SB2026101683 - Debian update for linux

Description

This security bulletin contains information about 283 vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2025-38204)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the dtInitRoot() and add_missing_indices() functions in fs/jfs/jfs_dtree.c. A local user can perform a denial of service (DoS) attack.

2) Use-after-free (CVE-ID: CVE-2025-40158)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ip6_finish_output2() and ip6_finish_output() functions in net/ipv6/ip6_output.c. A local user can escalate privileges on the system.

3) Race condition (CVE-ID: CVE-2026-52988)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in nf_tables commit phase hook list handling in netfilter when publishing new hooks while concurrent netlink dump list traversal via rcu is in progress. A local user can trigger concurrent ruleset updates to cause a denial of service.

4) Race condition (CVE-ID: CVE-2026-72315)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the cifs client direct i/o request cleanup and unmount handling when processing direct i/o writes during unmount. A local user can trigger direct i/o activity and unmount a cifs mount to cause a denial of service.

The issue results in a busy dentry warning because dentry reference counts may remain in use until delayed cleanup work completes.

5) Use-after-free (CVE-ID: CVE-2026-72463)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the xfrm async resumption handling in net/xfrm/xfrm_input.c when processing xfrm packets and resuming transport processing asynchronously. A remote attacker can send crafted traffic that triggers xfrm_rcv_cb to modify skb->dev and cause a denial of service.

The issue involves a race condition with tunnel device teardown and affects handling of both IPv4 and IPv6 transport finish paths.

6) Use-after-free (CVE-ID: CVE-2026-74347)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the netfilter conntrack timeout policy handling when removing a timeout policy while conntrack entries or queued packets still reference it. A local privileged user can delete a referenced timeout policy to cause a denial of service.

Exploitation requires the ability to manage conntrack timeout policies in netfilter.

7) Out-of-bounds write (CVE-ID: CVE-2026-80935)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in mt7996_mcu_get_eeprom() when processing an EEPROM response from a device. An attacker with physical access can report an arbitrary EEPROM address to cause memory corruption.

8) Out-of-bounds write (CVE-ID: CVE-2026-80937)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in mt7915_mcu_get_eeprom() when processing a device-controlled MCU EEPROM response. An attacker with physical access can provide a response containing an arbitrary address to cause memory corruption.

9) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-80939)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in the rtw89 PCI driver's rfkill polling handler when the system performs a warm reboot. A local privileged user can initiate a warm reboot to cause a denial of service.

The issue occurs on arm64 platforms after the PCIe link has been torn down.

10) Race condition (CVE-ID: CVE-2026-80980)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause connection state inconsistencies.

The vulnerability exists due to a race condition in the connection state flags of struct smc_connection when processing received connection control messages concurrently with connection termination. A remote attacker can send connection control messages during concurrent connection termination to cause connection state inconsistencies.

11) Unchecked Return Value (CVE-ID: CVE-2026-81016)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an ioremap-on-RAM warning.

The vulnerability exists due to unchecked return values in amd_stb_s2d_init() when handling S2D SMU physical-address queries. A local user can cause physical address zero to be passed to devm_ioremap() to trigger an ioremap-on-RAM warning.

The condition is associated with the spill-to-DRAM feature's separate SMU message port.

12) Memory leak (CVE-ID: CVE-2026-89437)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a memory leak in the sar_probe() function when handling device mode information allocated by parse_package(). A local user can trigger an error path in sar_probe() to cause a denial of service.

13) Use-after-free (CVE-ID: CVE-2026-89441)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a use-after-free condition.

The vulnerability exists due to a use-after-free in carddet_work in the VIA SD/MMC driver when queued card-detect work executes after driver removal. A local privileged user can trigger device removal while card-detect work is pending to cause a use-after-free condition.

14) Use-after-free (CVE-ID: CVE-2026-89445)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in IOMMUFD selftest IOPF reporting when concurrently triggering IOPF reports and detaching a PASID. A local user can trigger an IOPF report while detaching a PASID to trigger a use-after-free condition.

15) Use-after-free (CVE-ID: CVE-2026-89452)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in msm_iommu_probe() in the MSM IOMMU driver when IOMMU device sysfs setup or registration fails. A local user can trigger a failed probe to leave a dangling entry in qcom_iommu_devices to cause a denial of service.

A later traversal of qcom_iommu_devices is required to dereference the dangling list entry.

16) Use-after-free (CVE-ID: CVE-2026-89467)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the qcom_battmgr enable_work worker when the PMIC GLINK service comes up after battmgr has been freed. A local user can cause a PDR notification to queue enable_work after battmgr is freed to trigger a use-after-free.

17) Memory leak (CVE-ID: CVE-2026-89500)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect memory page order handling in the ring buffer cached reader page handling when discarding a cached reader page after a concurrent ring buffer resize. A local user can cause a cached reader page to be discarded after a concurrent ring buffer resize to cause a denial of service.

18) Race condition (CVE-ID: CVE-2026-89503)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a mismatch between reader-page metadata and allocated memory.

The vulnerability exists due to a race condition in ring_buffer_alloc_read_page() when resizing ring-buffer subbuffers while allocating a reader page. A local user can race reader-page allocation with a subbuffer-order change to cause a mismatch between reader-page metadata and allocated memory.

19) Race condition (CVE-ID: CVE-2026-89520)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in core scheduling's pick_next_task() when a core scheduling flip occurs while a lock-dropping pick_task() operation is in progress. A local user can trigger concurrent core scheduling flips and task selections to cause a denial of service.

Only systems using core scheduling are affected.

20) Improper resource shutdown or release (CVE-ID: CVE-2026-89527)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause resource leaks.

The vulnerability exists due to improper resource release in svc_rdma_create() when listener creation fails. A local user can trigger listener creation failure to cause resource leaks.

21) Out-of-bounds write (CVE-ID: CVE-2026-89633)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause out-of-bounds reads and writes.

The vulnerability exists due to improper input validation in coalesce_t2() when processing SMB transaction responses containing server-supplied DataOffset fields. A remote attacker can send a crafted response with malicious DataOffset values to cause out-of-bounds reads and writes.

22) Improper Preservation of Permissions (CVE-ID: CVE-2026-89638)

CWE-ID: CWE-281 - Improper preservation of permissions

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper preservation of permissions in the cifs_setattr_unix() and cifs_setattr_nounix() routines when processing writes to files with setuid or setgid bits set. A local user can write to such a file and retain its setuid or setgid bits on the server to escalate privileges.

The issue occurs when the mount stores modes on the server through cifsacl or modefromsid, SMB3.1.1 POSIX extensions, or SMB1 Unix extensions.

23) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-89766)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose namespace information.

The vulnerability exists due to a time-of-check time-of-use race condition in pidfd_ioctl() when performing PIDFD_GET_*_NAMESPACE ioctls while a target task executes a setuid binary. A local user can race a namespace ioctl with the target task's execve operation to disclose namespace information.

24) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89795)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to reset an unintended PCI function and leak memory.

The vulnerability exists due to improper PCI slot assignment in the s390 PCI hotplug slot handling when requesting a function reset through the hotplug driver's slot_reset interface. A local user can request a reset for a PCI function to reset an unintended function and leak memory.

This occurs on s390 systems that expose the topology of multifunction PCI devices in a shared PCI domain.

25) Use-after-free (CVE-ID: CVE-2026-89797)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to a use-after-free in the ab8500 fuel-gauge driver workqueue teardown when a threaded interrupt handler fires during driver removal. A local user can cause a threaded interrupt handler to queue work on a freed workqueue to trigger a use-after-free condition.

Threaded interrupt handlers remain armed until driver removal returns.

26) Integer overflow (CVE-ID: CVE-2026-89806)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code, disclose sensitive information, or cause a denial of service.

The vulnerability exists due to an integer overflow in the framebuffer size calculation in drm/sysfb/ofdrm.c when creating an ofdrm device with large linebytes and height values. A remote attacker can provide values that cause the framebuffer size calculation to overflow to execute arbitrary code, disclose sensitive information, or cause a denial of service.

27) Use of uninitialized resource (CVE-ID: CVE-2026-89827)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use of an uninitialized resource in the AMDGPU UVD decode ring fence driver when restoring the fence sequence during UVD resume on an SR-IOV virtual function. A local user can trigger UVD resume to cause a denial of service.

28) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-89832)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to persist inconsistent node data to storage.

The vulnerability exists due to improper error handling in the f2fs node folio error path when processing a node block with a checksum mismatch or inconsistent footer information. A local user can trigger error handling for a corrupted node block to persist inconsistent node data to storage.

29) Memory leak (CVE-ID: CVE-2026-89837)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a missing release of a folio reference in find_in_level() in the f2fs directory-handling code when handling an error returned by find_in_block(). A local user can perform directory lookups that encounter find_in_block() errors to cause a denial of service.

30) Out-of-bounds read (CVE-ID: CVE-2026-89838)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in F2FS recovery filename logging when logging a 255-byte recovery filename. A local user can cause recovery logging of a 255-byte filename to disclose sensitive information.

31) Integer overflow (CVE-ID: CVE-2026-89840)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data corruption and a denial of service.

The vulnerability exists due to an integer overflow in the F2FS F2FS_IOC_MOVE_RANGE operation when moving a range with unchecked destination offsets. A local user can invoke the operation with crafted range offsets to cause data corruption and a denial of service.

A source hole can cause the block-cloning operation to succeed while extending the destination inode using an unchecked destination end position.

32) Use of uninitialized resource (CVE-ID: CVE-2026-89859)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized memory in qla2x00_do_dport_diagnostics() when handling dport diagnostic requests. A local user can submit a dport diagnostic request with a partial payload to disclose sensitive information.

33) Infinite loop (CVE-ID: CVE-2026-89868)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite loop in the wave5_vpu_dec_stop_streaming function when stopping media streaming. A local user can trigger the stop_streaming operation to cause a denial of service.

34) NULL pointer dereference (CVE-ID: CVE-2026-89912)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in vgic_its_save_ite() in the KVM arm64 vgic-its component when saving ITS tables during virtual machine migration after processing MAPD, MAPTI, and MAPC with V=0 commands. A remote attacker can issue MAPD, MAPTI, and MAPC commands with V=0 in a guest to cause a denial of service.

The command sequence is architecturally unpredictable.

35) Use of Uninitialized Variable (CVE-ID: CVE-2026-89921)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of uninitialized stack data structures in __kvm_inject_pfault_token() when using migration ioctls after page-fault token injection. A local user can retrieve stale stack values to disclose sensitive information.

The stale values are not exposed to the guest through interrupt delivery.

36) Improper locking (CVE-ID: CVE-2026-89956)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause kernel memory corruption or a use-after-free condition.

The vulnerability exists due to improper locking in the s390 VFIO AP mediated-device list handling when concurrently creating, removing, or looking up mediated devices. A local user can concurrently manipulate mediated devices to cause kernel memory corruption or a use-after-free condition.

37) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-89971)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of positive NVMe status codes in nvme_update_ns_info_block() when processing a failed NVMe zone information query. A remote attacker can cause the zone information query to fail, resulting in a zoned queue with a zero zone size.

38) Use-after-free (CVE-ID: CVE-2026-89972)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to a missing SRCU grace period in the nvme_alloc_ns() error path when concurrently accessing NVMe multipath namespace paths. A remote attacker can trigger concurrent namespace access during error handling to compromise confidentiality, integrity, and availability.

39) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89996)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak dma-buf file descriptors.

The vulnerability exists due to improper resource management in DMA_HEAP_IOCTL_ALLOC handling when copying allocation results to userspace fails. A local user can trigger a copy_to_user failure to leak dma-buf file descriptors.

40) Use-after-free (CVE-ID: CVE-2026-90002)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ftrace set_ftrace_filter and set_ftrace_notrace trace instance files when opening a filter file concurrently with trace instance removal. A local user can race opening a filter file with removal of the trace instance to cause a denial of service.

41) Use-after-free (CVE-ID: CVE-2026-90013)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free kernel crash.

The vulnerability exists due to a use-after-free in tracefs options files when an options file is opened while another task removes its associated tracing instance. A local user can open an options file for a tracing instance and trigger removal of that instance to cause a use-after-free kernel crash.

42) Out-of-bounds read (CVE-ID: CVE-2026-90016)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.

The vulnerability exists due to an out-of-bounds read in rtw_restruct_wmm_ie() in the rtl8723bs driver when processing attacker-influenced information element buffers from association or scan data. A remote attacker can provide crafted association or scan data to disclose sensitive information and cause a denial of service.

43) NULL pointer dereference (CVE-ID: CVE-2026-90023)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in fsg_common_set_num_buffers() when processing a number-of-buffers value of 0. A local user can set the number-of-buffers value to 0 to cause a denial of service.

44) Use-after-free (CVE-ID: CVE-2026-90029)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to trigger a use-after-free.

The vulnerability exists due to a use-after-free in the Realtek USB card reader driver's suspend timer handling when disconnecting a USB device while the timer callback is running. An attacker with physical access can disconnect the device while the callback rearms the timer to trigger a use-after-free.

The issue applies to configurations with Realtek automatic power management enabled.

45) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-90030)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource lifetime management in DWC3 EndTransfer handling when aborting a transfer through the ep_dequeue path and subsequently starting a transfer on the same endpoint. A local user can trigger this transfer sequence to cause a denial of service.

The observed condition affects DWC_usb31 v2.00a and v2.10a controllers.

46) Improper input validation (CVE-ID: CVE-2026-90146)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass XDP program attachment restrictions.

The vulnerability exists due to improper input validation in XDP link update handling when replacing an XDP program through BPF_LINK_UPDATE. A local user can create an XDP link with a normal program and replace it with an offloaded or device-bound program to bypass XDP program attachment restrictions.

47) Out-of-bounds read (CVE-ID: CVE-2026-93179)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service or trigger an out-of-bounds read.

The vulnerability exists due to improper validation of voltage-object sizes in the AMD PowerPlay VoltageObjectInfo table lookup routines when processing a malformed VBIOS VoltageObjectInfo table. A local user can cause the driver to process a malformed VoltageObjectInfo table to cause a denial of service or trigger an out-of-bounds read.

48) Use-after-free (CVE-ID: CVE-2026-93196)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in virtio_pmem_host_ack() when completing a virtio pmem flush request after virtio_pmem_flush() has freed its request token. A local user can trigger this race to cause a denial of service.

49) Incorrect Comparison (CVE-ID: CVE-2026-93199)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect duplicate-device detection.

The vulnerability exists due to an incorrect comparison in i3c_master_search_i3c_dev_duplicate() when searching I3C devices with matching PIDs. A local user can cause the controller device to be identified as a duplicate target device.

50) Use-after-free (CVE-ID: CVE-2026-93200)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a use-after-free in master->this handling in the I3C master controller when accessing sysfs attributes for the master controller device. A local user can access sysfs attributes for the master controller device to trigger a use-after-free.

51) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-93231)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent locks associated with a requested server IP address from being released.

The vulnerability exists due to incorrectly specified arguments in nlmsvc_match_ip() when releasing locks by server IP address through /proc/fs/nfsd/unlock_ip. A local user can invoke the unlock-by-IP operation to prevent locks associated with the requested server IP address from being released.

52) Resource exhaustion (CVE-ID: CVE-2026-93243)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locked-page resource accounting in the Linux kernel secretmem feature when mapping and unmapping secret memory ranges. A local user can repeatedly map and unmap secret memory ranges to consume all available system memory with unevictable folios and cause a denial of service.

A secretmem file descriptor can be passed between processes and inherited across fork.

53) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-93244)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an integer truncation.

The vulnerability exists due to improper range validation in simpledrm device creation when calculating a framebuffer stride. A local user can cause a computed stride exceeding INT_MAX to be assigned to stride to trigger an integer truncation.

54) Race condition (CVE-ID: CVE-2026-93285)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the f2fs garbage-collection thread lifetime management when processing sysfs updates concurrently with filesystem remount or shutdown operations. A local user can update sysfs attributes while the garbage-collection thread is being stopped to cause a denial of service.

Exploitation requires write access to the relevant f2fs sysfs attributes.

55) Race condition (CVE-ID: CVE-2026-97527)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt kernel memory.

The vulnerability exists due to a race condition in the qla2xxx driver's fcport->unsol_ctx_head list when concurrently processing unsolicited NVMe contexts. A remote attacker can trigger concurrent additions and removals of list entries to corrupt kernel memory.

56) Use-after-free (CVE-ID: CVE-2026-97528)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption or a denial of service.

The vulnerability exists due to a use-after-free in qla_nvme_xmt_ls_rsp() in the qla2xxx NVMe transport when handling an LS response error. A remote attacker can trigger an LS response error to cause memory corruption or a denial of service.

57) Out-of-bounds read (CVE-ID: CVE-2026-97529)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the qla2xxx FC BSG vendor command handling when processing a short FC_BSG_HST_VENDOR request. A local privileged user can submit a short request with a matching vendor ID to trigger an out-of-bounds heap read.

Exploitation requires the CAP_SYS_RAWIO capability.

58) Type Confusion (CVE-ID: CVE-2026-97530)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper interpretation of continuation IOCB payload data in the qla2xxx driver's qla27xx_copy_multiple_pkt() and qla27xx_copy_fpin_pkt() functions when processing a crafted Fibre Channel frame. A remote attacker can send a frame with payload bytes matching the RESPONSE_PROCESSED value to cause a denial of service.

The affected processing occurs in interrupt/DPC context.

59) Use-after-free (CVE-ID: CVE-2026-97531)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to a use-after-free in the qla2xxx host_map lookup path when report ID acquisition races with virtual port teardown. A remote attacker can trigger report ID acquisition for a virtual port being deleted to cause memory corruption.

60) Double free (CVE-ID: CVE-2026-97532)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double free in the qla2x00_mem_alloc() error-handling path when memory allocation fails during qla2x00_probe_one(). A local user can cause qla2x00_mem_alloc() to fail during device probing to cause a denial of service.

61) Incorrect calculation (CVE-ID: CVE-2026-97534)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect free-section accounting in free_segment_range() when garbage collection migrates data from a truncated range. A local user can trigger garbage collection during range truncation to cause a denial of service.

Exploitation requires limited available filesystem space.

62) Out-of-bounds write (CVE-ID: CVE-2026-97535)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause an out-of-bounds write.

The vulnerability exists due to improper bounds checking in the qla2xxx VP control IOCB handling when processing a virtual port index that exceeds the vp_idx_map bitmap capacity. A local privileged user can submit a VP control operation containing an out-of-range virtual port index to cause an out-of-bounds write.

Exploitation is limited to adapters whose reported NPIV virtual-port capacity permits virtual port indices above 128.

63) Use-after-free (CVE-ID: CVE-2026-97536)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in the qla2xxx response queue work handling when tearing down a response queue with queued response work. A remote attacker can exploit the race condition during queue teardown to compromise confidentiality, integrity, and availability.

The condition is especially likely during full adapter teardown, which forces pending work to run after queue pairs have been freed.

64) Race condition (CVE-ID: CVE-2026-97537)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to overwrite a request or response queue map entry.

The vulnerability exists due to a race condition in qla25xx_free_req_que() and qla25xx_free_rsp_que() when queue creation fails concurrently with another queue allocation. A local user can race queue creation and teardown to overwrite a request or response queue map entry.

65) NULL pointer dereference (CVE-ID: CVE-2026-97537)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a kernel panic.

The vulnerability exists due to improper handling of a null DMA ring pointer in qla25xx_free_req_que() and qla25xx_free_rsp_que() when freeing a request or response queue after DMA allocation fails during queue creation. A local user can initiate queue creation when DMA allocation fails to cause a kernel panic.

66) Incorrect calculation (CVE-ID: CVE-2026-97549)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect block-reservation calculations in the XFS scrub repair code when repairing shortform directories. A local user can invoke XFS metadata scrubbing and repair to cause a denial of service.

The issue occurs when a directory block spans multiple filesystem blocks.

67) Memory leak (CVE-ID: CVE-2026-97558)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak kernel resources.

The vulnerability exists due to improper reference counting in cifs_close() deferred close handling when deferred close work is requeued while a prior execution is pending. A local user can open and close a reused handle while deferred close work is pending to leak kernel resources.

68) Integer overflow (CVE-ID: CVE-2026-97559)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt a discretionary access control list (DACL).

The vulnerability exists due to an integer overflow in the SMB client DACL rewrite functions when rewritten access control entries cause a DACL to exceed 64K. A local user can trigger a DACL rewrite that exceeds 64K to corrupt a DACL.

The affected allocation covers the worst-case expansion, so writes remain within the allocated buffer.

69) Incomplete cleanup (CVE-ID: CVE-2026-97566)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to incomplete cleanup in the in-kernel MPTCP path manager's id 0 endpoint removal path when removing an id 0 endpoint while an ADD_ADDR announcement is pending. A local user can remove the id 0 endpoint while a pending ADD_ADDR announcement exists to trigger a kernel warning.

The warning is triggered when the path manager subsequently reselects id 0 after another signal endpoint is added.

70) Race condition (CVE-ID: CVE-2026-97567)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause inconsistent connection status.

The vulnerability exists due to a race condition in the MPTCP disconnect handling in net/mptcp/protocol.c when disconnecting an MPTCP socket while its retransmission timer is running. A local user can trigger the concurrent disconnect and retransmission timer operations to cause inconsistent connection status.

71) Unchecked Return Value (CVE-ID: CVE-2026-97571)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the device to use a zero DMA address.

The vulnerability exists due to an unchecked return value in bnxt_queue_mem_alloc() when allocating TPA buffer information. A local user can trigger a TPA buffer allocation failure to cause the device to use a zero DMA address.

An uninitialized rx_tpa[] slot must be selected by the hardware.

72) Use-after-free (CVE-ID: CVE-2026-97574)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to use-after-free in the bnxt_en RX ring TPA state handling when a queue restart encounters an allocation failure. A local privileged user can trigger a queue restart that encounters an allocation failure to cause a denial of service.

73) Use-after-free (CVE-ID: CVE-2026-97594)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in current_check_refer_path() in the Landlock filesystem access-control implementation when racing linkat(2) calls against concurrent rename(2) and rmdir(2) operations. A local user can race a linkat(2) loop against rename(2) and rmdir(2) to compromise confidentiality, integrity, and availability.

Exploitation requires entering a Landlock domain that handles at least one filesystem access right.

74) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-97597)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits in ipv6_flowlabel_get() when repeatedly requesting a shareable IPv6 flow label. A local user can submit repeated GET requests for the same shareable IPv6 flow label to cause a denial of service.

75) Use-after-free (CVE-ID: CVE-2026-97603)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in Tx/Rx DIM work embedded in idpf_q_vector objects when NAPI polling queues DIM work after q_vectors are freed. A local user can repeatedly cycle the network interface under load to cause a denial of service.

Dynamic interrupt moderation is enabled by default, and no configuration is required.

76) Use-after-free (CVE-ID: CVE-2026-97609)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.

The vulnerability exists due to a use-after-free in the nfnetlink_cttimeout timeout hook handling when a timeout policy lookup races with module unload. A local user can trigger a timeout policy lookup during module unload to disclose sensitive information, modify data, or cause a denial of service.

77) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97615)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt list state on another bridge.

The vulnerability exists due to reuse of a global frame-type handler list node in the Linux bridge CFM and MRP frame handlers when enabling a protocol on multiple bridges and unregistering it on one bridge. A local privileged user can create protocol instances on multiple bridges and remove an instance from one bridge to corrupt list state on another bridge.

78) Incorrect calculation (CVE-ID: CVE-2026-97618)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect consumption of provided buffer-ring space.

The vulnerability exists due to improper buffer consumption accounting in io_uring recv and recvmsg operations when processing an incoming packet larger than the provided buffer with MSG_TRUNC. A remote attacker can send an oversized packet to cause incorrect consumption of provided buffer-ring space.

Multishot receives already limit consumption according to the available payload size.

79) Deadlock (CVE-ID: CVE-2026-97619)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization of write accounting in the io_uring read/write completion handling when asynchronous writes complete while filesystem shutdown is freezing the superblock. A local user can issue an asynchronous write and initiate filesystem shutdown to cause a denial of service.

The condition occurs when the ring owner blocks in freeze_super() before queued task work runs.

80) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-97620)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper cache flushing in the drm/xe emit_render_cache_flush() function when releasing graphics memory for reuse. A local user can access reused graphics memory to disclose sensitive information.

81) Use-after-free (CVE-ID: CVE-2026-97901)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the generic netlink controller policy dump handling when advancing a pending policy dump. A local user can initiate and advance a policy dump to cause a denial of service.

Exploitation requires the target generic netlink family to be unregistered and its module unloaded while the dump remains pending.

82) Integer overflow (CVE-ID: CVE-2026-97906)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to integer overflow in get_boot_config_from_initrd() when processing a crafted initrd bootconfig. A local user can supply a crafted initrd with a huge bootconfig size to cause a denial of service.

The issue can trigger during early boot on 32-bit systems; 64-bit systems are also affected when the initrd exceeds 4.29 GB.

83) Use-after-free (CVE-ID: CVE-2026-97918)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in histogram trigger registration cleanup when enabling a histogram trigger fails. A local user can cause histogram trigger enablement to fail, leaving a freed trigger referenced by the named trigger list, to trigger a use-after-free condition.

84) Use-after-free (CVE-ID: CVE-2026-97919)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free read.

The vulnerability exists due to an incorrect reference-counting order in event_hist_trigger_named_init() when initialization of a named histogram trigger fails because alloc_hist_pad() cannot allocate. A local user can cause initialization to fail and subsequently look up the trigger by name to trigger a use-after-free read.

85) Use-after-free (CVE-ID: CVE-2026-97933)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in tracer option file opening in tracefs when a trace instance is removed concurrently. A local privileged user can open a tracer option file while removing a trace instance to cause a denial of service.

