A vulnerability in the Linux kernel Bluetooth btnxpuart driver caused a memory leak when CONFIG_DEV_COREDUMP was disabled. Specifically, the function hci_devcd_append() returned an error without freeing a cloned socket buffer (skb), leading to a leak and preventing a recovery function from being called. This issue has been fixed by adding a guard to the function call based on the CONFIG_DEV_COREDUMP configuration.
A vulnerability in the Linux kernel's fbnic network driver related to flushing the firmware mailbox Rx ring has been resolved. The issue involved improper handling of the AW_FLUSH and AW_FLUSH_MODE bits during mailbox teardown, which caused staged write requests to remain in the pipeline indefinitely. This could prevent the flush operation from completing as expected. The fix sets both AW_FLUSH and AW_FLUSH_MODE bits to ensure staged writes drain correctly while maintaining device stability. The read path is unaffected by this issue.
A vulnerability in the Linux kernel's ovpn UDP output fallback mechanism was resolved by changing how stale local source addresses are cleared. The issue involved clearing bind->local in place, which could cause torn IPv6 addresses due to concurrent lockless reads. The fix retries route lookup without modifying the bind, revalidates under lock, resets the cache, and publishes a replacement bind with a wildcard address. This prevents inconsistent routing cache states.
A vulnerability in the Linux kernel's fbnic Ethernet driver related to incorrect usage of the Rx queue NAPI pointer has been resolved. The issue involved the queue management code incorrectly mapping Rx queues to Tx NAPI vectors when standalone Tx vectors were present, potentially causing use of freed memory or invalid pointers during queue restart or PCIe recovery scenarios. The fix uses the correct napi pointer stored in netdev_rx_queue.napi, ensuring safe queue management under locking. No CVSS score is available for this issue.
A vulnerability in the Linux kernel's Bluetooth BNEP implementation allowed out-of-bounds reads on short RX/TX frames and control fallthrough. The issue was fixed by adding proper length checks before accessing frame headers and preventing unintended fallthrough in control frame processing.
A vulnerability in the Linux kernel's fbnic network driver related to handling maximum standalone channels has been resolved. The issue involved an incorrect allocation of NAPI vectors for Tx and Rx queues, causing NULL pointer dereferences during resource setup in certain configurations.
A vulnerability in the Linux kernel's USB network driver for catc devices was resolved by properly bounding the RX packet length in the catc_rx_done() function. The flaw allowed crafted packet headers to cause out-of-bounds reads, potentially leading to reading uninitialized memory or buffer overflows. The fix involves stricter validation of packet lengths and rejecting malformed packets, preventing runt packets from being processed.
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) sock context code generation was fixed. The issue involved incorrect handling of the rx_queue_mapping field, where the code used 64-bit move instructions that could cause the register to hold values outside the verifier's assumptions. This discrepancy could lead to unexpected runtime values. The fix ensures the read value width matches the assumed size by using 32-bit move instructions and correctly reporting the destination variable size.
A race condition vulnerability in the Linux kernel's net: libwx Tx timestamp handling was resolved. The issue involved improper synchronization of shared skb pointers between transmission, timestamp worker, and cleanup paths, potentially causing double frees or reference leaks. A dedicated spinlock was introduced to serialize access and prevent these race conditions. This fix addresses stability and memory management issues in the affected kernel component.
A vulnerability in the Linux kernel NFC driver for pn533 devices allowed an out-of-bounds read due to improper validation of the ccid.datalen field from USB response frames. This could be triggered by a malicious or malfunctioning device sending crafted data. The issue was fixed by bounding the datalen value against the maximum frame size before use.
A vulnerability in the Linux kernel's nfp driver was resolved involving improper handling of IPsec RX state references under the XArray lock. The function nfp_net_ipsec_rx() released the XArray lock before safely acquiring a reference to the xfrm_state, allowing a race condition where the state could be deleted and its reference count dropped to zero. This could lead to attempts to increment a zero reference count after the state was queued for destruction. The issue arises because the asynchronous firmware invalidation and delayed garbage collection do not prevent invalid reference acquisition. The fix ensures the xfrm_state reference is taken before releasing the XArray lock, preventing the race condition.
