A vulnerability in the Linux kernel IPv4 implementation could cause an exception dump when a nexthop group shrinks during concurrent routing table dumps. This occurs due to a race condition where the nexthop group size changes between two related function calls, leading to a NULL pointer dereference. The issue has been resolved by stopping the walk when the indexed path is absent.
A vulnerability in the Linux kernel's IPv4 routing notification mechanism could cause a null pointer dereference when a nexthop group shrinks during route notification sizing. This occurs because the code does not properly handle the case where the nexthop group has fewer paths after an update, leading to a potential crash or instability. The issue has been resolved by stopping the sizing process when the indexed path is absent.
This vulnerability in the Linux kernel concerns a warning triggered by a race condition in route notification size handling. The issue arises when asynchronous route notifications for hardware flag changes are processed, potentially causing a legitimate size error that was previously misinterpreted as a bug. The fix removes the warning while maintaining error handling and notification to listeners.
A Linux kernel vulnerability related to IPv6 route notification size warnings has been addressed. The issue involves a race condition in fib6_info_hw_flags_set() where skb sizing and filling operations can mismatch due to concurrent changes, causing incorrect warnings. The fix removes the misleading warning while preserving error handling.
A type confusion vulnerability was fixed in the Linux kernel's ati_remote2 input driver. The issue involved device attribute handlers incorrectly using to_usb_device() on a usb_interface pointer, leading to invalid pointer usage. This was due to a change in how device attributes were managed, moving from the parent usb_device to the bound usb_interface devices without updating the callbacks accordingly.
A memory leak vulnerability in the ALSA ctxfi component of the Linux kernel was fixed. The issue occurred because the function dao_clear_input() removed mapper entries without freeing the allocated memory, causing a leak each time it was called. The fix involves properly freeing the allocated array after clearing the entries.
A reference leak vulnerability exists in the Linux kernel's btrfs filesystem scrub functionality. Specifically, the function scrub_print_warning_inode() fails to drop a local_root reference when paths_from_inode() fails, causing a reference leak. This issue occurs during error handling when printing scrub warnings, potentially leading to resource exhaustion over time.
A vulnerability in the Linux kernel's CAN network subsystem caused by missing skb header initialization can lead to a kernel panic. The issue arises because the skb_reset_mac_header(), skb_reset_network_header(), and skb_reset_transport_header() calls were removed, causing RX skbs to carry invalid header values. When these skbs reach packet_rcv_spkt(), an overflow in push length calculation triggers a kernel BUG and full machine panic. This flaw was originally reported in 2014 and has been reintroduced by a recent commit.
CVE-2026-99065 is a race condition vulnerability in the Linux kernel's cgroup cpuset subsystem related to CPU hotplug handling. The issue arises because the cpuset hotplug operation became synchronous, removing previous race handling code, but a subsequent change caused a race to reappear between cpu_active_mask updates and cpuset effective_cpus updates. This race can lead to the top cpuset having no active CPU, resulting in a NULL pointer dereference. The vulnerability affects specific Linux kernel versions and has been fixed by reintroducing a NULL check in guarantee_active_cpus().
A vulnerability in the Linux kernel's CIPSO option handling causes cached option offsets to become incorrect when CIPSO bytes are removed from a packet. This leads to consumers accessing wrong bytes, potentially causing incorrect interpretation and copying of packet data. The issue affects specific Linux kernel versions and has a high severity CVSS score of 8.1.
CVE-2026-99063 is a Linux kernel vulnerability in the device mapper ioctl interface where a buffer over-read can occur due to improper bounds checking of the data_start pointer relative to the buffer size. This flaw can cause a small out-of-bounds read of up to seven bytes past the allocated buffer. The issue arises because the struct dm_ioctl has trailing padding, and the kernel code does not clamp data_start to the actual buffer size. The vulnerability can only be triggered by root privileges and has been fixed by clamping data_start to the buffer size.
A vulnerability in the Linux kernel's vsock/virtio subsystem caused incorrect accounting of unread bytes in the read_skb() function. This led to underflow of the rx_bytes counter after partial stream receives, resulting in negative socket buffer indications, empty reads returning ELOOP, and misleading poll reports of socket readability. The flaw was fixed by adjusting the accounting to subtract only the unread portion of the packet, preventing counter underflow and ensuring accurate exposure of queued data.
A race condition vulnerability in the Linux kernel's brcmfmac WiFi driver can cause a kernel crash when the driver is removed while a user space process that created a P2P device (such as wpa_supplicant) is still exiting. This occurs due to the P2P device interface being removed twice, leading to a use-after-free fault and kernel panic.
A vulnerability in the Linux kernel's mt7603 wifi driver involves the use of an uninitialized global station WCID for certain frames, including those injected via a monitor interface. This flaw can lead to a NULL pointer dereference causing kernel crashes. The issue has been fixed by initializing the WCID before publishing it, with testing confirming stability and no resets during frame injection and data transfer.
CVE-2026-99059 is a high-severity vulnerability in the Linux kernel's WireGuard implementation related to the Noise protocol handshake. It involves a race condition where two threads process the same response message concurrently, potentially causing inconsistent handshake state and session creation. The flaw arises from improper synchronization during cryptographic state updates in the handshake process. Although exploitation is considered highly unlikely in practice, the vulnerability could allow an attacker to interfere with session establishment, impacting confidentiality and integrity. The issue has been resolved by adding a check comparing ephemeral private keys to ensure state consistency.
A vulnerability in the Linux kernel's workqueue subsystem could cause a NULL pointer dereference when checking chained work. This occurs because the worker's current_pwq pointer may be NULL outside of work-item execution, leading to a fault before a warning is emitted. The issue has been fixed by adding a guard to ensure current_pwq is valid before the chained-work test.
A vulnerability in the Linux kernel's xen/netfront driver causes memory leaks when the function xennet_fill_frags() fails due to response chains having more slots than fit in the skb's fragments. The skb buffer is dequeued but not freed, leading to resource leakage.
CVE-2026-99056 is a high-severity vulnerability in the Linux kernel's strparser component. It involves a race condition where the __strp_recv function may still be running when the parser is being torn down, potentially leading to use-after-free (UAF) conditions. This flaw affects certain Linux kernel versions and has been addressed by adding locking mechanisms to ensure no in-flight __strp_recv calls are active during teardown. A reproducer exists that can turn the UAF into an exploit. The vulnerability primarily affects the espintcp user but the patch prevents future users from encountering this bug.
A vulnerability in the Linux kernel TCP zerocopy receive path could cause a kernel panic due to a null pointer dereference when processing net_iov fragments. This occurs because the code incorrectly dereferences a NULL page pointer for net_iov fragments, leading to a KASAN-detected panic. The issue has been resolved by rejecting all net_iov fragments before accessing page-backed data, preventing the fault.
CVE-2026-99054 is a high-severity vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) component. It involves improper teardown of topology server workqueues before closing subscriber connections, leading to race conditions that can cause use-after-free, reference count errors, and RCU stalls. This flaw allows potential corruption of kernel memory and impacts confidentiality, integrity, and availability of the affected system. The issue affects specific Linux kernel versions listed and has been resolved by changing the order of teardown operations and adding safeguards to prevent workqueue misuse.