86) Memory corruption (CVE-ID: CVE-2026-97934)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of placeholder stacktrace fields in trace event histogram processing when parsing a histogram trigger with a STACKTRACE key. A local user can configure a histogram trigger using the STACKTRACE key and generate a trace event to cause a denial of service.

87) Use-after-free (CVE-ID: CVE-2026-97935)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in hist_register_trigger() when registering a named histogram trigger using common_timestamp with an unknown trace clock. A local user can write a crafted histogram trigger with an unknown clock and then create another trigger with the same name to cause a denial of service.

88) Use-after-free (CVE-ID: CVE-2026-97938)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free race condition in cad_pid pointer handling when concurrently accessing the cad_pid sysctl from user and PID namespaces. A local user can trigger concurrent sysctl operations to cause a denial of service.

89) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-97939)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to missing memory accounting in IPv4 and IPv6 multicast routing table allocations when creating multicast routing tables with MRT_TABLE or MRT6_TABLE. A local privileged user can create many multicast routing tables to cause a denial of service.

Exploitation requires netadmin privileges in a user and network namespace.

90) Use-after-free (CVE-ID: CVE-2026-97949)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in the configfs directory removal and symlink target-resolution logic when resolving a configfs symlink target while its directory is being removed. A local user can race a symlink operation with removal of its target directory to trigger a use-after-free condition.

91) Use-after-free (CVE-ID: CVE-2026-97950)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to use-after-free in configfs symlink handling when racing symlink creation with removal of its target directory. A local user can race symlink creation with removal of the target directory to trigger a kernel warning.

92) Race condition (CVE-ID: CVE-2026-98101)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause IPv6 multicast packets to be evaluated against incorrect source filters.

The vulnerability exists due to a race condition in the ip6_mc_source() IPv6 multicast source-filter handling function when source filters are modified concurrently with packet reception. A local user can concurrently add or remove IPv6 multicast source filters to cause IPv6 multicast packets to be evaluated against incorrect source filters.

The race affects UDP and raw multicast receive paths.

93) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98161)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause data writes to complete despite a failed ordering barrier.

The vulnerability exists due to improper handling of flush errors in pmem_submit_bio() when processing bio requests with REQ_PREFLUSH and REQ_FUA flags. A local user can submit a bio request with these flags after a preflush failure to cause data writes to complete despite a failed ordering barrier.

94) Out-of-bounds read (CVE-ID: CVE-2026-98167)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger out-of-bounds reads.

The vulnerability exists due to incorrect sub-PDU length validation in the Linux kernel SMB client when processing compound encrypted SMB frames. A remote attacker can send a compound encrypted frame containing a truncated non-last sub-PDU to trigger out-of-bounds reads.

95) Out-of-bounds read (CVE-ID: CVE-2026-98168)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger out-of-bounds reads.

The vulnerability exists due to insufficient bounds checking in cifs_query_reparse_point() when processing an SMB server response containing reparse point data. A remote attacker can send a crafted response with a DataOffset that leaves fewer than eight bytes available for the reparse_data_buffer header to trigger out-of-bounds reads.

The affected reads access the ReparseTag and ReparseDataLength fields.

96) Out-of-bounds read (CVE-ID: CVE-2026-98169)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose kernel memory to userspace.

The vulnerability exists due to an out-of-bounds read in smb3_enum_snapshots() in the Linux kernel SMB client when processing short server replies during snapshot enumeration. A remote attacker can supply a specially crafted SMB ioctl reply to disclose kernel memory to userspace.

The vulnerable path is reached when snapshot_array_size is smaller than GMT_TOKEN_SIZE. The exposed data comes from slab memory adjacent to the reply buffer.

97) Out-of-bounds read (CVE-ID: CVE-2026-98170)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger out-of-bounds reads.

The vulnerability exists due to insufficient bounds checking in move_smb2_ea_to_cifs() when processing a malformed extended attribute list returned by an SMB server. A remote attacker can return a specially crafted extended attribute list containing a truncated smb2_ea_info structure to trigger out-of-bounds reads.

The affected reads access the ea_name_length and ea_value_length fields.

98) Integer overflow (CVE-ID: CVE-2026-98171)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass command offset bounds checks.

The vulnerability exists due to integer overflow in the SMB client's receive_encrypted_standard() function when checking upper bounds for command offsets in compound encrypted frames. A remote attacker can supply a frame with a NextCommand value that triggers overflow in the upper-bound calculation to bypass command offset bounds checks.

The bounds check is intended to ensure that the trailing slice is large enough to contain a header.

99) Improper Validation of Specified Index, Position, or Offset in Input (CVE-ID: CVE-2026-98171)

CWE-ID: CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause acceptance of command offsets below the minimum header size.

The vulnerability exists due to insufficient command offset validation in the SMB client's receive_encrypted_standard() function when handling compound encrypted frames. A remote attacker can supply a frame with a nonzero NextCommand value smaller than MID_HEADER_SIZE(server) to cause acceptance of command offsets below the minimum header size.

100) Improper Handling of Length Parameter Inconsistency (CVE-ID: CVE-2026-98171)

CWE-ID: CWE-130 - Improper Handling of Length Parameter Inconsistency

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause command offsets to reference stale ciphertext residue.

The vulnerability exists due to incorrect plaintext length tracking in the SMB client's receive_encrypted_standard() function when validating command offsets in compound encrypted frames. A remote attacker can supply a frame with a NextCommand offset beyond the decrypted plaintext size but within the pre-decryption length to cause command offsets to reference stale ciphertext residue.

101) Use-after-free (CVE-ID: CVE-2026-98171)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger access to freed memory.

The vulnerability exists due to use-after-free in the SMB client's receive_encrypted_standard() function when handling compound encrypted frames and subsequent error paths. A remote attacker can supply compound encrypted frames that encounter an error after buffer reassignment to trigger access to freed memory.

The next_buffer pointer remains stale after its buffer is assigned to server->bigbuf.

102) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98172)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an RDMA connection resource leak.

The vulnerability exists due to missing release of an established RDMA connection in the Linux kernel SMB client's cifs_get_tcp_session() function when session setup fails after smbd_get_connection() successfully establishes the connection. A local user can trigger this error path to cause an RDMA connection resource leak.

The session setup failure can occur when kthread_create() returns an error.

103) Use-after-free (CVE-ID: CVE-2026-98173)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger accesses to freed kernel memory.

The vulnerability exists due to use-after-free in cifs_try_adding_channels() when adding SMB channels concurrently with a server interface refresh. A local user can trigger overlapping channel addition and interface refresh operations to trigger accesses to freed kernel memory.

104) Race condition (CVE-ID: CVE-2026-98174)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in cifs_signal_cifsd_for_reconnect() when multiple cifsd threads process reconnections concurrently. A local user can trigger concurrent reconnection processing that adds the same server's rlist node twice to a local list, corrupting it, to cause a denial of service.

105) Improper initialization (CVE-ID: CVE-2026-98174)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in the SMB client's TCP_Server_Info.rlist when adding a server node to the reconnection list. A local user can trigger reconnection processing involving an improperly initialized node to cause a denial of service.

The zero-initialized list pointers cause list_empty() to return false and list_add() to dereference a NULL prev pointer.

106) Use-after-free (CVE-ID: CVE-2026-98175)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the SMB client clean_demultiplex_info() function when the demultiplex thread exits while server reconnect work remains queued. A local user can trigger this cleanup sequence to cause a denial of service.

The queued smb2_reconnect_server() work subsequently reads the srv_count field of the freed server structure.

107) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98179)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to consume kernel mapping resources.

The vulnerability exists due to failure to release register BAR mappings in amdgpu_device_fini_sw() when removing a device or unloading the driver. A local privileged user can trigger driver unloading, leaking one register BAR mapping per unload, to consume kernel mapping resources.

108) Out-of-bounds write (CVE-ID: CVE-2026-98181)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to write beyond the bounds of an allocated properties array.

The vulnerability exists due to incorrect indexing that causes an out-of-bounds write in the GUD plane property loop when processing properties advertised by a USB device. An attacker with physical access can advertise the maximum number of properties through a USB device to write beyond the bounds of an allocated properties array.

109) NULL pointer dereference (CVE-ID: CVE-2026-98182)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mac80211 monitor-interface handling and the ath9k driver when activating a monitor interface without a transmit queue. A local privileged user can set the active flag on a down monitor interface and then bring the interface up to cause a denial of service.

Exploitation requires the CAP_NET_ADMIN capability. The RTNL lock remains held, causing subsequent netlink operations to block.

110) Heap-based buffer overflow (CVE-ID: CVE-2026-98184)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt heap memory.

The vulnerability exists due to a heap-based buffer overflow caused by authentication frame length truncation in mwifiex_cfg80211_authenticate() when processing authentication requests with oversized authentication data. A local privileged user can supply authentication data that causes the calculated frame length to exceed the capacity of a 16-bit field to corrupt heap memory.

Exploitation requires CAP_NET_ADMIN in the user namespace owning the network namespace, an up station network device, and a suitable BSS/SAE authentication request.

111) Integer underflow (CVE-ID: CVE-2026-98185)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger out-of-bounds reads.

The vulnerability exists due to integer underflow in mwifiex_ret_802_11_scan() when processing firmware-provided scan responses. A local user can supply a short response or a response with an oversized BSS length to trigger out-of-bounds reads.

The affected processing handles both normal and background scan responses.

112) Out-of-bounds read (CVE-ID: CVE-2026-98186)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to read beyond the bounds of a kernel beacon buffer.

The vulnerability exists due to an out-of-bounds read in mwifiex_search_oui_in_ie() when processing RSN or WPA information elements in beacon or probe-response frames during scan-result parsing. A remote attacker can transmit a crafted information element with a pairwise-cipher count exceeding the element's available length to read beyond the bounds of a kernel beacon buffer.

113) Out-of-bounds read (CVE-ID: CVE-2026-98187)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the p54_parse_eeprom() function when parsing a truncated trailing record in a PDR_INTERFACE_LIST entry. A local user can provide a malformed EEPROM buffer to disclose sensitive information.

The variant value read from the record also feeds synth front-end selection.

114) Out-of-bounds read (CVE-ID: CVE-2026-98188)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds reads past the EEPROM buffer.

The vulnerability exists due to an out-of-bounds read in p54_convert_rev0() and p54_convert_rev1() when processing device-supplied EEPROM calibration curve entries with channel and points-per-channel counts that exceed the available entry data. A local user can supply an EEPROM entry declaring more calibration curve data than it contains to cause out-of-bounds reads past the EEPROM buffer.

Exploitation requires control over the device-supplied EEPROM entry.

115) Out-of-bounds write (CVE-ID: CVE-2026-98189)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to corrupt neighboring kernel memory.

The vulnerability exists due to an out-of-bounds write in wilc_wlan_handle_isr_ext() in the wilc1000 wireless driver when processing receive transfers whose device-reported size exceeds the receive buffer capacity. An attacker with physical access can supply an oversized transfer containing controlled data through a bogus SDIO device to corrupt neighboring kernel memory.

The receive buffer is 96 KiB, while the device-reported transfer size can reach 131068 bytes. An oversized transfer can also leave the buffer offset beyond its end, allowing subsequent overflows to repeat.

116) Out-of-bounds read (CVE-ID: CVE-2026-98190)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the wilc1000 driver's wilc_wfi_p2p_rx() and mgmt_tx() functions when processing public action frames shorter than the 32-byte P2P public action header. A remote attacker can transmit a specially crafted 25- to 31-byte public action frame over the air to cause a denial of service.

Exploitation through the receive path requires the host to be in P2P listen mode. No wireless association is required.

117) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98191)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a runtime power-management reference leak.

The vulnerability exists due to failure to release a runtime power-management reference in wlcore_regdomain_config() when handling a failed regulatory-domain command. A local user can trigger a regulatory-domain command failure to cause a runtime power-management reference leak.

The recovery worker acquires a separate runtime power-management reference and cannot release the reference held by this function.

118) Use-after-free (CVE-ID: CVE-2026-98192)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free in kernel memory.

The vulnerability exists due to use-after-free in the wcn36xx wireless driver's TX ack timer teardown when removing the device while a timer callback is still executing. A local user can trigger teardown concurrently with the callback to cause a use-after-free in kernel memory.

119) Out-of-bounds read (CVE-ID: CVE-2026-98193)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an out-of-bounds read.

The vulnerability exists due to an unsigned payload length wraparound in libipw_michael_mic_verify() when processing short TKIP frames without a complete eight-byte Michael MIC. A remote attacker can send a short TKIP frame to trigger an out-of-bounds read in michael_mic() beyond the socket buffer.

The TKIP key must be set for the vulnerable verification path to run.

120) Use-after-free (CVE-ID: CVE-2026-98194)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause the kernel to dereference freed memory.

The vulnerability exists due to use-after-free in lbtf_free_adapter() in the libertas_tf wireless driver when freeing command buffers while the command timer callback is still running. A local user can cause adapter cleanup to overlap with an active command timer callback to cause the kernel to dereference freed memory.

The command_timer_fn callback accesses priv->cur_cmd->cmdbuf.