A vulnerability in the Linux kernel's BPF implementation on MIPS32 was fixed. The issue involved an incorrect instruction emitted for immediate JMP JEQ/JNE operations, causing invalid comparisons when the immediate operand was negative. This was due to using an addu instruction instead of addiu, leading to misinterpretation of the immediate value as a register. The flaw affected constant blinding via BPF_REG_AX. The vulnerability was identified with test_bpf on MIPS32r1 emulated by QEMU and has been resolved.
A vulnerability in the Linux kernel's hid-oxp driver was resolved by changing the removal function to use cancel_delayed_work_sync() instead of cancel_delayed_work(). The previous approach allowed delayed work callbacks to continue running concurrently with device teardown, potentially accessing the HID device after it was closed and stopped. This fix ensures that any in-progress work completes before the device is torn down.
A vulnerability in the Linux kernel's macb network driver was resolved by fixing memory leaks related to dma_alloc_coherent() during error handling in macb_alloc(). The issue involved leaking transmit (Tx) and receive (Rx) buffers when allocations failed or crossed a 4GB boundary. The fix ensures allocated buffers are properly stored and freed during error cleanup.
A vulnerability in the Linux kernel's NFC driver for the trf7970a device was resolved. The issue occurs when the trf7970a_startup() function powers up the device before applying an optional RX gain reduction. If a register read or write fails, the function returns without powering down the device, leaving the device in an unintended powered-on state. This can cause unbalanced power references and improper device state management. The fix ensures that trf7970a_power_down() is called on error to properly deassert enable GPIOs and restore the powered-off state. The vulnerability was found during static analysis of kernel code.
A vulnerability in the Linux kernel's SMB client was resolved involving improper handling of compound mids during send failures. When a compound request fails to send, the system incorrectly manages mids on the pending queue, leading to double decrementing of in-flight credits and kernel warnings. This issue was identified during SMB2 negotiation when socket send failures occur.
A vulnerability in the Linux kernel's stmmac network driver affects the handling of received frames larger than the DMA buffer size when scatter-gather is used. The secondary RX buffer was not properly allocated for regular frames, causing DMA to write to an unmapped address and trigger an SMMU translation fault on IOMMU-based platforms. This issue has been fixed by enabling scatter-gather support for non-split-header frames on capable cores and properly allocating the secondary buffer. The fix also addresses frame trimming to avoid underflows and prepares for future multi-buffer XDP support.
CVE-2026-98798 is a vulnerability in the Linux kernel's bcmgenet network driver where a NULL pointer dereference occurs when setting Rx coalescing parameters on an interface that has not been opened. This leads to a kernel oops and causes the networking stack to become unresponsive until a reboot. The issue arises because the Rx ring private data is only initialized during interface open, but the coalescing parameters can be set beforehand, causing a NULL dereference.
A vulnerability in the Linux kernel's sparx5 network driver causes a NULL pointer dereference during driver unbinding if the Precision Time Protocol (PTP) initialization was skipped. This occurs because sparx5_ptp_init() returns early without setting up PTP when certain features or interrupts are absent, but sparx5_ptp_deinit() does not check for this condition before cleanup. The issue has been fixed by adding an early return in sparx5_ptp_deinit() when PTP is not used.
A vulnerability in the Linux kernel's cw1200 WiFi driver allowed out-of-bounds reads during transmission padding, leaking up to 511 bytes of kernel heap data to the device. This occurred because the TX path sent padded data from the frame buffer without reserving space for padding, exposing stale memory. The issue has been fixed by ensuring proper padding allocation and zeroing the padding bytes before transfer. The vulnerability has a low severity score and does not affect the RX path.