A vulnerability in the Linux kernel's p54 wifi firmware parser allows reading beyond the bounds of firmware records due to insufficient validation of record lengths. This flaw can cause the parser to read past the intended data fields when processing malformed firmware records. The issue has been addressed by validating component ID and version record lengths and rejecting descriptor values that cause underflow or empty ranges before updating driver state.
A vulnerability in the Linux kernel's vsock subsystem involves improper handling of the TCP_CLOSING state during connection establishment. This flaw can lead to memory corruption and kernel crashes due to double insertion into the connected socket table. The issue arises from a race condition between connection state transitions and socket reset operations.
CVE-2026-99212 is a vulnerability in the Linux kernel's RDS (Reliable Datagram Sockets) subsystem related to RDMA connection management. The flaw occurs when a route failure causes the RDMA connection manager to destroy an identifier (id) that RDS still owns, leading to a use-after-free condition. This happens because the pointer to the id is not cleared, leaving the connection in a connecting state with a freed id until shutdown. The fix ensures the id remains owned by RDS until proper shutdown, preventing premature destruction.
A vulnerability in the Linux kernel netlink subsystem allows unprivileged NETLINK_RDMA users to potentially disclose kernel memory contents due to improper resetting of socket buffer (skb) headers before unicast and multicast filtering. This issue arises because netlink producers may reserve headroom without resetting network and MAC headers, enabling socket filters to read data before the initialized message. The flaw has been resolved by resetting both headers before running the receiver's filter in unicast and broadcast delivery.
A race condition vulnerability in the Linux kernel's SCSI target iSCSI implementation could cause a double-free error when concurrently updating the discovery AuthMethod parameter via configfs. This issue has been fixed by adding proper locking to protect the parameter update process.
A use-after-free vulnerability was identified and fixed in the Linux kernel's OCFS2 Distributed Lock Manager (DLM) module. The issue involved improper locking during debugfs reads of the recovery participant list, which could lead to reading freed memory. The fix ensures that the recovery list traversal and field reads in debug_state_print() are properly protected by the dlm_reco_state_lock, preventing concurrent access issues.
A vulnerability in the Linux kernel's pipe implementation can cause a use-after-free condition in the asynchronous notification mechanism when setting up a writer fails. This occurs due to improper handling of existing asynchronous readers during writer setup failure, potentially leading to memory corruption detected by KASAN. The issue affects specific Linux kernel versions and has been resolved by correcting the registration logic to preserve existing reader entries on failure.
CVE-2026-99181 is a Linux kernel vulnerability in the autofs subsystem where notification errors from a replaced pipe were not properly handled. This flaw could cause denial of service of the shared autofs service during a legitimate daemon restart. The issue does not lead to memory corruption, information disclosure, privilege escalation, or code execution. The vulnerability was reproduced in specific kernel versions and fixed by ensuring atomic state transitions when handling pipe replacement errors.
CVE-2026-99178 is a Linux kernel vulnerability affecting the x86 KVM subsystem. It involves improper handling of asynchronous page fault (#PF) flags during nested machine check or debug exceptions (NMI context). This flaw can cause a kernel panic when an NMI handler takes a page fault and clears flags belonging to the interrupted handler, leading to a crash. The issue was observed in scenarios involving KVM running as an L1 hypervisor and perf sampling with user call chains. The patch prevents consuming async #PF flags in kernel #PF in NMI context, avoiding the panic.
A resource leak vulnerability in the Linux kernel's viai2c-wmt driver was fixed by changing clock management in the wmt_i2c_probe() function. The issue involved the clock reference count not being decremented properly, leading to a clock leak. The fix switches to using devm_clk_get() to ensure automatic clock release.
A use-after-free race condition was identified and fixed in the Linux kernel's SCSI tape driver (st). The flaw occurred due to improper ordering in the removal and reference counting of scsi_tape structures, leading to potential access of freed memory during concurrent open and remove operations.
A vulnerability in the Linux kernel's libiscsi SCSI transport allows a negative task index to be used in parse_pdu_itt, leading to an out-of-bounds read from the session command array. This occurs because the index is only bounded from above, not below, permitting negative values to access memory before the array. The issue is related to how beiscsi handles unsolicited NOP-In PDUs and the session age comparison, which fails to reject invalid indices. This flaw has been resolved by adding a lower bound check on the index in both lookups.
A vulnerability in the Linux kernel's SCSI subsystem (libiscsi) allows improper validation of the Initiator Task Tag (ITT) reflected in a Reject Protocol Data Unit (PDU). This flaw can cause in-flight SCSI commands to be incorrectly completed as successful without actual data transfer, and may trigger kernel warnings or faults. The issue arises because the ITT extracted from the Reject PDU is not properly validated against active tasks, leading to potential task mismanagement and kernel instability.
A vulnerability in the Linux kernel's SCSI libiscsi component allows a target to specify an invalid task index in management responses, leading to a NULL pointer dereference and kernel crash. The flaw occurs because the task index is only bounds-checked against the maximum command slots but not verified to be in flight or valid, causing dereferencing of a NULL connection pointer. This can be triggered by sending a single unsolicited NOP-In or a Text Response with the same invalid task identifier. The issue has been resolved by requiring the task to be in flight and not a SCSI command, preventing invalid task references.
A vulnerability in the Linux kernel's Hyper-V driver (hv) involves improper resetting of the VMBus connection state on error or exit paths. The issue causes the connection state to be set to DISCONNECTED prematurely, preventing proper unloading of the VMBus connection. This can result in the Hyper-V host continuing to send messages or post interrupts despite the connection being considered disconnected. The flaw was introduced by a commit that changed how connection state was checked before unloading. The fix prevents forcibly setting the connection state to DISCONNECTED during exit or failure to establish the connection.
A use-after-free vulnerability in the Linux kernel power supply core was resolved by preventing unregistering a power supply while a callback is running. The issue occurs when a power supply is unregistered while its callback, triggered by events such as external_power_changed(), is still executing. This can lead to accessing freed driver data and cause kernel crashes. The fix introduces a read-write semaphore to synchronize the unregister operation with ongoing callbacks, preventing premature freeing of resources.
A vulnerability in the Linux kernel's drm/vc4 HDMI driver was fixed by moving the Packet RAM enablement to the runtime power management hooks. The issue involved the audio infoframe being written before video was restored, causing a kernel warning and potential system instability due to Packet RAM being disabled prematurely. This fix ensures Packet RAM remains enabled appropriately during runtime power management transitions.
CVE-2026-99210 is a vulnerability in the Linux kernel's accel/rocket driver where the rdev pointer is not cleared on device initialization failure. This can cause a later probe to dereference an error pointer, potentially leading to kernel instability or crashes. The issue arises because the rocket_probe() function stores the return value of rocket_device_init() in rdev without checking for errors first. If initialization fails, rdev remains an error pointer, which is then dereferenced improperly.
A vulnerability in the Linux kernel's drm/xe component causes a NULL pointer dereference when evicting a buffer object (BO) that has no associated resource. This occurs when an imported dma-buf BO's resource is freed during teardown while its attachment remains live, leading to a fault in the eviction process. The issue has been fixed by skipping eviction for BOs without resources, preventing the NULL dereference.
A vulnerability in the Linux kernel's drm/xe/oa component allows allocation of a zero OA buffer without proper zeroing, potentially exposing stale kernel memory contents to userspace via mmap. This occurs because ttm_bo_type_kernel buffer objects are not guaranteed to be zeroed on allocation. The flaw affects certain Linux kernel versions and has been fixed by zeroing the buffer at allocation.