121) Double free (CVE-ID: CVE-2026-98195)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to double free in the iwlegacy driver's broadcast station deallocation when handling an error during driver startup. A local user can toggle RF_KILL during driver startup to cause a denial of service.

122) Use-after-free (CVE-ID: CVE-2026-98196)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause access to freed kernel memory.

The vulnerability exists due to use-after-free in the brcmsmac driver's brcms_free_timer() function when freeing a timer while its delayed-work callback is still running. A local user can trigger this overlapping timer cleanup and callback execution to cause access to freed kernel memory.

The non-synchronous cancel_delayed_work() call returns without waiting for an already-running callback, which accesses the timer structure through container_of().

123) Use-after-free (CVE-ID: CVE-2026-98197)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger accesses to freed driver data.

The vulnerability exists due to use-after-free in the w83791d driver's fan/pwm 4-5 sysfs callbacks when accessing leftover sysfs files after driver unbind. A local user can access these leftover files to trigger accesses to freed driver data.

The optional sysfs group is created only when the fan/pwm 4-5 pins are not used as GPIO.

124) Use-after-free (CVE-ID: CVE-2026-98198)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to use-after-free in the pwm-fan driver's sample_timer() callback when detaching the driver while the RPM timer is active. A local user can trigger driver detachment during a timer expiry window to corrupt kernel memory.

The callback accesses device-managed tachometer arrays that can be freed before timer cleanup occurs. The callback can also rearm the RPM timer.

125) Out-of-bounds write (CVE-ID: CVE-2026-98199)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to out-of-bounds writes in the PMBus core when probing chips with more than 10 phases per page. A local user can trigger probing of an affected chip to corrupt kernel memory.

The mp2975 driver supports up to 14 phases per page, and the mp2856 driver supports up to 12 phases per page.

126) Use-after-free (CVE-ID: CVE-2026-98200)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read freed kernel memory.

The vulnerability exists due to use-after-free in fungible_show() in the hp-wmi-sensors driver when reading a sensor's current_state debugfs entry concurrently with a sensor state update that replaces the current_state string. A local user can trigger overlapping reads of the same sensor to read freed kernel memory.

127) Use of Uninitialized Variable (CVE-ID: CVE-2026-98201)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel stack memory.

The vulnerability exists due to use of an uninitialized stack variable in input_ff_effect_from_user() when copying a smaller compatibility structure into the native struct ff_effect. A local user can submit a force feedback effect through EVIOCSFF and retrieve the stored native structure through UI_BEGIN_FF_UPLOAD to disclose kernel stack memory.

The readback path requires a uinput-based force feedback daemon.

128) NULL pointer dereference (CVE-ID: CVE-2026-98202)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the synaptics-rmi4 driver's rmi_driver_suspend() and rmi_driver_resume() functions when handling system power management events for an unbound RMI device. A local user can trigger system suspend or resume to cause a denial of service.

129) Out-of-bounds read (CVE-ID: CVE-2026-98203)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in soc_button_get_button_info() in drivers/input/misc/soc_button_array.c when processing an empty ACPI button descriptor package. A local user can trigger access to btns_desc->package.elements[0] with a zero package count to trigger an out-of-bounds read.

130) Out-of-bounds read (CVE-ID: CVE-2026-98204)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read.

The vulnerability exists due to incorrect block-length calculation in rmi_smb_write_block() when splitting writes into SMBus blocks. A local user can trigger a write with an input length greater than 32 bytes and a partial final block to cause an out-of-bounds read.

The final partial block causes smb_block_write() to read 32 bytes even when fewer bytes remain in the input buffer.

131) Use of Uninitialized Variable (CVE-ID: CVE-2026-98205)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to use of an uninitialized stack variable in the evdev_do_ioctl() function when processing EVIOCSABS ioctl requests with user-supplied sizes. A local user can submit an EVIOCSABS request with a short size and retrieve the resulting absolute axis information through EVIOCGABS to disclose sensitive information.

The disclosed data consists of stale kernel stack bytes left in the portion of the input_absinfo structure not supplied by the caller.

132) Out-of-bounds write (CVE-ID: CVE-2026-98206)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in the cyttsp5 touchscreen driver's cyttsp5_handle_irq() function when handling device-supplied HID reports. A local user can provide a report with a size field exceeding the response buffer capacity to corrupt kernel memory.

133) Incorrect calculation (CVE-ID: CVE-2026-98207)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause transfer completion accounting to report incorrect byte counts.

The vulnerability exists due to failure to reset the transferred-byte counter in mmc_spi_request() when retrying a multi-block request after a data CRC error. A local user can issue a multi-block transfer request that encounters a CRC error followed by a successful internal retry to cause transfer completion accounting to report incorrect byte counts.

The data itself is retried. Exploitation depends on an MMC-over-SPI system encountering a data CRC error during the transfer.

134) Memory leak (CVE-ID: CVE-2026-98208)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to consume kernel memory through a transmit FIFO leak.

The vulnerability exists due to failure to release allocated memory in sdio_uart_add_port() when attempting to add a port after all UART_NR slots in sdio_uart_table[] are occupied. A local user can trigger a port-addition attempt with a full port table to consume kernel memory through a transmit FIFO leak.

135) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98209)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave SDHCI child devices registered after their parent resources have been released.

The vulnerability exists due to improper resource lifecycle management in the Aspeed SDHCI controller driver when probe failure or device removal occurs. A local user can trigger these lifecycle paths to leave SDHCI child devices registered after their parent resources have been released.

The released parent resources include the controller clock and managed resources.

136) Use-after-free (CVE-ID: CVE-2026-98210)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to freed host memory.

The vulnerability exists due to use-after-free in the mxcmmc driver's asynchronous callbacks when removing the driver without draining pending work and the watchdog timer. A local user can trigger driver removal while asynchronous callbacks remain pending to trigger access to freed host memory.

The watchdog is armed on the DMA path with a 10-second timeout. The datawork callback is scheduled by the IRQ handler on the PIO path.

137) Use-after-free (CVE-ID: CVE-2026-98211)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the MMCI driver's busy-timeout work when removing a device with delayed work still queued for an R1b command. A local user can trigger device removal while this work remains queued to cause a denial of service.

The delayed work can subsequently dereference the device-managed mmci_host allocation after it has been released.

138) Use-after-free (CVE-ID: CVE-2026-98212)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to freed kernel memory.

The vulnerability exists due to use-after-free in the MMC host software queue retry work handler when processing pending retry work after driver removal. A local user can trigger execution of pending retry work after its associated allocation has been released to trigger access to freed kernel memory.

Retry work is queued when request_atomic() returns -EBUSY. The sdhci-sprd driver is the only identified consumer implementing request_atomic().

139) Use-after-free (CVE-ID: CVE-2026-98213)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free access to kernel memory.

The vulnerability exists due to use-after-free in the MMC core SDIO interrupt worker when pending interrupt work executes after the host controller is removed and its host structure is freed. A local user can trigger execution of the pending worker during this removal race to cause a use-after-free access to kernel memory.

The issue applies to host controllers that use sdio_signal_irq() to schedule SDIO interrupt work from their interrupt handlers.

140) Missing Authorization (CVE-ID: CVE-2026-98214)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass SELinux execution restrictions on intermediate filesystem layers.

The vulnerability exists due to missing authorization checks in selinux_file_mprotect() when changing memory protections for files on stacked filesystems. A local user can map a file with mmap(PROT_NONE) and then call mprotect(PROT_EXEC) to bypass SELinux execution restrictions on intermediate filesystem layers.

The demonstrated scenario uses two nested overlayfs mounts and an SELinux policy denying an intermediate mounter execute permission on the intermediate file.

141) Incorrect authorization (CVE-ID: CVE-2026-98215)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through incorrect access denials.

The vulnerability exists due to incorrect propagation of the user security identifier in the SELinux backing-file security allocation logic when mapping files with nested backing files. A local user can invoke mprotect(PROT_READ) on such a file mapping to cause a denial of service through incorrect access denials.

The access denial was demonstrated with SELinux enforcing and two nested overlayfs mounts. Nested backing files can also occur with FUSE passthrough backed by overlayfs.

142) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-98216)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrectly specified DMA mapping arguments in the PIO_CRED case of hfi1_file_mmap() when selecting a credit-return page with an offset buffer address and a zero page offset. A local user can map the wrong credit-return page and initiate transfers using send PIO to cause a denial of service.

For an IOMMU-backed, virtually mapped allocation, the issue affects contexts whose credit-return entries reside on the second or third page. Transfers using send PIO stall indefinitely, while send-DMA-only transfers remain operational.

143) Incorrect Pointer Scaling (CVE-ID: CVE-2026-98216)

CWE-ID: CWE-468 - Incorrect Pointer Scaling

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect pointer scaling in the PIO_CRED case of hfi1_file_mmap() when mapping a credit-return page using a byte offset added to a struct credit_return pointer. A local user can map and read the affected credit-return page to cause a denial of service.

The erroneous offset occurs when the hardware send context index reaches 64 or 128. With IOMMU translation, the resulting mapping installs an invalid page-table entry, and the first user-space read triggers a kernel Oops.

144) Use-after-free (CVE-ID: CVE-2026-98217)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free during device cleanup.

The vulnerability exists due to use-after-free in the mlx4 InfiniBand driver's pkey sysfs cleanup when cleaning up a device after a per-slave pkey sysfs registration failure. A local user can trigger cleanup of a failed slave tree with stale parent kobject pointers to trigger a use-after-free.

Registration continues for the remaining slaves despite per-slave registration errors.

145) Use-after-free (CVE-ID: CVE-2026-98218)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent reuse of an I2C adapter channel.

The vulnerability exists due to use-after-free in the I2C address translator adapter management code when handling cleanup after an adapter registration failure. A local user can trigger an adapter registration failure that leaves a dangling channel pointer to prevent reuse of an I2C adapter channel.

146) Out-of-bounds read (CVE-ID: CVE-2026-98221)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds memory reads.

The vulnerability exists due to incorrect bounds checking in tpm2_load_cmd() when loading an ASN.1-encoded TPM 2.0 trusted key blob. A local user can supply a crafted trusted key blob to cause out-of-bounds memory reads.

The boundary checks use the ASN.1-encoded payload size rather than the decoded blob size.

147) Integer overflow (CVE-ID: CVE-2026-98222)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write beyond an allocated kernel heap buffer.

The vulnerability exists due to integer overflow in encrypted_key_alloc() when calculating encrypted key payload lengths. A local user can supply key data whose combined lengths exceed the 16-bit allocation size limit to write beyond an allocated kernel heap buffer.

148) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98227)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to cause a denial of service.

The vulnerability exists due to failure to release allocated workqueue resources in the Linux kernel Memory Stick block driver when removing a memory card. An attacker with physical access can repeatedly insert and remove a memory card to cause a denial of service.

Each insertion and removal cycle leaks the per-card workqueue and its worker thread, progressively exhausting kernel memory.

149) Use-after-free (CVE-ID: CVE-2026-98229)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause the kernel to dereference freed memory.

The vulnerability exists due to use-after-free in xfrm_input() when receive-side processing resets the packet's security path before the function finishes accessing the associated XFRM state. A remote attacker can send packets processed during concurrent deletion of the associated state to cause the kernel to dereference freed memory.

The race requires secpath_reset() to release the last state reference. Relevant paths include VTI receive processing, cross-network-namespace packets on XFRM interfaces, and the XFRM_MAX_DEPTH error path.

150) Use-after-free (CVE-ID: CVE-2026-98230)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to use-after-free in the xfrm state_cache and state_cache_input lists in net/xfrm/xfrm_state.c when deleting the same xfrm state more than once. A local user can trigger repeated deletion of the same state to corrupt kernel memory.

The write use-after-free occurs once the slab is reused. Subsequent list traversal can encounter a dangling next pointer, causing a read use-after-free in xfrm_input_state_lookup().

151) Use-after-free (CVE-ID: CVE-2026-98231)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in xfrm_dev_state_free() when deferred device state flushing races with state garbage collection. A local user can trigger concurrent device state flushing and state garbage collection to cause a denial of service.

The device garbage collection list does not hold an xfrm_state reference. Both execution paths can invoke the driver callback and release the device reference.

152) Out-of-bounds write (CVE-ID: CVE-2026-98232)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.4 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to execute arbitrary code and disclose sensitive information.

The vulnerability exists due to out-of-bounds reads and writes in scsi_cdl_enable() in drivers/scsi/scsi.c when processing target-supplied MODE SENSE length fields. An attacker with physical access can supply crafted MODE SENSE responses through a USB storage device that identifies as an ATA device and advertises CDL support to execute arbitrary code and disclose sensitive information.

Exploitation is reachable during automatic device scanning without a filesystem mount or userspace access to the block device. Code execution was demonstrated using a build-specific, one-vCPU QEMU/Raw Gadget proof with QEMU-only multi-UDC allocator sampling, while KASLR and NX were enabled.

153) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98233)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service in packet ring reception.

The vulnerability exists due to failure to release ring slot ownership in tpacket_rcv() when virtio-net header conversion fails for an unsupported UDP GSO packet. A local user can send an unsupported UDP GSO packet to cause a denial of service in packet ring reception.

