CVE-2026-98693 is a vulnerability in the Linux kernel's Thunderbolt driver related to improper handling of router references for allocated HopIDs. The flaw allows a DP tunnel to outlive its expected lifecycle, leading to operations on freed IDAs and triggering warnings. This can occur when unbinding the driver while a DP tunnel is still waiting for DPRX capabilities to be read, notably triggered by unplugging the Apple NHI cable. The issue is resolved by holding a router reference for each allocated HopID and releasing it appropriately to keep ports and their HopID IDAs alive during use.
CVE-2026-98689 is a high-severity vulnerability in the Linux kernel's Thunderbolt driver related to DisplayPort (DP) tunnel handling. The flaw occurs when the kernel accesses a DP tunnel after its DPRX read operation has been canceled, leading to potential use of torn-down resources during system suspend or domain shutdown. This happens due to improper synchronization and flag checking around the cancellation and stopping of DPRX reads. The issue affects specific Linux kernel versions used in various Ubuntu LTS releases.
A vulnerability in the Linux kernel's fbnic driver related to handling maximum standalone channels has been resolved. The issue involves incorrect allocation of NAPI vectors for Tx and Rx queues in a 64-Tx/64-Rx configuration, leading to NULL pointer dereferences during resource setup. This flaw has been fixed by including the maximum vector count in the standalone allocation process.
A vulnerability in the Linux kernel's fbnic network driver involves incorrect use of the Rx queue NAPI pointer to find the NAPI vector. The issue arises when standalone Tx vectors are present, causing the Rx queues to point to Tx NAPI vectors incorrectly. This can lead to improper queue management and potential instability. The fix involves using the correct stored napi pointer from netdev_rx_queue.napi and handling cases where the pointer is NULL to avoid accessing freed resources.
A vulnerability in the Linux kernel's fbnic driver related to mailbox flushing has been resolved. The issue involved improper flushing of staged write requests during teardown of the firmware mailbox Rx ring, which could cause the flush operation to never complete. The fix involves setting both AW_FLUSH and AW_FLUSH_MODE bits to ensure staged writes drain correctly without affecting the read path.
A vulnerability in the Linux kernel's USB CATC driver (catc_rx_done function) allows crafted packets to cause out-of-bounds reads. The flaw involves improper bounding of the RX packet length, which can lead to reading past buffer limits and processing invalid Ethernet headers. This issue has been fixed by properly validating packet lengths and rejecting malformed packets.
CVE-2026-98602 is a low-severity vulnerability in the Linux kernel's Bluetooth BNEP (Bluetooth Network Encapsulation Protocol) implementation. It involves multiple out-of-bounds read flaws in the processing of short RX/TX frames and control frames. These flaws could lead to information leaks due to improper validation of frame lengths before accessing data. The issue affects specific Linux kernel versions and has been addressed by adding proper length checks and control flow fixes.
A vulnerability in the Linux kernel's BPF subsystem related to bpf_sock context code generation has been fixed. The issue involved incorrect handling of the rx_queue_mapping field size during context access, causing the verifier's assumptions about register values to be violated. This could lead to runtime values exceeding expected limits due to sign-extension of a special value. The fix ensures correct instruction usage and proper size reporting for the bpf_sock field.
A vulnerability in the Linux kernel NFC driver for pn533 (CVE-2026-98575) allows an out-of-bounds (OOB) read due to improper validation of the datalen field in the pn533_acr122_is_rx_frame_valid() function. This occurs because the datalen value is used unchecked as an index into a data buffer, potentially causing the driver to read beyond the buffer limits. The issue is fixed by bounding datalen against the maximum ACR122 frame size and improving validation checks.
A critical vulnerability in the Linux kernel's stmmac network driver involves improper handling of buffer pages after a socket buffer (skb) build failure. Specifically, when napi_build_skb() fails in stmmac_rx(), the buffer page pointer (buf->page) is not cleared after recycling the page, leading to reuse of a stale pointer. This inconsistency can cause the recycled page to be reprogrammed into the RX descriptor, potentially leading to memory corruption or instability.
A use-after-free vulnerability in the Linux kernel's nfp driver related to IPsec RX state handling has been resolved. The issue occurs because the driver releases the XArray lock before safely acquiring a reference to the xfrm_state, allowing the state to be deleted and leading to a potential reference count increment on a freed object. This can cause instability or crashes in affected kernel versions.
CVE-2026-98492 addresses a memory leak issue in the Linux kernel's macb network driver related to dma_alloc_coherent() during error handling in macb_alloc(). The flaw causes leaks of transmit (Tx) and receive (Rx) buffers under certain error conditions, such as buffer allocations crossing a 4GB boundary or Rx buffer allocation failures. The issue is fixed by ensuring allocated buffers are stored promptly to enable proper freeing during error cleanup.
A vulnerability in the Linux kernel NFC driver for the trf7970a device causes improper power-down handling on startup RX gain failure. If register read or write fails during startup, the device remains powered up due to missing power-down calls, leading to unbalanced power states. This issue was found during static code analysis and affects specific Linux kernel versions.
A vulnerability in the Linux kernel's stmmac network driver affects the handling of received frames larger than the DMA buffer size. The flaw causes the DMA to write overflow data into an unmapped secondary buffer address, triggering an SMMU translation fault on IOMMU-based platforms. This occurs because the secondary RX buffer was not allocated for regular frames, only when split-header mode was active. The issue has been fixed by enabling scatter-gather support for non-split-header frames on certain cores, properly allocating and marking the secondary buffer as valid, and adjusting buffer length computations and frame trimming.
A NULL pointer dereference vulnerability in the Linux kernel's bcmgenet network driver occurs when setting Rx coalescing parameters on an interface that has not been opened. This leads to a kernel oops and networking becoming unresponsive until reboot. The issue is fixed by initializing necessary data structures at probe time rather than at interface open.
CVE-2026-98795 is a vulnerability in the Linux kernel's sparx5 network driver where a NULL pointer dereference occurs during driver unbinding if the Precision Time Protocol (PTP) initialization was skipped. This happens because sparx5_ptp_init() may return early without initializing PTP-related structures, but sparx5_ptp_deinit() does not check for this condition before cleanup, leading to a NULL dereference and potential kernel crash. The issue affects Linux kernel version 5.18 and has been fixed by adding an early return in sparx5_ptp_deinit() when PTP is not used.
A use-after-free vulnerability in the Linux kernel's mac80211 WiFi subsystem was fixed by properly shutting down the RX BA session timer during teardown. The flaw allowed a timer callback to run against freed memory due to improper synchronization, potentially leading to memory corruption.
A vulnerability in the Linux kernel's Thunderbolt driver causes a domain reference leak when a DisplayPort (DP) tunnel read operation is canceled. This leak can block driver unbinding indefinitely, leading to resource management issues. The flaw occurs if a DP tunnel is torn down before the DPRX read completes, such as unplugging within a timeout window. The issue has been fixed by adjusting reference ownership within the DPRX work scheduling logic.