A heap out-of-bounds write vulnerability exists in the Linux kernel's ksmbd component within the krb5_authenticate() function. The flaw occurs when processing SMB2_SESSION_SETUP as a non-first element in a compounded SMB2 request, causing an incorrect calculation of buffer headroom. This miscalculation allows memcpy() to write past the end of the allocated buffer into adjacent kernel heap memory. The issue has been fixed by adjusting the calculation to correctly reflect the remaining buffer space.
CVE-2026-99082 is a vulnerability in the Linux kernel's KVM x86 virtualization component related to the handling of per-vCPU MMIO cache and memslot generations. The flaw involves improper use of memslots when the vCPU runs in System Management Mode (SMM), which can lead to stale cache entries and incorrect memory accesses. This can cause KVM to bypass write-tracking for certain memory pages, potentially allowing continued use of outdated shadow translations. The issue has been fixed by ensuring the active memslots are used for caching and validation, distinguishing between normal and SMM address spaces.
CVE-2026-99081 is a vulnerability in the Linux kernel's bnxt_en driver affecting Intel BCM57412 NetXtreme-E NICs. It involves incorrect DMA mapping length for padded small packets, causing the NIC's DMA engine to read beyond the mapped buffer boundary. This results in IOMMU DMA read faults and transmit queue timeouts. The issue arises because the DMA mapping length does not account for padding added to small packets, leading to a DMA read buffer overrun. The vulnerability was introduced after a commit that changed VLAN headroom handling, causing small packets to be positioned near page boundaries. The fix ensures the DMA mapping length matches the padded packet size by adjusting skb length before mapping.
A memory leak vulnerability in the Linux kernel's clear_inode() function has been resolved. The issue involved a hard-to-hit leak of xarray nodes, which could be triggered by certain operations such as madvise. The fix involves freeing excess xarray nodes by calling xa_destroy(), which also cycles the i_pages lock.
A critical vulnerability in the Linux kernel's mlx5e network driver allows stale XSK buffers to be released during refill retries when an XDP redirect to an AF_XDP socket fails due to a full RX ring. This can cause double publication of UMEM frames, leading to potential memory corruption and data integrity issues. The flaw is silent and does not produce kernel warnings. It was detected under high packet load conditions and has been resolved by marking WQEs as released immediately after driver-side free to prevent stale pointer usage.
CVE-2026-99078 is a critical vulnerability in the Linux kernel's mlx5e network driver related to AF_XDP zero-copy buffer management. It involves a flaw where stale XSK buffers may be released multiple times during MPWQE refill retries, potentially causing memory corruption. The issue occurs when buffer allocation fails with -ENOMEM, leading to improper handling of buffer release bitmaps. This flaw has been resolved by ensuring idempotent retries through proper bitmap management.
CVE-2026-99077 is a vulnerability in the Linux kernel's IPv4 UDP implementation where exceptions in the FIB nexthop exception (FNHE) cache are only created after matching a UDP packet to an existing socket. This allows off-path attackers to perform side-channel attacks to discover ephemeral UDP ports. Previous mitigations were bypassable. The fix involves always creating FNHE entries before socket matching, ensuring that attacker guesses always result in cache updates, preventing reliable side-channel discovery.
A vulnerability in the Linux kernel's IPv6 UDP handling allows off-path attackers to conduct side-channel attacks on the IPv6 exception cache to discover ephemeral UDP ports. The issue arises because exceptions are only created in the cache if a matching socket is found, enabling attackers to infer port usage. The vulnerability has been addressed by changing the kernel to always create exceptions before socket matching, preventing this side-channel. This fix may cause additional route lookups and exceptions but does not introduce new exception creation capabilities beyond previous behavior.
A vulnerability in the Linux kernel's rust_binder component causes a node's delivery and count state to become desynchronized when a thread exits while holding a pending node refcount increment. This occurs because the refcount increment is dropped due to no-op cancel functions, potentially causing the node to never be freed from the process's nodes tree after all external references are dropped. The issue is fixed by rescheduling the pending refcount update to the process's work queue on thread exit.