With a one-frame TPACKET_V2 ring, the only slot becomes unavailable and the next valid packet is dropped. TPACKET_V3 is not affected by this error path.

154) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-98234)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits in the heavy-hitter filter (HHF) queuing discipline when processing heavy-hitter flows with an excessively large configured flow limit. A local user can configure an oversized hh_limit and generate spoofed traffic to cause a denial of service.

Exploitation requires CAP_NET_ADMIN in a user namespace.

155) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98235)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak traffic control action references and leave actions registered after successful deletion requests.

The vulnerability exists due to incomplete resource release in tcf_action_put_many() in net/sched/act_api.c when processing a failed batched RTM_DELACTION request. A local user can submit a batch whose deletion fails at an action bound to a filter to leak traffic control action references and leave actions registered after successful deletion requests.

The leaked references belong to subsequent, unprocessed actions in the batch. A later deletion of an unbound action can report success without removing that action from the IDR.

156) Unchecked Return Value (CVE-ID: CVE-2026-98236)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel heap memory to the network stack.

The vulnerability exists due to an unchecked return value from skb_copy_bits() in mhi_mbim_rx() when processing modem-supplied network transfer blocks. A local user can supply a datagram pointer entry that references data outside the received socket buffer, causing a failed copy and subsequent delivery of an uninitialized buffer to netif_rx(), to disclose kernel heap memory to the network stack.

157) Infinite loop (CVE-ID: CVE-2026-98237)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an infinite loop caused by unchecked cyclic NDP chains in mhi_mbim_rx() when processing modem-supplied NTBs. A local user can supply a crafted NTB containing an NDP that points to itself or an earlier NDP to cause a denial of service.

158) Out-of-bounds read (CVE-ID: CVE-2026-98238)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read and invalid pointer dereference.

The vulnerability exists due to an out-of-bounds read in t7xx_ccmni_recv_skb() when processing a DPMAIF PIT header containing an unchecked netif index. A local user can set the netif index to a value between 21 and 31 to cause an out-of-bounds read and invalid pointer dereference.

The out-of-bounds array access reaches an adjacent callback table containing non-null values, which are subsequently interpreted as pointers to struct t7xx_ccmni.

159) Use-after-free (CVE-ID: CVE-2026-98239)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to write to freed kernel memory.

The vulnerability exists due to use-after-free in lan743x_rx_process_buffer() when processing checksum-success packets that span multiple receive buffers. A remote attacker can send a packet that spans multiple receive buffers to write to freed kernel memory.

Receive checksum offload must be enabled. Multi-buffer reception can occur after a live MTU increase because existing receive ring entries retain their old buffer size until replenished.

160) Out-of-bounds read (CVE-ID: CVE-2026-98241)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger out-of-bounds reads in kernel memory.

The vulnerability exists due to out-of-bounds reads caused by treating request sockets as full IPv6 sockets in xfrm6_local_rxpmtu() and xfrm6_local_error() when accessing inet_sock or ipv6_pinfo state through skb->sk. A remote attacker can trigger local PMTU or error handling for TCP SYN-ACK packets owned by a request socket to trigger out-of-bounds reads in kernel memory.

The vulnerable path is reachable when rerouting selects an IPv6 XFRM tunnel route with a lower MTU while a TCP_NEW_SYN_RECV request socket remains attached to the packet.

161) Use-after-free (CVE-ID: CVE-2026-98245)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to freed memory in the Linux kernel.

The vulnerability exists due to use-after-free in mark_block_group_to_copy() when iterating over the Btrfs commit root without locking. A local user can trigger iteration concurrently with a transaction commit that swaps and frees the commit root to trigger access to freed memory through extent buffers.

162) Use-after-free (CVE-ID: CVE-2026-98246)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to freed kernel memory.

The vulnerability exists due to use-after-free in the Bluetooth local codec list handling when device closure and a BT_CODEC query execute concurrently. A local user can issue a BT_CODEC query during device closure to trigger access to freed kernel memory.

163) Out-of-bounds read (CVE-ID: CVE-2026-98247)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read.

The vulnerability exists due to an out-of-bounds read in the Bluetooth Read Local Supported Codecs parsers when processing a controller reply that ends immediately after the standard codec array. A local user can supply such a reply to trigger an out-of-bounds read.

The vendor codec count is accessed beyond the socket buffer data while calculating the vendor codec array size. Both command variants are affected.

164) Out-of-bounds write (CVE-ID: CVE-2026-98248)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt adjacent memory.

The vulnerability exists due to out-of-bounds reads and writes caused by an omitted instruction size suffix in the arm64 per-CPU atomic operations when performing 8-bit or 16-bit operations using LSE instructions. A local user can invoke the affected operations to corrupt adjacent memory.

165) Use-after-free (CVE-ID: CVE-2026-98249)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in swsusp_arch_suspend_exit() when restoring hypervisor stub vectors during hibernation resume without supplying the required hypervisor call arguments. A local user can trigger a hibernation resume that leaves EL2 referencing freed vector memory to cause a denial of service.

The reported hang occurs with CONFIG_PAGE_POISONING=y and page_poison=on.

166) Use-after-free (CVE-ID: CVE-2026-98251)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause access to freed kernel memory.

The vulnerability exists due to use-after-free in ovs_ct_get_conn_labels() when adding a labels extension to a confirmed conntrack entry while another CPU accesses its extension block. A local user can trigger label extension allocation during concurrent access to cause access to freed kernel memory.

Exploitation requires a confirmed conntrack entry that does not already have a labels extension.

167) Race condition (CVE-ID: CVE-2026-98252)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise system confidentiality, integrity, and availability.

The vulnerability exists due to a race condition in reference count initialization in iwpm_get_nlmsg_request() in the Linux kernel RDMA core when publishing a request to a global list before initializing its reference count. A local user can trigger concurrent access to the incompletely initialized request to compromise system confidentiality, integrity, and availability.

168) Use-after-free (CVE-ID: CVE-2026-98253)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to a use-after-free in ucma_process_join() in the RDMA/ucma subsystem when handling concurrent multicast joins and a copy_to_user() failure. A local user can issue concurrent JOIN_MCAST calls for the same address and trigger a response-copy failure to trigger a use-after-free in the kernel.

Multicast leave operations match entries by socket address and destroy the first matching entry. This can cancel the newer RoCE work while an older worker still references the freed ucma_multicast object.

169) Incorrect calculation (CVE-ID: CVE-2026-98254)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory and transfer incorrect data during DMA operations.

The vulnerability exists due to incorrect address calculations in swiotlb_bounce() when performing partial DMA synchronization. A local user can trigger a partial synchronization with an address adjustment that crosses a page boundary to corrupt memory and transfer incorrect data during DMA operations.

A recorded lowmem address that is adjusted into highmem can also cause the lowmem path to pass a highmem address to phys_to_virt().

170) Improper input validation (CVE-ID: CVE-2026-98255)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to improperly modify TCP connection state.

The vulnerability exists due to improper acknowledgment validation in the TCP receive fast path of tcp_rcv_established() when processing segments with acknowledgment sequence numbers before SND.UNA. A remote attacker can send a TCP segment carrying payload and an excessively old acknowledgment to improperly modify TCP connection state.

The segment's sequence number must match RCV.NXT, and its TCP flags must match the fast-path prediction flags.

171) Deadlock (CVE-ID: CVE-2026-98257)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by permanently stalling the RDS connection workqueues.

The vulnerability exists due to a deadlock between synchronous connection teardown and shutdown work in rds_ib_cm_connect_complete() when a peer negotiates a protocol version older than RDS_PROTOCOL_COMPAT_VERSION. A remote attacker can negotiate such a protocol version to cause a denial of service by permanently stalling the RDS connection workqueues.

172) Use-after-free (CVE-ID: CVE-2026-98260)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in POSIX CPU timer cleanup during process execution and termination when a non-leader thread executes a program and a subsequent failure leaves a freed timer node queued. A local user can create and arm a per-thread CPU timer and trigger an execution failure after the thread ID exchange, followed by task reaping, to cause a denial of service.

The affected timer functionality requires CONFIG_POSIX_TIMERS to be enabled.

173) Use-after-free (CVE-ID: CVE-2026-98261)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise system confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in cifs_chan_skip_or_disable() when handling a secondary channel that is no longer supported by the server. A remote attacker can trigger the release of a channel reference followed by access to freed server objects to compromise system confidentiality, integrity, and availability.

Both the secondary channel and its primary server can be freed if cifs_put_tcp_session() drops their last references.

174) Improper initialization (CVE-ID: CVE-2026-98262)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization of the PxCLBU and PxFBU registers in ahci_start_fis_rx() in drivers/ata/libahci.c when probing the ahci driver. A local user can trigger initialization of an affected AHCI controller to cause a denial of service.

The issue occurs on HBAs that support 64-bit addressing but operate with the AHCI_HFLAG_32BIT_ONLY flag. The reported failure leaves a JMicron JMB585 controller unusable.

175) Use of Uninitialized Variable (CVE-ID: CVE-2026-98263)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an incorrect stream type to be used for a SoundWire audio stream.

The vulnerability exists due to use of an uninitialized variable in rt712_sdca_dmic_hw_params() when configuring a SoundWire audio stream. A local user can trigger audio stream configuration to cause an incorrect stream type to be used for a SoundWire audio stream.

176) Use-after-free (CVE-ID: CVE-2026-98264)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a device to access freed memory.

The vulnerability exists due to use-after-free in the ALSA virtio sound driver's virtsnd_remove() and virtsnd_freeze() functions when deleting virtqueues before resetting the device. A local user can trigger device removal or freezing to cause a device to access freed memory.

Modern virtio-pci keeps enabled queues active until the device is reset. The affected removal path is also used during probe failures after DRIVER_OK.

177) Out-of-bounds write (CVE-ID: CVE-2026-98265)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in the ALSA USB audio driver's implicit feedback handling when processing a capture endpoint packet count that exceeds the playback URB's allocated descriptor capacity. A local user can supply a USB audio device with mismatched implicit feedback capture and playback endpoint parameters to corrupt kernel memory.

The reproducer uses a high-speed UAC2 device declaring bInterval 1 for capture and bInterval 4 for playback. The invalid writes occur on the first capture completion after the audio stream starts.

178) Use-after-free (CVE-ID: CVE-2026-98266)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free.

The vulnerability exists due to improper device lifetime management in ALSA core (sound/core/init.c) when releasing a sound card asynchronously. A local user can trigger asynchronous card release while in-flight tasks still access the underlying card device to cause a use-after-free.

The disconnection operation gates new accesses but does not prevent access by tasks already in progress.

179) Expected behavior violation (CVE-ID: CVE-2026-98267)

CWE-ID: CWE-440 - Expected Behavior Violation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause file size metadata to become inconsistent with the server file size.

The vulnerability exists due to a failure to update local and remote file size metadata in v9fs_issue_write() in the Linux kernel 9p filesystem when writing data that extends a server file. A local user can write data beyond the previously recorded file size to cause file size metadata to become inconsistent with the server file size.

180) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98269)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause persistent filesystem inconsistencies.

The vulnerability exists due to improper handling of inode update failures in btrfs_replace_file_extents() when performing hole punching or reflinking. A local user can perform hole punching or reflinking operations that encounter an inode update failure to cause persistent filesystem inconsistencies.

Exploitation requires the transaction to be committed after the inode update failure.

181) NULL pointer dereference (CVE-ID: CVE-2026-98270)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in nbio_v7_9_handle_ras_controller_intr_no_bifring() when handling an interrupt before the RAS context or PCIE_BIF RAS object is available. A local user can exploit an interrupt occurring during the initialization window to cause a denial of service.

The interrupt handler executes in hard-IRQ context.

182) Use of uninitialized resource (CVE-ID: CVE-2026-98271)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to stale header offsets referencing uninitialized packet-buffer data in pskb_carve_inside_header() and pskb_carve_inside_nonlinear() when removing initial packet bytes and reallocating the skb head. A local user can trigger RDS-over-TCP packet processing that leaves these stale offsets to cause a denial of service.

The observed kernel BUG occurs when drop_monitor processes packet buffers freed with SKB_DROP_REASON_QUEUE_PURGE during RDS incoming-message cleanup.

183) Memory corruption (CVE-ID: CVE-2026-98272)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory.

The vulnerability exists due to a buffer overflow in the mvpp2 driver's page_pool array during mvpp2_bm_init() when changing the network interface MTU triggers a switch to per-CPU buffering without checking the pool count. A local user can trigger this buffering switch with a receive-queue configuration that exceeds the array capacity to corrupt memory.

The per-CPU buffering scheme requires two pools per receive queue and supports a maximum of eight pools.

184) Incorrect calculation (CVE-ID: CVE-2026-98275)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave RX overrun interrupts unacknowledged.

The vulnerability exists due to incorrect interrupt acknowledgment bit selection in the Cortina Gemini Ethernet driver's gmac_irq() function when handling RX overrun interrupts. A local user can trigger RX overrun interrupt handling to leave RX overrun interrupts unacknowledged.

