A use-after-free vulnerability in the Linux kernel's MediaTek SD card driver (mtk-sd) was resolved by ensuring proper cancellation of delayed work during device removal. The issue involved a timeout callback accessing freed resources after the driver had unbound and released host resources. This could lead to kernel memory corruption detected by KASAN during testing.
A vulnerability in the Linux kernel's drm/imagination driver caused incorrect sizing of page table preallocation. The issue stemmed from miscalculating the size of memory preallocation, leading to excessive allocation of MMU pages. This could exhaust system memory and cause an out of memory (OOM) panic. The vulnerability has been resolved by correcting the calculation to count tables properly and prevent underflow errors when mappings cross page table boundaries.
A vulnerability in the Linux kernel's mmc sdhci-sprd driver was resolved. The issue involved improper runtime power management (PM) cleanup during device removal, where runtime PM was enabled on probe but not properly disabled on remove. This could lead to clocks being disabled twice or in an inconsistent state if the device was runtime suspended during removal. The fix ensures the device is resumed before removal and runtime PM is properly disabled before clocks are turned off.
A vulnerability in the Linux kernel's packet_rcv_spkt() function could cause a kernel panic when processing packets on devices without a visible link layer header, such as CAN interfaces. The issue arises because packet_rcv_spkt() does not guard the link layer header push operation, leading to an invalid length calculation and a panic in skb_push(). This flaw was introduced when other receive paths were updated but packet_rcv_spkt() was not. The vulnerability has been resolved by adding the appropriate guard to prevent the panic.
A use-after-free vulnerability in the Linux kernel's net/smc subsystem was resolved. The flaw occurs in the smc_getname() function, which dereferences a pointer to a CLC socket without proper locking, allowing a race condition where the socket may be released asynchronously. This can lead to either a use-after-free or a NULL pointer dereference during getsockname() calls. The fix involves holding the clcsock_release_lock to serialize access and returning an error if the socket has already been released.
A vulnerability in the Linux kernel's network bridge component involving recursive multicast port cleanup has been resolved. The issue occurs in the function br_multicast_sg_del_exclude_ports(), which removes automatically added STAR_EXCL port groups by calling br_multicast_del_pg(). For certain S,G entries, this deletion triggers recursive calls that consume one kernel stack frame per port, potentially hitting the stack guard page and causing a stack overflow. The fix suppresses recursive exclude-port cleanup during the same entry walk while retaining the overall port-group deletion behavior.
A use-after-free vulnerability in the Linux kernel's network team driver was resolved. The issue involved improper reuse of socket buffers (skb) after a queue override operation, leading to potential kernel memory corruption and panic. The flaw was due to incorrect handling of dev_queue_xmit() results and skb ownership, causing a slab-use-after-free error detected by KASAN. This vulnerability could cause kernel crashes and instability.
A vulnerability in the Linux kernel's network team driver was resolved involving improper handling of broadcast packets when no transmitable port is available. The function bc_transmit() sends the original socket buffer (skb) through the last transmitable port, but if no port is transmitable, it returns false without consuming the skb. However, team_xmit() incorrectly returns NETDEV_TX_OK, causing AF_PACKET sockets to retain the skb and its associated socket write-memory charge, potentially leading to resource leaks. The fix ensures the original skb is freed on the no-port path while maintaining existing drop accounting.
A vulnerability in the Linux kernel's openvswitch component caused a soft lockup during netlink flow dumps on production compute nodes with many datapath flows. The issue arises because the softirq backlog refills as fast as it drains, causing the dumping thread to monopolize CPU time without rescheduling, leading to a system hang. The fix involves holding bottom halves off across the entire callback to prevent nested softirq draining, ensuring the CPU can reschedule properly.
A vulnerability in the Linux kernel's OP-TEE driver allowed TEE devices to be registered before full initialization, leading to potential use of uninitialized mutexes and NULL pointer dereferences. This occurred because tee_device_register() was called prematurely in optee_probe(), exposing devices to user and kernel space before the struct optee was fully set up. The issue has been fixed by deferring device registration until after complete initialization.