A vulnerability in the Linux kernel's IPv4 implementation allows a null pointer dereference during Path MTU (PMTU) updates when a nexthop group shrinks. This occurs because the code does not properly handle cases where the nexthop group size changes concurrently, leading to a kernel crash (KASAN null pointer dereference). The issue requires CAP_NET_ADMIN privileges in the network namespace, but can be exploited by local users in unprivileged user namespaces.
A vulnerability in the Linux kernel IPv4 implementation could cause an exception dump when a nexthop group shrinks during concurrent routing table dumps. This occurs due to a race condition where the nexthop group size changes between two related function calls, leading to a NULL pointer dereference. The issue has been resolved by stopping the walk when the indexed path is absent.
A vulnerability in the Linux kernel's IPv4 routing notification mechanism could cause a null pointer dereference when a nexthop group shrinks during route notification sizing. This occurs because the code does not properly handle the case where the nexthop group has fewer paths after an update, leading to a potential crash or instability. The issue has been resolved by stopping the sizing process when the indexed path is absent.
This vulnerability in the Linux kernel concerns a warning triggered by a race condition in route notification size handling. The issue arises when asynchronous route notifications for hardware flag changes are processed, potentially causing a legitimate size error that was previously misinterpreted as a bug. The fix removes the warning while maintaining error handling and notification to listeners.
A Linux kernel vulnerability related to IPv6 route notification size warnings has been addressed. The issue involves a race condition in fib6_info_hw_flags_set() where skb sizing and filling operations can mismatch due to concurrent changes, causing incorrect warnings. The fix removes the misleading warning while preserving error handling.
A type confusion vulnerability was fixed in the Linux kernel's ati_remote2 input driver. The issue involved device attribute handlers incorrectly using to_usb_device() on a usb_interface pointer, leading to invalid pointer usage. This was due to a change in how device attributes were managed, moving from the parent usb_device to the bound usb_interface devices without updating the callbacks accordingly.
A memory leak vulnerability in the ALSA ctxfi component of the Linux kernel was fixed. The issue occurred because the function dao_clear_input() removed mapper entries without freeing the allocated memory, causing a leak each time it was called. The fix involves properly freeing the allocated array after clearing the entries.
A reference leak vulnerability exists in the Linux kernel's btrfs filesystem scrub functionality. Specifically, the function scrub_print_warning_inode() fails to drop a local_root reference when paths_from_inode() fails, causing a reference leak. This issue occurs during error handling when printing scrub warnings, potentially leading to resource exhaustion over time.
A vulnerability in the Linux kernel's CAN network subsystem caused by missing skb header initialization can lead to a kernel panic. The issue arises because the skb_reset_mac_header(), skb_reset_network_header(), and skb_reset_transport_header() calls were removed, causing RX skbs to carry invalid header values. When these skbs reach packet_rcv_spkt(), an overflow in push length calculation triggers a kernel BUG and full machine panic. This flaw was originally reported in 2014 and has been reintroduced by a recent commit.
CVE-2026-99065 is a race condition vulnerability in the Linux kernel's cgroup cpuset subsystem related to CPU hotplug handling. The issue arises because the cpuset hotplug operation became synchronous, removing previous race handling code, but a subsequent change caused a race to reappear between cpu_active_mask updates and cpuset effective_cpus updates. This race can lead to the top cpuset having no active CPU, resulting in a NULL pointer dereference. The vulnerability affects specific Linux kernel versions and has been fixed by reintroducing a NULL check in guarantee_active_cpus().
A vulnerability in the Linux kernel's CIPSO option handling causes cached option offsets to become incorrect when CIPSO bytes are removed from a packet. This leads to consumers accessing wrong bytes, potentially causing incorrect interpretation and copying of packet data. The issue affects specific Linux kernel versions and has a high severity CVSS score of 8.1.