A vulnerability in the Linux kernel's workqueue subsystem could cause a NULL pointer dereference when checking chained work. This occurs because the worker's current_pwq pointer may be NULL outside of work-item execution, leading to a fault before a warning is emitted. The issue has been fixed by adding a guard to ensure current_pwq is valid before the chained-work test.
A vulnerability in the Linux kernel's xen/netfront driver causes memory leaks when the function xennet_fill_frags() fails due to response chains having more slots than fit in the skb's fragments. The skb buffer is dequeued but not freed, leading to resource leakage.
CVE-2026-99056 is a high-severity vulnerability in the Linux kernel's strparser component. It involves a race condition where the __strp_recv function may still be running when the parser is being torn down, potentially leading to use-after-free (UAF) conditions. This flaw affects certain Linux kernel versions and has been addressed by adding locking mechanisms to ensure no in-flight __strp_recv calls are active during teardown. A reproducer exists that can turn the UAF into an exploit. The vulnerability primarily affects the espintcp user but the patch prevents future users from encountering this bug.
A vulnerability in the Linux kernel TCP zerocopy receive path could cause a kernel panic due to a null pointer dereference when processing net_iov fragments. This occurs because the code incorrectly dereferences a NULL page pointer for net_iov fragments, leading to a KASAN-detected panic. The issue has been resolved by rejecting all net_iov fragments before accessing page-backed data, preventing the fault.
CVE-2026-99054 is a high-severity vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) component. It involves improper teardown of topology server workqueues before closing subscriber connections, leading to race conditions that can cause use-after-free, reference count errors, and RCU stalls. This flaw allows potential corruption of kernel memory and impacts confidentiality, integrity, and availability of the affected system. The issue affects specific Linux kernel versions listed and has been resolved by changing the order of teardown operations and adding safeguards to prevent workqueue misuse.
CVE-2026-99053 is a use-after-free vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem. The flaw arises because tipc_node_find_by_name() returns a node pointer after releasing its RCU read lock without taking a reference, allowing concurrent cleanup of the node to free it while still in use. This can lead to accessing freed memory, causing potential kernel crashes or other impacts. The issue affects multiple Linux kernel versions and has been assigned a high severity rating with a CVSS score of 7.8.
This vulnerability in the Linux kernel SELinux subsystem involves improper preservation of native security labels on an already-initialized superblock when mounting an NFSv4 filesystem with security_label a second time. The issue causes SELinux to skip setting a critical flag, leading to silent disabling of per-file labeling on both the new and original mounts.
CVE-2026-99051 is a use-after-free vulnerability in the Linux kernel's fsverity subsystem. The issue arises because __fsverity_get_info() uses rcu_read_lock() without proper synchronization with fsverity_remove_info(), leading to potential use-after-free when accessing fsverity_info structures for different inodes concurrently. The vulnerability has a high severity with a CVSS score of 7.8.
A race condition in the Linux kernel gpio mpsse driver was fixed that could cause a use-after-free condition. The issue occurs when the IRQ poll worker is armed before it is properly published, allowing a disconnect operation to miss the worker and leading to access of freed memory. The fix involves synchronizing the publishing and arming of the worker within a critical section and adding a flag to prevent late arming during teardown.
A vulnerability in the Linux kernel's Xilinx GPIO driver causes a runtime power management (PM) leak on the request error path. The function pm_runtime_get_sync() increments the usage counter even when it fails, and the error path does not properly decrement this counter, preventing the controller from runtime-suspending and leaving its clock enabled.
A deadlock vulnerability in the Linux kernel's GVE driver occurs when disabling XSK pools due to improper use of unlocked napi_disable and napi_enable calls while holding the netdev lock. This causes the thread to attempt re-acquiring a lock it already holds, resulting in a deadlock. The issue has been fixed by updating the NAPI calls to their locked versions.
A vulnerability in the Linux kernel's GVE driver causes a buffer leak of XSK buffers when rings are stopped. The issue occurs because GVE does not free XSK buffers when resetting ring state during queue stoppage, leading to resource leakage. This flaw has been observed in production environments and affects multiple specific Linux kernel versions.
CVE-2026-99046 is a high-severity vulnerability in the Linux kernel affecting certain versions of the linux-hwe-edge product. It involves a buffer leak in the AF_XDP zero-copy (ZC) mechanism when an error bit is set in the RX completion descriptor. Specifically, the XSK buffer was not freed properly on error, leading to a resource leak. This issue has been resolved in the affected versions listed.
A vulnerability in the Linux kernel's ibmveth driver was resolved involving improper cleanup of logical LAN resources on failure during the open operation. Specifically, if buffer pool allocation fails after registering the logical LAN, the cleanup function h_free_logical_lan() was not called, leaving the buffer-list page owned by PHYP when unmapped. This could lead to resource management issues.
A use-after-free vulnerability in the Linux kernel's ice driver was fixed. The flaw occurs during dynamic port cleanup when the code frees a VSI object before using its index to erase a dynamic port, leading to a use-after-free condition.
A vulnerability in the Linux kernel's ice driver involves improper reference count handling of metadata_dst objects during representor teardown. The flaw occurs because metadata_dst_free() is called directly, freeing memory without checking reference counts, potentially leading to use-after-free conditions when packets still hold references. This has been fixed by replacing metadata_dst_free() with dst_release(), which correctly manages reference counts and frees memory only when all references are dropped.
A vulnerability in the Linux kernel's io_uring/net subsystem allows bypassing of IPv6 connect filters due to improper handling of sockaddr_in6 address length. The io_connect_bpf_populate() function only populates connect filter fields when the address length is at least 28 bytes, but IPv6 connect paths accept a 24-byte length that already contains port and address information. This discrepancy causes filters that deny specific IPv6 ports or addresses to be bypassed, as the filter sees zeroed port and address values while the kernel connects to the intended destination.
A vulnerability in the Linux kernel's ip6_gre module related to obsolete ERSPAN Path MTU (PMTU) update handling has been resolved. The legacy PMTU update code in ip6erspan_tunnel_xmit() incorrectly dereferences a null pointer due to treating a metadata destination as a route without an output device, causing a kernel panic. This issue was triggered by specific user and network namespace configurations. The obsolete code was removed to align ERSPAN PMTU handling with IPv6 GRE, eliminating the null pointer dereference and preventing kernel crashes.
CVE-2026-99040 is a race condition vulnerability in the Linux kernel's key management subsystem. It involves a timing issue in the add_key() function where a writer can bypass keyring restrictions by exploiting a race between reading the restriction and linking a key. The flaw allows a writer with write permission on a destination keyring to link a key despite a reject-all restriction being installed. The issue was confirmed through concurrency testing and reproducer tools.
A use-after-free vulnerability exists in the Linux kernel memstick subsystem where asynchronous requests may write to memory after the associated card structure has been freed. This occurs because wait_for_completion_timeout() is used to wait for request completion, and if it times out, the card structure is freed while the request is still in flight. The issue is fixed by replacing wait_for_completion_timeout() with wait_for_completion() to ensure the card is not freed prematurely.