A use-after-free vulnerability in the Linux kernel's io_uring subsystem with SQPOLL enabled has been fixed. The issue occurs when the sqpoll thread processes task_work independently, potentially freeing context structures while they are still accessed, leading to memory corruption detected by KASAN. The fix involves holding an RCU read lock during the addition of task work and waiting for a grace period before freeing context structures.
A NULL pointer dereference vulnerability in the Linux kernel's net/mlx5e driver related to AF_XDP TX timestamp teardown has been fixed. The issue occurs during the teardown of the XSK TX queue when outstanding descriptors are completed without a completion queue entry (CQE). If a TX timestamp was requested, the code attempts to dereference a NULL CQE, causing a potential crash. The fix returns zero when no CQE is available, preventing the NULL dereference.
A vulnerability in the Linux kernel's TPM subsystem was fixed to address an off-by-four bounds check error in the tpm2_get_random() function. The flaw allowed memcpy() to read up to 4 bytes beyond the end of a truncated TPM response, potentially leaking stale buffer contents as random bytes. The issue was corrected by adjusting the bounds check to properly account for the parameter size field in the response.
A vulnerability in the Linux kernel's nvmet pci-epf component allows out-of-bounds reads due to improper handling of too-short SGL segments. Specifically, when the host provides an SGL segment length smaller than one descriptor but nonzero, the kernel reads memory before the allocated buffer, potentially leading to kernel panic. This issue has been fixed by rejecting segments that cannot hold at least one descriptor.
A vulnerability in the Linux kernel's KVM SEV implementation involves improper cache maintenance timing during intra-host VM migration. The issue arises because cache flushes are performed after clearing the SEV active state on the source VM, creating a small window where memory pages could be reclaimed and reused without proper cache flushing. This could lead to memory corruption or data leakage between virtual machines.
A vulnerability in the Linux kernel's iio adc pac1934 driver involved improper handling of ACPI label duplication. The issue caused a failure that reached the terminating-byte write, potentially leading to access of a missing label. The flaw was detected by static analysis and fixed by adding checks to release the ACPI result and abort before accessing missing labels. The fix is included in specific Linux kernel commits.
A divide-by-zero vulnerability was identified and fixed in the Linux kernel's bpf subsystem, specifically in the btf_struct_walk() function. The flaw occurs when accessing past a struct with a flexible array member whose element type has zero size, causing a divide-by-zero error at program load time. This can lead to kernel crashes during BPF program verification.
A vulnerability in the Linux kernel's BPF subsystem could cause a soft lockup due to lack of rescheduling points in the __htab_map_lookup_and_delete_batch() function. This issue affects batch operations on large hash maps, potentially causing CPUs to be held for extended periods, triggering the kernel's soft lockup watchdog. The problem has been fixed by adding rescheduling points to avoid long CPU holds during batch lookups and deletions.
CVE-2026-98626 is a vulnerability in the Linux kernel's BPF CO-RE (Compile Once - Run Everywhere) relocation handling. It involves improper poisoning of instructions when relocation cannot be resolved, allowing malformed metadata to replace critical instructions such as jumps, calls, and exits. The issue has been fixed by restricting poisoning only to relocatable instructions and validating instruction forms before poisoning. The fix applies to both libbpf and in-kernel CO-RE code.
A concurrency issue in the Linux kernel's netfilter nfnetlink_queue subsystem was fixed by ensuring the nfnl mutex is held in the event notifier. This prevents parallel UNBIND and URELEASE events that could cause a general protection fault (kernel crash). The fix serializes release notifier and config netlink functions to avoid race conditions during socket close and unbind operations.
A vulnerability in the Linux kernel's fbnic network driver involves improper handling of the num_napi count when freeing napi vectors during power management suspend and resume operations. This can lead to a kernel NULL pointer dereference and crash when the driver attempts to access freed vectors during device removal or unbind.
CVE-2026-98609 is a vulnerability in the Linux kernel's drm/virtio component where an object leak occurs when drm_gem_handle_create() fails. The issue arises because drm_gem_object_release() is incorrectly called on an error path, leaving a buffer object with a reference count of 1 and causing memory and resource leaks. This flaw has been fixed in specific commits of the Linux kernel.
CVE-2026-98606 is a vulnerability in the Linux kernel's drm/virtio component where the GEM object is not properly released on errors in the virtio_gpu_vram_create() function. This leads to use-after-free conditions in the device's VMA offset manager, causing potential memory corruption and resource leaks. The issue was fixed by ensuring drm_gem_object_release() is called before freeing the object on all error paths.
A vulnerability in the Linux kernel's skb_pointer_if_linear() function caused an underflow in bounds checking for skb-backed BPF dynptrs. This flaw could lead to returning an arbitrary pointer referencing invalid memory. The issue has been fixed by preventing underflow and overflow in the bounds check calculations.
A vulnerability in the Linux kernel's BPF sock context code generation was fixed. The issue involved incorrect handling of the rx_queue_mapping field, where the code used 64-bit moves that caused sign extension and resulted in runtime values exceeding verifier assumptions. The fix ensures proper use of 32-bit move instructions and correct size reporting for the bpf_sock field.
A vulnerability in the Linux kernel NFC driver (nfcmrvl) involves improper validation of helper command length before processing. The firmware download receive path removes the NCI data header and reads the helper command without first validating the remaining packet length, allowing a short frame to be accessed before the malformed packet is rejected. This flaw has been fixed by validating the complete helper command length before stripping the NCI data header.
A race condition vulnerability in the Linux kernel's NFC LLCP socket handling was fixed. The flaw involved concurrent unlinking and releasing of the same child socket due to improper synchronization between socket release and accept dequeue operations. This could lead to use-after-free or NULL pointer dereference errors. The fix involves changing locking mechanisms, deferring resource release to a workqueue, and adding checks to prevent hangs and ensure idempotency.
A vulnerability in the Linux kernel NFC driver for the PN533 chip (CVE-2026-98575) allows an out-of-bounds (OOB) read in the function pn533_acr122_is_rx_frame_valid(). This occurs because the driver reads the frame->ccid.datalen field from a USB response frame without proper bounds checking, potentially causing it to read outside the allocated buffer. The issue is fixed by bounding datalen against the maximum ACR122 frame size and rejecting invalid datalen values.
A vulnerability in the Linux kernel's IPv6 packet processing was fixed to address a pull-bound underflow in skb_checksum_setup_ipv6(). This flaw occurs when parsing IPv6 extension headers if the skb linear area is larger than MAX_IPV6_HDR_LEN, causing an unsigned subtraction to wrap and become negative, leading to an excessively large copy length in skb_copy_bits().
A NULL pointer dereference vulnerability was fixed in the Linux kernel's DSA mt7530 driver affecting MT7531 and MT7621 devices. The issue occurs because regulator pointers remain NULL on these devices, leading to an unconditional call to regulator_disable() on NULL during module removal or sysfs unbind. This flaw could cause kernel crashes or instability when the affected driver is unloaded.