly assumes that the vmalloc area is writable when CONFIG_STRICT_MODULE_RWX is disabled, leading to a page fault and failure to JIT compile BPF programs. This bug affects configurations where BPF text is made read-only unconditionally, causing the JIT compilation to fail. The vulnerability is similar to a previously fixed issue on arm64 and is addressed by properly handling execmem addresses based on CONFIG_EXECMEM. The !CONFIG_MMU builds are not affected. Multiple specific Linux kernel versions are impacted.
A vulnerability in the Linux kernel Bluetooth management (MGMT) subsystem caused incorrect status reporting for pending commands flushed on power off. Specifically, commands pending during power off were incorrectly reported as successful (status 0x00) instead of the appropriate error status (e.g., Not Powered). This could cause user-space Bluetooth daemons like bluetoothd to crash due to unexpected zero-length success responses. The issue was fixed by ensuring the correct status is passed back for such commands.
CVE-2026-99090 is a vulnerability in the Linux kernel's amdgpu driver where vblank counter reads are not properly serialized against GPU reset operations. This can cause lockdep warnings and tainting when accessing display hardware during reset. The fix involves acquiring the reset semaphore for reading before hardware access and using a cached software counter if reset is in progress, preventing unsafe hardware reads during reset.
This vulnerability in the Linux kernel's ASoC samsung i2s driver involves improper clock management during the probe function, leading to a runtime PM imbalance and a warning during system boot. The issue arises because the op_clk clock is set but not enabled, causing a double disable on the first runtime suspend. The fix involves enabling op_clk in the probe function to align clock states with runtime PM expectations and disabling it properly in the remove function.
A Linux kernel vulnerability in the Open vSwitch component was fixed by validating the presence of the transport header in the set_ipv6_addr function. The issue occurs when processing IPv6 fragments, where an uninitialized transport header pointer leads to a debug warning under CONFIG_DEBUG_NET=y. This warning is harmless but indicates improper handling of IPv6 fragment packets in checksum calculation.
A vulnerability in the Linux kernel's dm-integrity subsystem causes a NULL pointer dereference leading to a crash when the device is activated with the 'R' flag and the SB_FLAG_DIRTY_BITMAP flag is set. The issue occurs during the dm_integrity_resume function's attempt to read the journal containing the bitmap. The patch modifies dm-integrity to skip writes during resume if the device is activated in 'R' mode.
A vulnerability in the Linux kernel's dm-integrity module allows an attacker to modify the superblock on the underlying device while the dm-integrity device is suspended. This causes a mismatch between the in-memory and on-disk superblock data upon resume, potentially leading to out-of-bounds memory writes.
CVE-2026-99085 is a Linux kernel vulnerability affecting the CPU hotplug process when tasks managed by the BPF scheduler remain on a CPU that is going offline. This can cause the CPU hotplug thread to hang, potentially stalling the CPU offline operation. The issue arises because tasks on the BPF scheduler are still counted on the CPU's runqueue, but the CPU no longer dispatches these tasks, leading to a deadlock scenario. The fix involves re-enqueuing tasks on the local dequeue and ensuring dispatch continues until the runqueue goes offline.
CVE-2026-99084 is a vulnerability in the Linux kernel's readdir implementation where an inode lock is not taken on an immutable directory. This can cause readers to hold a shared lock for extended periods, potentially stalling other operations such as mkdir or lookups in certain mount namespaces. The issue affects specific Linux kernel versions and has been resolved by adding an immutable flag to directories that never change, allowing iterate_dir() to skip the lock.
A heap out-of-bounds write vulnerability exists in the Linux kernel's ksmbd component within the krb5_authenticate() function. The flaw occurs when processing SMB2_SESSION_SETUP as a non-first element in a compounded SMB2 request, causing an incorrect calculation of buffer headroom. This miscalculation allows memcpy() to write past the end of the allocated buffer into adjacent kernel heap memory. The issue has been fixed by adjusting the calculation to correctly reflect the remaining buffer space.