For GMAC0, the acknowledgment writes the GMAC1 overrun bit instead; for GMAC1, the shift leaves no bit set in the 32-bit register.

185) Use-after-free (CVE-ID: CVE-2026-98276)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in sock_gettstamp() in net/core/sock.c when non-atomic socket flag updates race without holding the socket lock. A local user can race a SIOCGSTAMPNS_NEW ioctl with bind() on a UDP socket to cause a denial of service.

186) Integer overflow (CVE-ID: CVE-2026-98282)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass I/O bus address range validation.

The vulnerability exists due to incomplete integer overflow and range validation in iommu_tce_check_ioba() in the PowerPC IOMMU code when validating multi-page requests for H_STUFF_TCE or H_PUT_TCE_INDIRECT. A local user can supply a multi-page range that causes arithmetic overflow or exceeds the TCE table capacity to bypass I/O bus address range validation.

The affected validation function is shared by KVM and VFIO.

187) Use-after-free (CVE-ID: CVE-2026-98283)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to freed kernel memory.

The vulnerability exists due to use-after-free in kvmhv_emulate_tlbie_all_lpid() when iterating nested-guest entries and dropping mmu_lock without holding a reference to the nested-guest object. A local user can issue a concurrent single-LPID tlbie operation from another vCPU to trigger access to freed kernel memory.

The memory-release path is fully controlled by the L1 guest. The single-LPID operation uses is=2 and ric=2.

188) Use of Uninitialized Variable (CVE-ID: CVE-2026-98287)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger reads of uninitialized packet headroom or corrupt packet-buffer state.

The vulnerability exists due to an unsafe protocol-compression undo heuristic in pppoatm_send() when transmit admission fails with protocol compression enabled. A local user can submit packets that encounter transmit admission failure to trigger reads of uninitialized packet headroom or corrupt packet-buffer state through an unbalanced skb_push() operation.

The affected protocol-compression option is SC_COMP_PROT.

189) Out-of-bounds read (CVE-ID: CVE-2026-98287)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds memory read.

The vulnerability exists due to an out-of-bounds read in pppoatm_send() when inspecting the first data byte of zero-length or non-linear packet buffers. A local user can submit zero-length or non-linear frames to trigger an out-of-bounds memory read.

Frames can reach the affected function through PPP channel bridging (PPPIOCBRIDGECHAN).

190) Memory corruption (CVE-ID: CVE-2026-98287)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt shared packet headers.

The vulnerability exists due to failure to ensure that packet headers are writable in pppoatm_send() when applying LLC encapsulation to packets received through PPP channel bridging. A local user can submit packets with shared headers through a bridged PPP channel to corrupt shared packet headers.

The affected encapsulation operation prepends a four-byte LLC header.

191) Deadlock (CVE-ID: CVE-2026-98290)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to lock order inversion in rfcomm_sock_cleanup_listen() when closing unaccepted child sockets concurrently with RFCOMM worker activity. A local user can initiate shutdown of an RFCOMM listening socket while the worker handles connections or DLC state changes to cause a denial of service.

192) Off-by-one (CVE-ID: CVE-2026-98291)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds access to the FRBD array.

The vulnerability exists due to an off-by-one bounds check in btintel_pcie_submit_rx() when submitting receive buffers. A local user can trigger RX submission with an FRBD index equal to the RX queue count to cause an out-of-bounds access to the FRBD array.

193) Improper update of reference count (CVE-ID: CVE-2026-98293)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a parent socket resource leak.

The vulnerability exists due to failure to release a parent socket reference in the Bluetooth ISO iso_conn_ready() function when child socket allocation fails. A local user can exercise the affected connection handling error path to cause a parent socket resource leak.

194) Use-after-free (CVE-ID: CVE-2026-98295)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger access to freed kernel memory.

The vulnerability exists due to use-after-free in the Bluetooth coredump processing component when unregistering a controller during an active coredump. A local user can disconnect the controller during the dump to trigger access to freed kernel memory.

The dump_timeout and dump_rx work items remain active after unregistering and can access the device object after hci_release_dev() frees it.

195) Race condition (CVE-ID: CVE-2026-98297)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt Bluetooth data transmission.

The vulnerability exists due to a race condition in the Bluetooth hci_send_acl(), hci_send_sco(), and hci_send_iso() functions when socket writes occur concurrently with HCI device shutdown and workqueue draining. A local user can trigger Bluetooth socket writes during workqueue draining to disrupt Bluetooth data transmission.

196) Out-of-bounds read (CVE-ID: CVE-2026-98298)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds reads and silent data loss.

The vulnerability exists due to incorrect scatterlist entry length selection in mmp_pdma_prep_slave_sg() when preparing DMA transfers from scatterlists containing entries of different lengths. A local user can trigger processing of such a scatterlist to cause out-of-bounds reads and silent data loss.

197) Division by zero (CVE-ID: CVE-2026-98299)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to division by zero in the Linux kernel functions tcp_rcvbuf_grow() and tcp_rcv_space_adjust() when processing incoming TCP data with a zero receive-queue space value. A remote attacker can send TCP data that triggers a kernel crash to cause a denial of service.

Exploitation requires tcp_rmem[1] to be configured to a very small value, such as 1.

198) Race condition (CVE-ID: CVE-2026-98300)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to a race condition in tcp_v6_do_rcv() when processing incoming IPv6 TCP packets concurrently with closure of a listening socket. A local user can close a listening socket during the race window between tcp_v6_rcv() and tcp_v6_do_rcv() to trigger a kernel warning.

The affected path requires IPv6 receive options to be enabled through np->rxopt.all.

199) Improper locking (CVE-ID: CVE-2026-98301)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking in br_mst_set_state() when processing nonzero MSTI state changes through netlink. A local user can request these state changes to cause a denial of service.

The switchdev_port_attr_set() call invokes a blocking notifier chain that may sleep while an RCU read-side critical section is active. Nonzero MSTI changes are processed with the RTNL lock held.

200) NULL pointer dereference (CVE-ID: CVE-2026-98302)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the Linux kernel skfp FDDI driver's adapter reset path when setting the MAC address on a down interface that has never been brought up. A local privileged user can set the interface's MAC address to trigger a kernel oops and cause a denial of service.

Exploitation requires the CAP_NET_ADMIN capability.

201) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98303)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper checking of unreachable input routes in icmp_route_lookup() when performing reverse-path route lookup for ICMP output. A local user can supply a packet whose source address resolves to an unreachable input route to trigger a kernel warning.

The reverse-path lookup is reached when the forward output route cannot be used. An unreachable input route can be returned when forwarding is disabled.

202) Improper access control (CVE-ID: CVE-2026-98306)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass VRF socket isolation.

The vulnerability exists due to improper access control caused by failure to propagate the VRF interface flag in decap_and_validate() in net/ipv6/seg6_local.c when decapsulating IPv4 traffic from SRv6 packets received on VRF-enslaved interfaces. A remote attacker can send SRv6 packets carrying IPv4 traffic that is delivered to an unbound socket outside the ingress VRF to bypass VRF socket isolation.

The behavior is observable with the End.DX4 action during delivery to a local address of the node.

203) Memory leak (CVE-ID: CVE-2026-98307)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak.

The vulnerability exists due to missing release of station statistics allocations in ath11k_mac_peer_cleanup_all() when recovering from a firmware crash. A local user can encounter firmware-crash recovery with allocated station statistics to cause a memory leak.

The unreleased allocations are arsta->rx_stats and arsta->tx_stats. Recovery calls ieee80211_restart_hw(), which assumes that driver resources have already been cleaned up.

204) NULL pointer dereference (CVE-ID: CVE-2026-98308)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the ALSA HDA PCM open tracepoint when stream assignment fails because hardware streams are exhausted. A local user can attempt to open a PCM substream under these conditions to cause a denial of service.

The tracepoint payload accesses the assigned stream tag before checking whether stream assignment succeeded.

205) Use-after-free (CVE-ID: CVE-2026-98309)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to use-after-free in the vc4 driver's KMS output polling when the driver is unbound and scheduled polling work accesses a freed drm_device. A local privileged user can unload the vc4 driver while output polling remains scheduled to cause a denial of service.

206) Use-after-free (CVE-ID: CVE-2026-98311)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to use-after-free in virt_wifi_newlink() when transferring operational state before device registration. A local user can attempt to create a virtual wireless device with an invalid name while its lower device is dormant to trigger a use-after-free in the kernel.

Exploitation requires device registration to fail and a subsequent linkwatch_fire_event() call to access the queued list entry after the device object has been freed.

207) Out-of-bounds write (CVE-ID: CVE-2026-98312)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds write in usb6fire_pcm_in_urb_handler() in the ALSA 6fire driver when calculating outgoing isochronous packet sizes from device-reported input lengths. A local user can supply isochronous packets whose reported lengths cause output buffer writes to exceed the allocated buffer to cause a denial of service.

Zero-length isochronous packets are legal on the USB bus. At 88.2/96 kHz, eight full 420-byte input packets can produce 5024 bytes of output for a 4832-byte buffer.

208) NULL pointer dereference (CVE-ID: CVE-2026-98314)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in ALSA PCM timer initialization when concurrent timer callbacks execute before the registered timer's private data is initialized. A local user can read /proc/asound/timers concurrently with PCM timer initialization to cause a denial of service.

209) Use-after-free (CVE-ID: CVE-2026-98316)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in kernel memory.

The vulnerability exists due to a use-after-free caused by a race condition in the ALSA bcd2000 USB driver when handling USB disconnect concurrently with rawmidi operations. A local user can cause a rawmidi trigger callback to overlap with USB disconnect handling to trigger a use-after-free in kernel memory.

An in-flight function such as bcd2000_midi_send() can continue accessing a USB request block (URB) during disconnect handling.

210) Memory leak (CVE-ID: CVE-2026-98319)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to deplete kernel memory.

The vulnerability exists due to a memory leak caused by incomplete error-path cleanup in prepare_signaling() in the DRM subsystem when handling a request that provides an out_fence_ptr without DRM_MODE_PAGE_FLIP_EVENT and encounters an allocation failure or a failure in setup_out_fence(). A local user can trigger an error path that leaves a drm_pending_vblank_event unreleased to deplete kernel memory.

211) Use-after-free (CVE-ID: CVE-2026-98320)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise confidentiality, integrity, and availability.

The vulnerability exists due to use-after-free in the netfilter flowtable component when the flowtable datapath accesses connection-tracking state after its reference has been released. A local user can access prematurely released connection-tracking state to compromise confidentiality, integrity, and availability.

RCU typesafe semantics also allow a flowtable datapath reference to resolve to the wrong connection-tracking object.

212) Use of Uninitialized Variable (CVE-ID: CVE-2026-98322)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause uninitialized stack data to be used during IPv4 address mapping.

The vulnerability exists due to use of an uninitialized variable in nft_nat_setup_netmap() when constructing an IPv4 netmap address. A local user can trigger IPv4 netmap processing to cause uninitialized stack data to be used during IPv4 address mapping.

Only the 4-byte IPv4 member of the 16-byte address union is initialized before the entire union is copied into the address range passed to nf_nat_setup_info(). The IPv6 path initializes all 16 bytes and is not affected.

213) Out-of-bounds write (CVE-ID: CVE-2026-98323)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt receive-state memory.

The vulnerability exists due to an out-of-bounds write in the Linux kernel RDMA/siw siw_get_hdr() function when receiving an extended DDP/RDMAP header across multiple TCP callbacks. A remote attacker can send a fragmented extended DDP/RDMAP header to corrupt receive-state memory.

214) Improper initialization (CVE-ID: CVE-2026-98325)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent failed wireless transmissions from being reported to userspace.

The vulnerability exists due to improper initialization of socket buffer transmit metadata in the mac80211 transmit path when handling transmit header construction and socket buffer resizing failures. A local user can trigger the affected transmit failure paths to prevent failed wireless transmissions from being reported to userspace.

215) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98326)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to failure to release an acquired channel context in ieee80211_join_mesh() when mesh startup fails. A local user can trigger a mesh startup failure followed by interface removal to trigger a kernel warning.

During interface removal, the channel context is unassigned after the interface has already been removed from the driver.

216) Memory leak (CVE-ID: CVE-2026-98327)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a memory leak and leave stale channel-switch state.

The vulnerability exists due to incomplete cleanup of allocated memory and channel-switch state in ieee80211_stop_mesh() when leaving a mesh network while a channel switch is pending. A local user can leave the mesh before the channel switch completes to cause a memory leak and leave stale channel-switch state.

217) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2026-98328)

CWE-ID: CWE-131 - Incorrect Calculation of Buffer Size

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt wireless scanning.

The vulnerability exists due to incorrect calculation of the probe request element buffer size in the mac80211 wireless subsystem when building probe request elements. A local user can initiate a wireless scan to disrupt wireless scanning.

The issue requires hardware support for 6 GHz. The HE 6 GHz Band Capability element is included in probe requests for every band when this support is present.

218) Improper input validation (CVE-ID: CVE-2026-98329)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to insufficient validation of requested transmission bandwidth in mac80211 radiotap parsing when processing frames injected through a monitor interface. A local user can inject a frame with a radiotap field requesting bandwidth wider than the operational channel bandwidth to trigger a kernel warning.

