CVE-2026-99053 is a use-after-free vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem. The flaw arises because tipc_node_find_by_name() returns a node pointer after releasing its RCU read lock without taking a reference, allowing concurrent cleanup of the node to free it while still in use. This can lead to accessing freed memory, causing potential kernel crashes or other impacts. The issue affects multiple Linux kernel versions and has been assigned a high severity rating with a CVSS score of 7.8.
This vulnerability in the Linux kernel SELinux subsystem involves improper preservation of native security labels on an already-initialized superblock when mounting an NFSv4 filesystem with security_label a second time. The issue causes SELinux to skip setting a critical flag, leading to silent disabling of per-file labeling on both the new and original mounts.
CVE-2026-99051 is a use-after-free vulnerability in the Linux kernel's fsverity subsystem. The issue arises because __fsverity_get_info() uses rcu_read_lock() without proper synchronization with fsverity_remove_info(), leading to potential use-after-free when accessing fsverity_info structures for different inodes concurrently. The vulnerability has a high severity with a CVSS score of 7.8.
A race condition in the Linux kernel gpio mpsse driver was fixed that could cause a use-after-free condition. The issue occurs when the IRQ poll worker is armed before it is properly published, allowing a disconnect operation to miss the worker and leading to access of freed memory. The fix involves synchronizing the publishing and arming of the worker within a critical section and adding a flag to prevent late arming during teardown.
A vulnerability in the Linux kernel's Xilinx GPIO driver causes a runtime power management (PM) leak on the request error path. The function pm_runtime_get_sync() increments the usage counter even when it fails, and the error path does not properly decrement this counter, preventing the controller from runtime-suspending and leaving its clock enabled.
A deadlock vulnerability in the Linux kernel's GVE driver occurs when disabling XSK pools due to improper use of unlocked napi_disable and napi_enable calls while holding the netdev lock. This causes the thread to attempt re-acquiring a lock it already holds, resulting in a deadlock. The issue has been fixed by updating the NAPI calls to their locked versions.
A vulnerability in the Linux kernel's GVE driver causes a buffer leak of XSK buffers when rings are stopped. The issue occurs because GVE does not free XSK buffers when resetting ring state during queue stoppage, leading to resource leakage. This flaw has been observed in production environments and affects multiple specific Linux kernel versions.
CVE-2026-99046 is a high-severity vulnerability in the Linux kernel affecting certain versions of the linux-hwe-edge product. It involves a buffer leak in the AF_XDP zero-copy (ZC) mechanism when an error bit is set in the RX completion descriptor. Specifically, the XSK buffer was not freed properly on error, leading to a resource leak. This issue has been resolved in the affected versions listed.
A vulnerability in the Linux kernel's ibmveth driver was resolved involving improper cleanup of logical LAN resources on failure during the open operation. Specifically, if buffer pool allocation fails after registering the logical LAN, the cleanup function h_free_logical_lan() was not called, leaving the buffer-list page owned by PHYP when unmapped. This could lead to resource management issues.
A use-after-free vulnerability in the Linux kernel's ice driver was fixed. The flaw occurs during dynamic port cleanup when the code frees a VSI object before using its index to erase a dynamic port, leading to a use-after-free condition.
A vulnerability in the Linux kernel's ice driver involves improper reference count handling of metadata_dst objects during representor teardown. The flaw occurs because metadata_dst_free() is called directly, freeing memory without checking reference counts, potentially leading to use-after-free conditions when packets still hold references. This has been fixed by replacing metadata_dst_free() with dst_release(), which correctly manages reference counts and frees memory only when all references are dropped.
A vulnerability in the Linux kernel's io_uring/net subsystem allows bypassing of IPv6 connect filters due to improper handling of sockaddr_in6 address length. The io_connect_bpf_populate() function only populates connect filter fields when the address length is at least 28 bytes, but IPv6 connect paths accept a 24-byte length that already contains port and address information. This discrepancy causes filters that deny specific IPv6 ports or addresses to be bypassed, as the filter sees zeroed port and address values while the kernel connects to the intended destination.
A vulnerability in the Linux kernel's ip6_gre module related to obsolete ERSPAN Path MTU (PMTU) update handling has been resolved. The legacy PMTU update code in ip6erspan_tunnel_xmit() incorrectly dereferences a null pointer due to treating a metadata destination as a route without an output device, causing a kernel panic. This issue was triggered by specific user and network namespace configurations. The obsolete code was removed to align ERSPAN PMTU handling with IPv6 GRE, eliminating the null pointer dereference and preventing kernel crashes.
CVE-2026-99040 is a race condition vulnerability in the Linux kernel's key management subsystem. It involves a timing issue in the add_key() function where a writer can bypass keyring restrictions by exploiting a race between reading the restriction and linking a key. The flaw allows a writer with write permission on a destination keyring to link a key despite a reject-all restriction being installed. The issue was confirmed through concurrency testing and reproducer tools.
A use-after-free vulnerability exists in the Linux kernel memstick subsystem where asynchronous requests may write to memory after the associated card structure has been freed. This occurs because wait_for_completion_timeout() is used to wait for request completion, and if it times out, the card structure is freed while the request is still in flight. The issue is fixed by replacing wait_for_completion_timeout() with wait_for_completion() to ensure the card is not freed prematurely.
A vulnerability in the Linux kernel's memstick subsystem (rtsx_usb_ms driver) causes requests to be dropped silently after a card eject event, leading to a hang during device removal. This occurs because requests are not properly completed when the device is ejected, causing blocking in kernel workqueues and preventing proper cleanup.
A vulnerability in the Linux kernel's dm-crypt subsystem involves improper handling of the lmk IV mode when used with AEAD ciphers. Specifically, pairing an AEAD cipher with the lmk IV mode causes a kernel oops due to out-of-bounds memory access. This issue arises because lmk sets a transform count of 64, but only one transform is allocated, leading to memory corruption during key setup. The flaw is not exploitable by unprivileged users as root privileges are required to trigger it.
A race condition in the Linux kernel device mapper (dm) subsystem was fixed where a function could read freed memory during concurrent ioctl calls. This issue occurs because dm_table_get_mode is called without holding locks, allowing a concurrent ioctl to swap the table and cause a use-after-free scenario. The flaw was identified by syzbot and fixed by changing the order of operations to read the mode before swapping the table. This is not considered a security bug since only root can trigger it and common tools do not invoke the vulnerable ioctls concurrently.
A use-after-free vulnerability in the Linux kernel's mmc mtk-sd driver was fixed by ensuring that the request timeout work is properly canceled during device removal. The issue involved a delayed work callback accessing freed resources after the driver unbinds and frees the mmc_host, causing kernel memory safety violations detected by KASAN.
A vulnerability in the Linux kernel's mmc sdhci-sprd driver involves improper handling of runtime power management (PM) during device removal. The driver enables runtime PM on probe but fails to properly clean up runtime PM on removal, potentially leading to clocks being disabled incorrectly if the device is runtime suspended. This issue was identified through manual code inspection and affects specific Linux kernel versions.