CVE-2026-99082 is a vulnerability in the Linux kernel's KVM x86 virtualization component related to the handling of per-vCPU MMIO cache and memslot generations. The flaw involves improper use of memslots when the vCPU runs in System Management Mode (SMM), which can lead to stale cache entries and incorrect memory accesses. This can cause KVM to bypass write-tracking for certain memory pages, potentially allowing continued use of outdated shadow translations. The issue has been fixed by ensuring the active memslots are used for caching and validation, distinguishing between normal and SMM address spaces.
CVE-2026-99081 is a vulnerability in the Linux kernel's bnxt_en driver affecting Intel BCM57412 NetXtreme-E NICs. It involves incorrect DMA mapping length for padded small packets, causing the NIC's DMA engine to read beyond the mapped buffer boundary. This results in IOMMU DMA read faults and transmit queue timeouts. The issue arises because the DMA mapping length does not account for padding added to small packets, leading to a DMA read buffer overrun. The vulnerability was introduced after a commit that changed VLAN headroom handling, causing small packets to be positioned near page boundaries. The fix ensures the DMA mapping length matches the padded packet size by adjusting skb length before mapping.
A memory leak vulnerability in the Linux kernel's clear_inode() function has been resolved. The issue involved a hard-to-hit leak of xarray nodes, which could be triggered by certain operations such as madvise. The fix involves freeing excess xarray nodes by calling xa_destroy(), which also cycles the i_pages lock.
A critical vulnerability in the Linux kernel's mlx5e network driver allows stale XSK buffers to be released during refill retries when an XDP redirect to an AF_XDP socket fails due to a full RX ring. This can cause double publication of UMEM frames, leading to potential memory corruption and data integrity issues. The flaw is silent and does not produce kernel warnings. It was detected under high packet load conditions and has been resolved by marking WQEs as released immediately after driver-side free to prevent stale pointer usage.
CVE-2026-99078 is a critical vulnerability in the Linux kernel's mlx5e network driver related to AF_XDP zero-copy buffer management. It involves a flaw where stale XSK buffers may be released multiple times during MPWQE refill retries, potentially causing memory corruption. The issue occurs when buffer allocation fails with -ENOMEM, leading to improper handling of buffer release bitmaps. This flaw has been resolved by ensuring idempotent retries through proper bitmap management.
CVE-2026-99077 is a vulnerability in the Linux kernel's IPv4 UDP implementation where exceptions in the FIB nexthop exception (FNHE) cache are only created after matching a UDP packet to an existing socket. This allows off-path attackers to perform side-channel attacks to discover ephemeral UDP ports. Previous mitigations were bypassable. The fix involves always creating FNHE entries before socket matching, ensuring that attacker guesses always result in cache updates, preventing reliable side-channel discovery.
A vulnerability in the Linux kernel's IPv6 UDP handling allows off-path attackers to conduct side-channel attacks on the IPv6 exception cache to discover ephemeral UDP ports. The issue arises because exceptions are only created in the cache if a matching socket is found, enabling attackers to infer port usage. The vulnerability has been addressed by changing the kernel to always create exceptions before socket matching, preventing this side-channel. This fix may cause additional route lookups and exceptions but does not introduce new exception creation capabilities beyond previous behavior.
A vulnerability in the Linux kernel's rust_binder component causes a node's delivery and count state to become desynchronized when a thread exits while holding a pending node refcount increment. This occurs because the refcount increment is dropped due to no-op cancel functions, potentially causing the node to never be freed from the process's nodes tree after all external references are dropped. The issue is fixed by rescheduling the pending refcount update to the process's work queue on thread exit.
A vulnerability in the Linux kernel's IPv4 implementation allows a null pointer dereference during Path MTU (PMTU) updates when a nexthop group shrinks. This occurs because the code does not properly handle cases where the nexthop group size changes concurrently, leading to a kernel crash (KASAN null pointer dereference). The issue requires CAP_NET_ADMIN privileges in the network namespace, but can be exploited by local users in unprivileged user namespaces.