The reported warning occurs in hwsim when the requested bandwidth is passed to the driver.

219) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98331)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to retaining references to unregistered interfaces in the mac80211 interface list when unregistering a network device without going through ieee80211_if_remove(). A local user can trigger destruction of a network namespace containing a wiphy to cause a denial of service.

Exploitation depends on allocation failures preventing the wiphy from being moved to the initial network namespace. Subsequent hardware unregistration can trigger a kernel BUG.

220) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98334)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of failure conditions in the mac80211 ieee80211_start_ap() function when access point startup fails after setting beaconing state. A local user can trigger a failed access point startup followed by scanning to cause a denial of service.

The divide error was observed with the mac80211_hwsim driver.

221) NULL pointer dereference (CVE-ID: CVE-2026-98335)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in mac80211 mesh channel-switch finalization when a mesh interface leaves the mesh with a channel switch still active. A local user can trigger departure from the mesh during an active channel switch to cause a denial of service.

Leaving the mesh releases the channel context, but pending channel-switch finalization work subsequently attempts to rebuild the mesh beacon.

222) Improper input validation (CVE-ID: CVE-2026-98336)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause unsupported traffic control setup on purely virtual interfaces to be passed to drivers.

The vulnerability exists due to insufficient validation of interface types in ieee80211_netdev_setup_tc() in mac80211 when configuring traffic control offloading on AP_VLAN interfaces. A local user can request traffic control offloading on an AP_VLAN interface to cause unsupported traffic control setup on purely virtual interfaces to be passed to drivers.

223) Race condition (CVE-ID: CVE-2026-98337)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to a race condition in __ieee80211_roc_work() in net/mac80211/offchannel.c when processing remain-on-channel work concurrently with a wireless scan. A local user can cause a remain-on-channel operation to start during a scan to trigger a kernel warning.

The problematic sequence involves pending remain-on-channel work, an initially empty remain-on-channel list, and a newly queued operation. The warning occurs in ieee80211_start_next_roc().

224) Incorrect comparison (CVE-ID: CVE-2026-98339)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a kernel warning.

The vulnerability exists due to incorrect BSS type comparison in cfg80211_update_assoc_bss_entry() when updating an associated access point's BSS entry after a channel change. A remote attacker can operate a rogue access point that switches to a channel containing an existing BSS entry with a mismatched advertised type to trigger a kernel warning.

The retained entry collides with the associated access point's entry in the BSS red-black tree during cfg80211_rehash_bss().

225) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98340)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger kernel warnings and prevent beacon data from being populated or updated for grouped BSS entries.

The vulnerability exists due to improper validation of beacon data presence in cfg80211 BSS grouping when processing probe responses and subsequent hidden-SSID beacons. A remote attacker can transmit probe responses that cause entries without beacon data to be grouped, followed by a hidden-SSID beacon with the same BSSID and channel, to trigger kernel warnings and prevent beacon data from being populated or updated for grouped BSS entries.

A hidden SSID can be zero-length or NUL-filled.

226) Use-after-free (CVE-ID: CVE-2026-98342)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel DMA engine when releasing a DMA device while concurrent RCU readers traverse the device list. A local user can trigger concurrent device release and list traversal to trigger a use-after-free.

Holding a dmaengine reference to the provider module no longer guarantees that the DMA device remains alive.

227) Use-after-free (CVE-ID: CVE-2026-98343)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free read in the kernel.

The vulnerability exists due to use-after-free in dma_chan_put() and dma_release_channel() when releasing a DMA channel drops the last reference to its device and frees the device and its channels. A local user can trigger DMA channel release to trigger a use-after-free read in the kernel.

228) Improper update of reference count (CVE-ID: CVE-2026-98344)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference counting in dma_chan_put() in drivers/dma/dmaengine.c when releasing DMA channels acquired through the fast path. A local user can cycle dmaengine_get() and dmaengine_put() to cause a denial of service.

Exploitation requires a non-private DMA provider with a persistent client keeping chan->client_count greater than zero.

229) Use of Uninitialized Variable (CVE-ID: CVE-2026-98345)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect classification of transmitted IP frames.

The vulnerability exists due to use of uninitialized memory caused by missing IP header length checks in cfg80211_classify8021d() when processing outgoing frames with undersized IP headers. A local user can transmit a frame marked as IPv4 or IPv6 with an incomplete IP header to cause incorrect classification of transmitted IP frames.

230) NULL pointer dereference (CVE-ID: CVE-2026-98346)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in cfg80211_calculate_bi_data() when calculating beacon interval data for wireless devices without an associated network device. A local user can trigger the affected calculation to cause a denial of service.

The problematic radio-mask lookup occurs when a specific radio index is being considered.

231) Race condition (CVE-ID: CVE-2026-98347)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the Linux kernel IPoIB interface state handling when a light multicast flush overlaps with interface shutdown. A local user can bring an IPoIB interface down during a multicast flush to cause a denial of service by leaving IPOIB_FLAG_OPER_UP set after shutdown, resulting in endless workqueue retries and an interface teardown deadlock.

232) Out-of-bounds read (CVE-ID: CVE-2026-98348)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger an out-of-bounds read.

The vulnerability exists due to unsigned length arithmetic wrapping in libipw_handle_assoc_resp() when processing association response frames shorter than the 30-byte fixed prefix. A remote attacker can send a truncated association response frame to trigger an out-of-bounds read.

The ipw2100 and ipw2200 management receive paths check only for the generic 24-byte three-address header before reaching this function. The wrapped length is truncated to a 16-bit value near 64 KiB and passed to libipw_parse_info_param(), which reads beyond the receive buffer.

233) Out-of-bounds read (CVE-ID: CVE-2026-98349)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger reads beyond the allocated receive buffer.

The vulnerability exists due to an out-of-bounds read in libipw_network_init() and libipw_parse_info_param() when processing beacon or probe response frames shorter than the required 36-byte prefix. A remote attacker can send a specially crafted wireless management frame to trigger reads beyond the allocated receive buffer.

A 24-byte frame causes the information element length calculation to wrap and truncate to 65524, making the parser treat the buffer as containing almost 64 KiB of information elements.

234) Memory leak (CVE-ID: CVE-2026-98351)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause kernel memory leaks.

The vulnerability exists due to failure to free socket buffers in virt_wifi_start_xmit() when transmitting packets while the simulated link is disconnected. A local user can send packets through the disconnected simulated link to cause kernel memory leaks.

235) Race condition (CVE-ID: CVE-2026-98352)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a shared completion queue credit leak.

The vulnerability exists due to a race condition in the Linux kernel RDMA RTRS client when handling address resolution concurrently with connection teardown after an interrupted connection attempt. A local user can interrupt a connection attempt while the address resolution handler races with teardown to cause a shared completion queue credit leak.

Subsequent RDMA device unregistration triggers a kernel warning in ib_cq_pool_cleanup() if completion queue credits remain allocated.

236) Memory leak (CVE-ID: CVE-2026-98354)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service through memory exhaustion.

The vulnerability exists due to a receive buffer memory leak in ib_mad_complete_recv() in the RDMA MAD subsystem when processing management datagrams that fail PKey enforcement. A remote attacker can repeatedly send management datagrams with an incorrect PKey to cause a denial of service through memory exhaustion.

Each rejected datagram leaks approximately 300 bytes for an InfiniBand port or approximately 2 KB for OPA.

237) Use-after-free (CVE-ID: CVE-2026-98357)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Linux kernel iSER target's deferred control PDU completion handling when queued completion work executes after connection teardown has freed the connection objects. A local user can trigger connection teardown while control PDU completions remain queued to cause a denial of service.

The affected completion states are ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and ISTATE_SEND_TEXTRSP. ISTATE_SEND_LOGOUTRSP follows a separate logout wait path.

238) NULL pointer dereference (CVE-ID: CVE-2026-98358)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the iSER initiator's iser_check_remote_inv() and iser_inv_desc() functions when processing remote invalidations for unregistered data directions. A remote attacker can respond to a write command with IB_WR_SEND_WITH_INV to cause a denial of service.

The triggering write command sends all of its data as immediate data. Exploitation requires control of the target responding to the initiator.

239) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98359)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an RDMA port query to operate on an unregistered and uninitialized network device.

The vulnerability exists due to a missing registration-state check in ib_get_eth_speed() when processing asynchronous RDMA port queries during network device unregistration. A local user can trigger an asynchronous RDMA port query to cause an RDMA port query to operate on an unregistered and uninitialized network device.

The reference returned by ib_device_get_netdev() keeps the network device structure allocated but does not ensure that the device remains operational. The ethtool callback can be invoked after NETDEV_UNREGISTER and ndo_uninit have completed.

240) Use-after-free (CVE-ID: CVE-2026-98360)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to a use-after-free in the RDMA/rxe multicast-group handling code when a failed multicast-address operation frees a group that remains published in the multicast-group tree. A local user can request a subsequent attachment to the same multicast group to trigger a use-after-free in the kernel.

This path is reachable through ATTACH_MCAST on a UD queue pair. The initial rxe_mcast_add() failure can occur when the backing network device has been removed or dev_mc_add() returns an error.

241) Out-of-bounds read (CVE-ID: CVE-2026-98362)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect clock rates to be reported to consumers.

The vulnerability exists due to an out-of-bounds read in scpi_dvfs_recalc_rate() in the SCPI clock driver when recalculating a clock rate using an out-of-range DVFS index returned by SCP firmware. A local user can trigger clock-rate recalculation using such an index to cause incorrect clock rates to be reported to consumers.

The SCP firmware may supply the invalid index because it is buggy or returns a stale value.

242) Out-of-bounds read (CVE-ID: CVE-2026-98363)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds reads and populate the operating performance point table with invalid entries.

The vulnerability exists due to an out-of-bounds read caused by a missing upper-bound check in scpi_dvfs_get_info() when processing operating performance point counts from SCP firmware replies. A local user can supply a firmware reply with a count greater than MAX_DVFS_OPPS to cause out-of-bounds reads and populate the operating performance point table with invalid entries.

243) Integer overflow (CVE-ID: CVE-2026-98365)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the Linux kernel RDMA/rxe mr_check_range() function when validating memory ranges supplied in RDMA read or write requests. A remote attacker can send a specially crafted RDMA request whose address and length cause arithmetic wraparound, bypassing the range check and triggering an out-of-bounds read or write and a kernel oops to cause a denial of service.

244) Use-after-free (CVE-ID: CVE-2026-98366)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel RDMA/rxe memory registration and cleanup code when re-registering a memory region with both protection-domain and access changes and unsupported access flags. A local user can trigger a failed re-registration followed by memory-region deregistration, protection-domain deallocation, and memory-window cleanup to cause a denial of service.

245) Use-after-free (CVE-ID: CVE-2026-98367)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to use-after-free in the RDMA/siw siw_accept() function when cleaning up after a failed siw_qp_modify() call. A local user can trigger a concurrent queue pair transition to the error state to corrupt kernel memory.

Exploitation requires the concurrent transition to occur after the queue pair state lock is released but before connection endpoint cleanup completes.

246) Memory leak (CVE-ID: CVE-2026-98368)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak kernel page memory.

The vulnerability exists due to missing release of a destination-page reference in esp_output_tail() and skb_release_data() when processing out-of-place ESP output containing zerocopy managed fragments. A local user can trigger this processing to leak kernel page memory.

The destination page retains a reference while SKBFL_MANAGED_FRAG_REFS remains set, causing skb_release_data() to take its skip_unref branch. The leak occurs at packet rate.

247) Use-after-free (CVE-ID: CVE-2026-98368)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free of zerocopy pages.

The vulnerability exists due to incorrect page reference counting in the ESP output path and esp_ssg_unref() when processing out-of-place output containing zerocopy managed fragments. A local user can trigger this processing to cause a use-after-free of zerocopy pages.

The affected pages remain pinned while their reference counts fall below the GUP pin bias.

248) Improper locking (CVE-ID: CVE-2026-98369)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger kernel RCU lockdep warnings.

The vulnerability exists due to missing RCU read-side locking and insufficient object lifetime management in xfrm_trans_reinject() and xfrm_trans_queue_net() when reinjecting transport-mode packets through a workqueue. A local user can cause transport-mode packets to undergo deferred reinjection to trigger kernel RCU lockdep warnings.

Under CONFIG_PREEMPT_RCU, workqueue workers run in process context where local_bh_disable() does not establish an RCU read-side critical section. Queued packets may carry non-reference-counted destination entries, and network-device unregistration can replace a destination's device with blackhole_netdev.

249) Use-after-free (CVE-ID: CVE-2026-98370)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to use-after-free in xfrm_alloc_userspi() and xfrm_user_rcv_msg() when processing compat ALLOCSPI requests. A local user can submit a compat ALLOCSPI request that causes a translated child buffer to be attached to the inbound request to trigger a use-after-free in the kernel.

Exploitation depends on a multicast clone sharing skb_shared_info with the request and a compat receiver still copying from the translated child when the request handler frees it.

