A vulnerability in the Linux kernel's memstick subsystem (rtsx_usb_ms driver) causes requests to be dropped silently after a card eject event, leading to a hang during device removal. This occurs because requests are not properly completed when the device is ejected, causing blocking in kernel workqueues and preventing proper cleanup.
A vulnerability in the Linux kernel's dm-crypt subsystem involves improper handling of the lmk IV mode when used with AEAD ciphers. Specifically, pairing an AEAD cipher with the lmk IV mode causes a kernel oops due to out-of-bounds memory access. This issue arises because lmk sets a transform count of 64, but only one transform is allocated, leading to memory corruption during key setup. The flaw is not exploitable by unprivileged users as root privileges are required to trigger it.
A race condition in the Linux kernel device mapper (dm) subsystem was fixed where a function could read freed memory during concurrent ioctl calls. This issue occurs because dm_table_get_mode is called without holding locks, allowing a concurrent ioctl to swap the table and cause a use-after-free scenario. The flaw was identified by syzbot and fixed by changing the order of operations to read the mode before swapping the table. This is not considered a security bug since only root can trigger it and common tools do not invoke the vulnerable ioctls concurrently.
A use-after-free vulnerability in the Linux kernel's mmc mtk-sd driver was fixed by ensuring that the request timeout work is properly canceled during device removal. The issue involved a delayed work callback accessing freed resources after the driver unbinds and frees the mmc_host, causing kernel memory safety violations detected by KASAN.
A vulnerability in the Linux kernel's mmc sdhci-sprd driver involves improper handling of runtime power management (PM) during device removal. The driver enables runtime PM on probe but fails to properly clean up runtime PM on removal, potentially leading to clocks being disabled incorrectly if the device is runtime suspended. This issue was identified through manual code inspection and affects specific Linux kernel versions.
CVE-2026-99033 is a vulnerability in the Linux kernel's net/packet subsystem where the function packet_rcv_spkt() improperly handles the link layer header push operation. This can cause a kernel panic when processing CAN (Controller Area Network) packets on certain socket types due to an uninitialized mac_header pointer. The issue arises because packet_rcv_spkt() does not guard the skb_push() operation with a check for the presence of a link layer header, unlike similar functions. This flaw can lead to a fatal kernel panic from softirq context, causing a system crash.
CVE-2026-99032 is a use-after-free and potential NULL dereference vulnerability in the Linux kernel's SMC (Shared Memory Communications) subsystem. The flaw occurs in the smc_getname() function, which accesses the clcsock pointer without proper locking, allowing asynchronous release of the associated CLC socket. This can lead to memory corruption or kernel crashes when getsockname() is called concurrently with link-group termination.
A vulnerability in the Linux kernel's network bridge code could cause recursive multicast port cleanup to consume excessive kernel stack frames, potentially hitting the stack guard page. This issue arises from the function br_multicast_sg_del_exclude_ports() calling br_multicast_del_pg(), which in turn calls back into br_multicast_sg_del_exclude_ports() for certain entries. The fix suppresses the recursive cleanup while the helper is already processing the same entry.
A vulnerability in the Linux kernel's skb_copy_and_csum_bits() function could cause stale bytes to be left in network buffers. This occurs when unreadable fragments cause the function to copy only the linear part of a buffer, leaving the remainder uninitialized. The uninitialized memory may be sent out in network packets such as ICMP errors or driver transmit buffers, potentially leaking sensitive data. The issue is addressed by zeroing the unused portion of the buffer before transmission.
A memory leak vulnerability was identified and fixed in the Linux kernel's sparx5 network driver. The issue involved the sparx5_tc_matchall_destroy() function failing to free allocated memory for matchall filter entries, causing a leak when deleting mirror and goto matchall filters. The leak was confirmed using kmemleak on specific hardware and resolved by freeing the entries after unlinking them.
A vulnerability in the Linux kernel's Xilinx axienet driver causes a memory leak of DMA buffers when the network device is stopped. This occurs because the driver aborts DMA descriptors without running their completion callbacks, leading to unreleased SKBs and DMA mappings. The leak can exhaust IOMMU resources. The fix involves proper synchronization and freeing of DMA buffers during device stop.
CVE-2026-99027 is a vulnerability in the Linux kernel's network team driver where the reuse of socket buffers (skb) after queue override can lead to a use-after-free condition. This occurs because a nonzero dev_queue_xmit() result does not return ownership of the skb, causing the queue override helper to improperly reuse freed skb memory. The flaw can trigger kernel memory corruption and a kernel panic due to use-after-free errors detected by KASAN.
A vulnerability in the Linux kernel's team network driver causes the original socket buffer (skb) not to be freed when a broadcast packet has no transmitable port. This leads to retained memory charge on the socket, potentially causing resource leakage. The issue occurs because the transmit function returns success without consuming the skb when no port is available, but the skb is not freed. The flaw has been fixed by ensuring the skb is freed in this no-port scenario.
A vulnerability in the Linux kernel's openvswitch component caused a soft lockup during netlink flow dumps on production compute nodes with thousands of datapath flows. The issue arises because the softirq backlog refills as fast as it drains, causing the dumping thread to monopolize CPU time without rescheduling, leading to a soft lockup. The fix involves holding bottom halves (BH) off across the entire callback to prevent draining softirqs prematurely, thus avoiding the lockup. This fix trades off preemption under CONFIG_PREEMPT but keeps the BH-off region short and bounded by the flow count.
CVE-2026-99024 is a vulnerability in the Linux kernel's optee driver where TEE devices were registered before full initialization, allowing access to uninitialized structures. This could lead to dereferencing NULL pointers and using uninitialized mutexes during a race window. The issue is fixed by delaying device registration until full initialization of the optee structure is complete.
A memory leak vulnerability in the Linux kernel's power sequencing code for pcie-m2 was fixed. The function of_regulator_bulk_get_all() allocates an array that was not properly freed in the pwrseq-pcie-m2.c code, causing a leak. The fix adds an explicit kfree() call to release the allocated consumers array.
A vulnerability in the Linux kernel regulator driver for the LTC3676 chip allows reading from write-only registers HRST and CLIRQ. Reading these registers triggers unintended hardware actions, such as a hard reset or clearing interrupts, causing the board to reboot unexpectedly during register dumps.
A vulnerability in the Linux kernel's regulator subsystem was fixed where the function of_regulator_bulk_get_all() did not properly initialize supply names in the returned array. This could lead to uninitialized memory dereferences when the array is used, such as during error logging in regulator_bulk_enable(). The fix involves copying supply names into the array's own allocation to ensure proper lifetime management and prevent memory issues.
A vulnerability in the Linux kernel's tps6594 regulator driver affects the TPS65224 BUCK2, BUCK3, and BUCK4 voltage regulators. The issue arises because the driver incorrectly specifies the number of linear voltage ranges, causing out-of-bounds array access during voltage selector lookups. This flaw also impacts the TPS652G1 device. The problem has been fixed by adjusting the count of linear ranges to match the actual table size using ARRAY_SIZE().
CVE-2026-99019 is a vulnerability in the Linux kernel's SCSI changer driver (ch) where references to data transfer element devices are improperly retained. This causes scsi_device references to leak when drives are removed, preventing their release and blocking new devices from being recognized at the same address. The issue leads to increased module use counts and prevents unloading of the low-level driver module until a reboot occurs. The flaw affects certain Linux kernel versions and has been resolved by dropping references immediately after use and removing the unused array.