A vulnerability in the Linux kernel regulator driver for the LTC3676 chip involved reading write-only registers HRST and CLIRQ. These registers trigger hardware reset and interrupt clear commands when written, but reading them causes unintended board resets. The issue was resolved by making these registers writable only and preventing reads that cause resets.
A vulnerability in the Linux kernel's regulator subsystem was resolved involving the function of_regulator_bulk_get_all(). This function returned an array with uninitialized supply name fields, which could lead to dereferencing uninitialized memory when the array is used by regulator_bulk_enable(). The fix involved copying supply names into the array's allocation to ensure proper initialization and memory safety.
A vulnerability in the Linux kernel's SCSI changer driver (ch) caused references to data transfer element devices to be retained improperly. This led to scsi_device objects never being released after device removal, preventing the unloading of the low-level driver module and requiring a system reboot to recover. The issue was fixed by dropping the reference immediately after use and removing the unused array that caused the leak.
A race condition vulnerability in the Linux kernel Bluetooth subsystem (hci_sock) has been resolved. The issue involves rebinding an HCI socket after its controller is unregistered, which can lead to a kernel crash due to a NULL pointer dereference or use-after-free. The root cause is missing serialization when detaching dead devices, allowing concurrent access to freed or nullified device pointers.
A concurrency vulnerability in the Linux kernel Bluetooth ISO socket connect function (iso_sock_connect) has been resolved. The flaw allowed concurrent connect calls to bypass socket state checks, potentially leading to use-after-free conditions due to race conditions in connection setup and teardown. The fix serializes concurrent connect calls by marking the connect operation in progress and rejecting concurrent attempts until completion. This prevents destination overwrites and stranded connection references.
A vulnerability in the Linux kernel Bluetooth RFCOMM implementation causes a memory leak when the data link connection (DLC) has no owner. Specifically, the skb (socket buffer) is not freed in certain conditions, leading to resource leakage. This occurs because the socket implementation does not free the skb when the DLC owner is cleared, unlike the tty implementation which does. The leak can grow indefinitely while the remote device continues sending data.
A locking order vulnerability in the Linux kernel's Bluetooth RFCOMM implementation (CVE-2026-99009) has been resolved. The issue involves a circular locking dependency between rfcomm_mutex and hdev->lock during RFCOMM socket connection and HCI event handling, which can cause lockdep warnings and potential deadlocks. The fix changes the order of locking by connecting the session socket before acquiring rfcomm_mutex, eliminating the circular dependency. Additional safeguards were added to handle race conditions where sockets or DLCs might be closed during connection setup.
A NULL pointer dereference vulnerability in the Linux kernel Bluetooth RFCOMM subsystem was fixed. The issue occurs in the rfcomm_dev_shutdown() function when closing an RFCOMM tty device. If the tty device registration fails, a NULL pointer dereference can happen because the code does not check if the tty device pointer is NULL before using it. This can lead to a kernel crash (general protection fault). The fix adds a NULL check to prevent this dereference.
A vulnerability in the Linux kernel's drm/fb-helper component was resolved. The issue involved improper handling of failures in drm_fb_helper_single_fb_probe(), where failures other than -EAGAIN did not mark the fb_helper for deferred setup. This caused stale mode_set configurations to be committed later, triggering warnings. The fix ensures deferred setup is marked on any failure, preventing stale commits until a successful re-probe occurs.
A vulnerability in the Linux kernel's drm/i915/gem component could cause improper memory cleanup by overstepping the exec array boundary during relocation parsing. This occurs when the function eb_relocate_parse_slow() calls kvfree() on entries beyond the original exec array due to an incremented buffer count that includes appended VMAs. The issue has been resolved by ensuring relocation cleanup uses the original exec object count, excluding appended VMAs.