250) Incorrect calculation (CVE-ID: CVE-2026-98373)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect destination address calculation in move_hugetlb_page_tables() when skipping a source page table that is absent initially or after unsharing a PMD table. A local user can invoke mremap() with source and destination addresses at different offsets within their page tables to cause a denial of service.

251) Use-after-free (CVE-ID: CVE-2026-98374)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tcp_send_synack() when replacing a cloned SYN socket buffer in the retransmit queue without updating the retransmission hint. A local user can initiate a TCP Fast Open connection using sendmsg(MSG_FASTOPEN) and supply an ICMP fragmentation-needed message to cause a denial of service.

Exploitation requires a simultaneous open after the retransmission hint has been armed.

252) Out-of-bounds read (CVE-ID: CVE-2026-98375)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to insufficient validation of the Ethernet header length in xen/netfront handle_incoming_queue() when processing backend-supplied receive packets. A local user can supply a packet whose first receive slot is shorter than ETH_HLEN and is followed by additional slots to cause a denial of service.

Exploitation requires control over the receive slot lengths supplied by the backend.

253) Out-of-bounds read (CVE-ID: CVE-2026-98377)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized kernel slab memory.

The vulnerability exists due to an out-of-bounds read caused by insufficient verification of MAC header availability in __vlan_insert_inner_tag() when inserting VLAN tags into undersized frames. A local user can send a one-byte AF_PACKET/SOCK_RAW frame through an IFF_TUN device subjected to repeated VLAN pushes to disclose uninitialized kernel slab memory.

The IFF_TUN device has hard_header_len set to zero. The first VLAN push sets only a hardware-accelerated tag; subsequent pushes reach the helper through a clsact VLAN push action or bpf_skb_vlan_push().

254) Use-after-free (CVE-ID: CVE-2026-98378)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the BPF link iterator when iterating over unsettled links during link creation. A local user can trigger concurrent BPF link creation and iteration to cause a denial of service.

Exploitation requires anon_inode_getfile() to fail after the iterator acquires a reference to the unsettled link. The reported kernel panic occurred with KASAN panic_on_warn enabled.

255) NULL pointer dereference (CVE-ID: CVE-2026-98379)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to a null pointer dereference in the Linux kernel IPv6 reverse-path filtering component when processing a route without an inet6_dev. A local user can use rtnetlink to lower an external nexthop device's MTU below IPV6_MIN_MTU and trigger an IPv6 reverse-path filtering lookup to cause a denial of service by triggering a kernel panic.

An unprivileged user can construct the required state within a private user namespace and network namespace.

256) Race condition (CVE-ID: CVE-2026-98380)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition and improper error-pointer validation in tcf_idr_delete_index() in net/sched/act_api.c when deleting traffic control actions. A local user can trigger concurrent action deletion and reservation of the same IDR slot to cause a denial of service.

257) Use-after-free (CVE-ID: CVE-2026-98381)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the veth driver's XDP program handling when resizing receive channels and detaching or replacing an XDP program. A local user can reduce the receive channel count, detach or replace the XDP program, and subsequently increase the channel count to cause a denial of service.

258) Out-of-bounds read (CVE-ID: CVE-2026-98382)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to an out-of-bounds read in veth_xdp_rx_timestamp() when executing veth-specific metadata kfuncs on a tun device's xdp_buff. A local privileged user can use bpf(BPF_LINK_CREATE) with a different target interface index to attach a veth-bound program to a tun device to cause a denial of service by triggering a kernel panic.

Exploitation requires both CAP_BPF and CAP_NET_ADMIN capabilities.

259) Use-after-free (CVE-ID: CVE-2026-98383)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to use-after-free in BPF LWT_SEG6LOCAL handling when performing post-program SRH validation. A local user can run an LWT_SEG6LOCAL program that invalidates its cached SRH with bpf_lwt_seg6_adjust_srh() and then calls bpf_skb_pull_data() to corrupt kernel memory.

Reallocation of skb->head leaves the per-CPU SRH pointer dangling, and subsequent SRH validation writes through that pointer.

260) Out-of-bounds read (CVE-ID: CVE-2026-98384)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds memory read.

The vulnerability exists due to an out-of-bounds read in bpf_sock_destroy() when processing a timewait or request socket supplied by the TCP iterator. A local user can invoke bpf_sock_destroy() through a TCP iterator BPF program with such a socket to trigger an out-of-bounds memory read.

The sk_protocol field belongs to struct sock and is not present in struct sock_common or the supplied socket objects.

261) Reliance on undefined behavior (CVE-ID: CVE-2026-98386)

CWE-ID: CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to the use of ordinary memory operations on device I/O memory in the qla2xxx driver's __qla2x00_alloc_iocbs() function when clearing a QLAFX00 request ring slot. A local user can trigger the affected slot-clearing operation to cause a denial of service.

On architectures such as ARM64, a regular memset() may emit unaligned or block-zeroing instructions that are invalid for device memory, resulting in a synchronous external abort.

262) Out-of-bounds write (CVE-ID: CVE-2026-98403)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory.

The vulnerability exists due to an out-of-bounds write in append_ipl_block_parm() in arch/s390/boot/ipl_parm.c when appending an IPL parameter to a command line that occupies all but the terminating byte of COMMAND_LINE_SIZE. A local user can supply an IPL parameter that causes the conversion helpers to write beyond the early_command_line buffer to corrupt memory.

263) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98406)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to insufficient validation of the interface's driver-presence state in ieee80211_set_bitrate_mask() when handling wireless bitrate-setting requests. A local user can issue a SIOCSIWRATE ioctl for an interface marked as running but absent from the driver to trigger a kernel warning.

The affected state can occur during interface teardown or during bringup before the interface is added to the driver.

264) Out-of-bounds write (CVE-ID: CVE-2026-98407)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt unrelated kernel heap objects.

The vulnerability exists due to incorrect pointer arithmetic resulting in an out-of-bounds write in the rsi_hal_load_key() function when removing a key with a null data pointer. A local user can trigger a key-removal operation to corrupt unrelated kernel heap objects.

The write occurs on every DISABLE_KEY callback, including during disconnects, roaming, and interface teardown. It writes 144 zero bytes approximately 2.4 KB beyond the end of a 160-byte heap buffer.

265) Division by zero (CVE-ID: CVE-2026-98409)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to division by zero in the rtd119x watchdog driver's rtd119x_wdt_probe() function when initializing the watchdog device with a clock rate of zero. A local user can trigger the affected initialization path to cause a denial of service.

266) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98410)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through an unexpected system reset.

The vulnerability exists due to incomplete watchdog state checks in da9063_wdt_suspend() and da9063_wdt_resume() when handling system suspend and resume. A local user can trigger system suspend while the hardware watchdog is running but not marked active to cause a denial of service through an unexpected system reset.

The issue occurs when the driver leaves the watchdog running and userspace never opens the watchdog device. The software power-management path must be enabled.

267) NULL pointer dereference (CVE-ID: CVE-2026-98411)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null-pointer dereference in the Linux kernel power sequencing subsystem when handling a dev_set_name() failure in pwrseq_device_register(). A local user can trigger the device-registration error path to cause a denial of service.

The error path invokes pwrseq_release(), which unconditionally iterates over the targets list before its list head has been initialized.

268) NULL pointer dereference (CVE-ID: CVE-2026-98412)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null-pointer dereference caused by an uninitialized unit list in the power-sequencing subsystem when releasing a partially initialized unit after a memory allocation failure. A local user can trigger this cleanup path to cause a denial of service.

269) Use of Uninitialized Variable (CVE-ID: CVE-2026-98413)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause SELinux to use uninitialized access-decision data.

The vulnerability exists due to use of an uninitialized stack variable in the SELinux avc_has_perm_noaudit() function when handling an empty requested permission set. A local user can trigger a permission check with an empty requested permission set to cause SELinux to use uninitialized access-decision data.

Callers pass the resulting decision to avc_audit(), and the inode hook also stores it in the per-task decision cache.

270) NULL pointer dereference (CVE-ID: CVE-2026-98416)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in k3_udma_glue_release_rx_chn() in the Linux kernel TI K3 UDMA glue driver when handling a receive-channel request after memory allocation fails. A local user can trigger the affected cleanup path to cause a denial of service.

The failure occurs when devm_kcalloc() cannot allocate the receive-channel flow array and cleanup subsequently calls k3_udma_glue_release_rx_flow().

271) Numeric Truncation Error (CVE-ID: CVE-2026-98417)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to trigger a kernel warning.

The vulnerability exists due to integer truncation in the handle_esp() function in net/xfrm/espintcp.c when processing ESP-in-TCP packets after the stream parser trims the TCP envelope. A remote attacker can supply packets whose transport header offset cannot be represented to trigger a kernel warning.

272) Out-of-bounds write (CVE-ID: CVE-2026-98419)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in reset_per_cpu_data() in the Linux kernel drop_monitor component when zeroing an alert message buffer. A local user can trigger an oversized memset() operation to corrupt kernel memory.

The write extends four bytes beyond the allocated buffer and corrupts skb_shared_info.

273) Improper input validation (CVE-ID: CVE-2026-98421)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper validation of the peer station state in the mac80211 TDLS management component when preparing a TDLS setup confirmation frame. A local user can request a TDLS setup confirmation for a peer without an existing TDLS station to trigger a kernel warning.

274) Improper initialization (CVE-ID: CVE-2026-98422)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to improper reinitialization of the crypto_tx_tailroom_needed_cnt counter in mac80211 AP_VLAN interface handling when bringing an AP_VLAN interface down. A local user can repeatedly bring the same AP_VLAN interface down and up while its parent AP interface remains up to trigger a kernel warning.

The sanity check detects a mismatch between the AP_VLAN interface's counter and the parent AP interface's counter.

275) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-98423)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to a time-of-check time-of-use race condition in mac80211_hwsim when processing frames from wmediumd during radio shutdown. A local user can submit frames from userspace concurrently with radio shutdown to trigger a kernel warning.

276) Reachable assertion (CVE-ID: CVE-2026-98425)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to an unnecessary warning assertion in ieee80211_request_ibss_scan() when requesting an IBSS scan with no channels permitted by the current regulatory domain. A local user can request a scan under this condition to trigger a kernel warning.

The regulatory domain can change while an IBSS is operating, and the IBSS can continue operating briefly during a 60-second grace period before shutdown.

277) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98426)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak interrupt resources.

The vulnerability exists due to incorrect resource cleanup using the wrong context index in mwifiex_pcie_request_irq() when handling an MSI-X interrupt registration failure. A local user can trigger this error path to leak interrupt resources.

278) Use-after-free (CVE-ID: CVE-2026-98428)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to improper lifetime management of reference-counted USB request blocks in the ALSA USB 6fire driver when releasing embedded USB request blocks asynchronously. A local user can exercise the affected URB release paths to trigger a use-after-free in the kernel.

The affected URBs are embedded in structures used for PCM, MIDI, and communication.

279) Use-after-free (CVE-ID: CVE-2026-98429)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free and access to uninitialized state in the EFA RDMA driver's completion interrupt handler when event queues are initialized or destroyed. A local user can trigger interrupt handling that accesses event queue state or a DMA buffer outside its valid lifetime to cause a denial of service.

280) Use-after-free (CVE-ID: CVE-2026-98430)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel EFA RDMA driver's management interrupt handler when handling interrupts during device removal. A local user can exploit interrupt handling that accesses already-destroyed admin completion and asynchronous event queues to cause a denial of service.

The lifetime mismatch also permits the interrupt handler to access these queues before they have been initialized during device initialization.

281) Use-after-free (CVE-ID: CVE-2026-98432)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through access to freed IPv6 request socket options.

The vulnerability exists due to use-after-free in tcp_v6_reqsk_destructor() when request socket migration leaves concurrent processing using shared options after they have been freed. A remote attacker can send TCP traffic that encounters concurrent request socket migration and destruction to potentially cause a kernel crash.

The affected ipv6_opt options are only set by CALIPSO.

282) Use-after-free (CVE-ID: CVE-2026-98432)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service by triggering access to freed IPv4 socket options.

The vulnerability exists due to use-after-free in the Linux kernel IPv4 TCP socket option handling when socket destruction frees shared options while another CPU is still using them to build a SYNACK or create a child socket. A remote attacker can send TCP traffic that encounters these concurrent processing paths to potentially cause a kernel crash.

The request socket migration path requires net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program. IPv6 is not affected by the child socket ownership-transfer path because it duplicates the options.

283) Improper input validation (CVE-ID: CVE-2026-99999)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt IPv4 packet headers and potentially compromise system confidentiality, integrity, and availability.

The vulnerability exists due to improper validation of the checksum start offset in the Linux kernel IPv4 checksum-completion paths when processing packets with invalid checksum metadata. A remote attacker can introduce a packet whose checksum start offset precedes the end of its IPv4 header into an affected processing path to cause skb_checksum_help to corrupt the network header, potentially compromising system confidentiality, integrity, and availability.

Remediation

Install update from vendor's website.

References

• https://lists.debian.org/debian-security-announce/2026/msg00482.html