A heap out-of-bounds write vulnerability exists in the Linux kernel's ksmbd component within the krb5_authenticate() function. The flaw occurs when processing SMB2_SESSION_SETUP as a non-first element in a compounded SMB2 request, causing an incorrect calculation of buffer headroom. This miscalculation allows memcpy() to write past the end of the allocated buffer into adjacent kernel heap memory. The issue has been fixed by adjusting the calculation to correctly reflect the remaining buffer space.
CVE-2026-99081 is a vulnerability in the Linux kernel's bnxt_en driver affecting Intel BCM57412 NetXtreme-E NICs. It involves incorrect DMA mapping length for padded small packets, causing the NIC's DMA engine to read beyond the mapped buffer boundary. This results in IOMMU DMA read faults and transmit queue timeouts. The issue arises because the DMA mapping length does not account for padding added to small packets, leading to a DMA read buffer overrun. The vulnerability was introduced after a commit that changed VLAN headroom handling, causing small packets to be positioned near page boundaries. The fix ensures the DMA mapping length matches the padded packet size by adjusting skb length before mapping.
A critical vulnerability in the Linux kernel's mlx5e network driver allows stale XSK buffers to be released during refill retries when an XDP redirect to an AF_XDP socket fails due to a full RX ring. This can cause double publication of UMEM frames, leading to potential memory corruption and data integrity issues. The flaw is silent and does not produce kernel warnings. It was detected under high packet load conditions and has been resolved by marking WQEs as released immediately after driver-side free to prevent stale pointer usage.
CVE-2026-99078 is a critical vulnerability in the Linux kernel's mlx5e network driver related to AF_XDP zero-copy buffer management. It involves a flaw where stale XSK buffers may be released multiple times during MPWQE refill retries, potentially causing memory corruption. The issue occurs when buffer allocation fails with -ENOMEM, leading to improper handling of buffer release bitmaps. This flaw has been resolved by ensuring idempotent retries through proper bitmap management.
A vulnerability in the Linux kernel's rust_binder component causes a node's delivery and count state to become desynchronized when a thread exits while holding a pending node refcount increment. This occurs because the refcount increment is dropped due to no-op cancel functions, potentially causing the node to never be freed from the process's nodes tree after all external references are dropped. The issue is fixed by rescheduling the pending refcount update to the process's work queue on thread exit.
CVE-2026-99065 is a race condition vulnerability in the Linux kernel's cgroup cpuset subsystem related to CPU hotplug handling. The issue arises because the cpuset hotplug operation became synchronous, removing previous race handling code, but a subsequent change caused a race to reappear between cpu_active_mask updates and cpuset effective_cpus updates. This race can lead to the top cpuset having no active CPU, resulting in a NULL pointer dereference. The vulnerability affects specific Linux kernel versions and has been fixed by reintroducing a NULL check in guarantee_active_cpus().
CVE-2026-99059 is a high-severity vulnerability in the Linux kernel's WireGuard implementation related to the Noise protocol handshake. It involves a race condition where two threads process the same response message concurrently, potentially causing inconsistent handshake state and session creation. The flaw arises from improper synchronization during cryptographic state updates in the handshake process. Although exploitation is considered highly unlikely in practice, the vulnerability could allow an attacker to interfere with session establishment, impacting confidentiality and integrity. The issue has been resolved by adding a check comparing ephemeral private keys to ensure state consistency.
A vulnerability in the Linux kernel's workqueue subsystem could cause a NULL pointer dereference when checking chained work. This occurs because the worker's current_pwq pointer may be NULL outside of work-item execution, leading to a fault before a warning is emitted. The issue has been fixed by adding a guard to ensure current_pwq is valid before the chained-work test.
A vulnerability in the Linux kernel's xen/netfront driver causes memory leaks when the function xennet_fill_frags() fails due to response chains having more slots than fit in the skb's fragments. The skb buffer is dequeued but not freed, leading to resource leakage.
