A vulnerability in the Linux kernel's SMB client implementation related to the handling of allocated ranges in the fallocate emulation was resolved. The issue arises because the FSCTL_QUERY_ALLOCATED_RANGES call on Windows servers may not reflect recently written data unless the data is flushed and committed first. This can lead to zero-filling of live data, causing data corruption. The fix ensures that dirty pages are written back, outstanding I/O is drained, and an SMB2 FLUSH is issued before querying allocated ranges, preventing data corruption.
A vulnerability in the Linux kernel's iio: imu: adis16400 driver involved unprotected debugfs reads due to improper handling of debugfs file operations. The issue was that adis16400_serial_number_fops did not call debugfs_file_get(), causing debugfs_remove_recursive() to not wait for ongoing reads before unbinding and freeing the device, potentially leading to use-after-free conditions. The vulnerability was fixed by changing the debugfs file creation method to debugfs_create_file(), aligning with other similar drivers and ensuring proper protection of debugfs reads.
A vulnerability in the Linux kernel scheduler's extended scheduling code (sched_ext) has been resolved. The issue involves incorrect handling of the SCX_RQ_IN_WAKEUP flag derived from enqueue flags, leading to deferred actions not being scheduled properly. This can cause an immediate (IMMED) task insert to remain pending behind the running task, potentially resulting in a use-after-free scenario when the scheduler is disabled and the deferred actions reference freed per-CPU memory. The fix ensures that only the core enqueue flags' wakeup bit triggers the task_woken_scx() call, preventing the stale flag condition.
A vulnerability in the Linux kernel's iio imu adis16480 driver allowed unprotected debugfs reads due to improper use of debugfs file operations. The issue was that firmware_revision and firmware_date file operations did not call debugfs_file_get(), causing debugfs_remove_recursive() to not wait for ongoing reads before freeing the device, potentially leading to use-after-free conditions. This flaw has been fixed by replacing debugfs_create_file_unsafe() with debugfs_create_file().
A clock reference leak vulnerability in the Linux kernel's fsl/fman component was fixed. The issue occurred because the read_dts_node() function called clk_get() to obtain a clock reference but did not call clk_put() to release it, causing a reference count leak. This fix ensures the clock reference is released after reading its rate, including error paths.
A vulnerability in the Linux kernel's virtual terminal (vt) selection code allows an unsigned integer underflow and slab-out-of-bounds read in the paste_selection() function. This occurs when a concurrent ioctl call replaces the selection buffer with a shorter one while paste_selection() is sleeping, causing the function to read memory beyond the allocated buffer. The issue has been fixed by terminating the loop when the pasted byte count reaches the buffer length.
A vulnerability in the Linux kernel's MTD core involves incorrect handling of the _get_device() callback with partitioned MTD devices. The flaw causes gluebi partitions to break because the _get_device() callback is called with a partition MTD instead of the master MTD, which is required by gluebi_get_device(). This issue has been resolved by ensuring the master MTD is passed to _get_device(), matching the behavior of _put_device().
A vulnerability in the Linux kernel's BPF trampoline handling could lead to use-after-free conditions when BPF programs are detached while still in use by tasks. This occurs because detached BPF programs are freed after grace periods without accounting for tasks sleeping in other BPF programs within the same trampoline image. The issue has been fixed by introducing patchable no-op instructions before each program call to safely skip detached programs. This fix prevents kernel crashes caused by tasks resuming execution in freed program memory.
A vulnerability in the Linux kernel's iio gyro driver (adis16136) involves unprotected debugfs reads. The issue arises because the serial_number file operations do not call debugfs_file_get(), which is required by debugfs_create_file_unsafe(). This leads to a race condition where debugfs_remove_recursive() does not wait for ongoing reads, and unbinding can free the iio_dev structure underneath, causing potential use-after-free conditions. The vulnerability has been fixed by replacing debugfs_create_file_unsafe() with debugfs_create_file().
A vulnerability in the Linux kernel's TCP stack was fixed where the function cond_resched() was called in an invalid context under BPF (Berkeley Packet Filter) execution. This caused a kernel BUG due to a sleeping function being invoked while holding RCU read locks, which is not allowed. The issue occurs during socket destruction when a listening socket with children in its accept queue is aborted, triggering the problematic cond_resched() call. The fix involves skipping cond_resched() in this specific BPF context to avoid the invalid sleep.
CVE-2026-98515 is a high-severity double-free vulnerability in the Linux kernel's nouveau DRM driver. The flaw occurs because the function nvif_vmm_dtor frees memory pointed to by vmm->page without clearing the pointer, leading to a second free on cleanup paths that call nouveau_cli_fini() twice. This can cause kernel memory corruption and potentially lead to system crashes or privilege escalation. The issue was discovered via fuzzing with a modified Syzkaller tool. A fix has been implemented in multiple Linux kernel commits.
CVE-2026-98486 is a low-severity vulnerability in the Linux kernel's ena network driver. It involves a memory leak of a coherent DMA buffer allocated for MMIO read responses when the probe function fails after initialization. The issue occurs because the error path does not properly release this buffer, leading to resource leakage. This flaw was identified through manual code inspection and has been fixed by adding the missing buffer release call in the probe error path.
A NULL pointer dereference vulnerability exists in the Linux kernel's Bluetooth RFCOMM implementation. Specifically, the getsockopt handler for RFCOMM_CONNINFO can dereference a NULL session pointer when deferred setup is enabled and the socket state is BT_CLOSED. This occurs because the session pointer is cleared while the defer_setup flag remains set, leading to an unconditional dereference. This flaw can cause a kernel crash (general protection fault) when a getsockopt call is made on an accepted socket after a remote disconnect (DISC) has been processed.
@fastify/jwt versions prior to 10.2.5 have a vulnerability where the top-level sign and verify methods do not merge per-call options with global defaults. This causes token expiration and maximum age protections to be silently dropped, resulting in tokens that never expire and verification that does not enforce maximum age. The issue is fixed in version 10.2.5.
Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable_space_global objects on find/findOne, attackers can call GET /api/v1/reports to disclose report names, descriptions, and object and field API names.
Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection with a chosen endpointId and url to send stored connection credentials to attacker-controlled servers, or abuse dt_begin_authorization to create connections.