CVE-2026-99056 is a high-severity vulnerability in the Linux kernel's strparser component. It involves a race condition where the __strp_recv function may still be running when the parser is being torn down, potentially leading to use-after-free (UAF) conditions. This flaw affects certain Linux kernel versions and has been addressed by adding locking mechanisms to ensure no in-flight __strp_recv calls are active during teardown. A reproducer exists that can turn the UAF into an exploit. The vulnerability primarily affects the espintcp user but the patch prevents future users from encountering this bug.
A vulnerability in the Linux kernel TCP zerocopy receive path could cause a kernel panic due to a null pointer dereference when processing net_iov fragments. This occurs because the code incorrectly dereferences a NULL page pointer for net_iov fragments, leading to a KASAN-detected panic. The issue has been resolved by rejecting all net_iov fragments before accessing page-backed data, preventing the fault.
CVE-2026-99054 is a high-severity vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) component. It involves improper teardown of topology server workqueues before closing subscriber connections, leading to race conditions that can cause use-after-free, reference count errors, and RCU stalls. This flaw allows potential corruption of kernel memory and impacts confidentiality, integrity, and availability of the affected system. The issue affects specific Linux kernel versions listed and has been resolved by changing the order of teardown operations and adding safeguards to prevent workqueue misuse.
CVE-2026-99053 is a use-after-free vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem. The flaw arises because tipc_node_find_by_name() returns a node pointer after releasing its RCU read lock without taking a reference, allowing concurrent cleanup of the node to free it while still in use. This can lead to accessing freed memory, causing potential kernel crashes or other impacts. The issue affects multiple Linux kernel versions and has been assigned a high severity rating with a CVSS score of 7.8.
This vulnerability in the Linux kernel SELinux subsystem involves improper preservation of native security labels on an already-initialized superblock when mounting an NFSv4 filesystem with security_label a second time. The issue causes SELinux to skip setting a critical flag, leading to silent disabling of per-file labeling on both the new and original mounts.
CVE-2026-99051 is a use-after-free vulnerability in the Linux kernel's fsverity subsystem. The issue arises because __fsverity_get_info() uses rcu_read_lock() without proper synchronization with fsverity_remove_info(), leading to potential use-after-free when accessing fsverity_info structures for different inodes concurrently. The vulnerability has a high severity with a CVSS score of 7.8.
A race condition in the Linux kernel gpio mpsse driver was fixed that could cause a use-after-free condition. The issue occurs when the IRQ poll worker is armed before it is properly published, allowing a disconnect operation to miss the worker and leading to access of freed memory. The fix involves synchronizing the publishing and arming of the worker within a critical section and adding a flag to prevent late arming during teardown.
A vulnerability in the Linux kernel's ibmveth driver was resolved involving improper cleanup of logical LAN resources on failure during the open operation. Specifically, if buffer pool allocation fails after registering the logical LAN, the cleanup function h_free_logical_lan() was not called, leaving the buffer-list page owned by PHYP when unmapped. This could lead to resource management issues.
A use-after-free vulnerability in the Linux kernel's mmc mtk-sd driver was fixed by ensuring that the request timeout work is properly canceled during device removal. The issue involved a delayed work callback accessing freed resources after the driver unbinds and frees the mmc_host, causing kernel memory safety violations detected by KASAN.
A memory leak vulnerability was identified and fixed in the Linux kernel's sparx5 network driver. The issue involved the sparx5_tc_matchall_destroy() function failing to free allocated memory for matchall filter entries, causing a leak when deleting mirror and goto matchall filters. The leak was confirmed using kmemleak on specific hardware and resolved by freeing the entries after unlinking them.
A vulnerability in the Linux kernel's openvswitch component caused a soft lockup during netlink flow dumps on production compute nodes with thousands of datapath flows. The issue arises because the softirq backlog refills as fast as it drains, causing the dumping thread to monopolize CPU time without rescheduling, leading to a soft lockup. The fix involves holding bottom halves (BH) off across the entire callback to prevent draining softirqs prematurely, thus avoiding the lockup. This fix trades off preemption under CONFIG_PREEMPT but keeps the BH-off region short and bounded by the flow count.