SB20261111176 - Ubuntu update for linux, linux-aws, linux-gcp and more

Description

This security bulletin contains information about 391 vulnerabilities.

1) NULL pointer dereference (CVE-ID: CVE-2026-68305)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in the xe SR-IOV VF CCS detach and migrate buffer handling code when destroying buffer objects after the device is unbound. A local user can trigger buffer object destruction in this state to cause a denial of service.

The issue occurs while the DRM structure remains valid after device unbind.

2) Use-after-free (CVE-ID: CVE-2026-72404)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to a use-after-free in the TIPC UDP media bearer cleanup logic in net/tipc/udp_media.c when tearing down a bearer while concurrent transmit or receive operations are still accessing cached destinations or bearer state under RCU protection. A local attacker can trigger concurrent TIPC UDP activity during bearer cleanup to cause a denial of service.

The issue can affect concurrent transmitters through replicast destination cache access and concurrent receivers through access to the bearer structure after teardown begins.

3) Improper input validation (CVE-ID: CVE-2026-72497)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper input validation in the bnxt_re queue pair initialization logic when processing a user-supplied sq_slots value for variable WQE mode. A local user can supply an invalid sq_slots value to cause a denial of service.

The issue occurs when variable WQE mode is used, and the supplied sq_slots value is zero or exceeds the hardware-supported maximum of 64K.

4) Improper access control (CVE-ID: CVE-2026-74527)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to modify shared packet kind configuration and disrupt network parsing behavior.

The vulnerability exists due to improper access control in the octeontx2-af CGX/NIX PKIND configuration logic when allocating or configuring a VF NIX logical function that shares a CGX LMAC with a PF using HiGig2 or EDSA parsing. A local user can allocate or configure a crafted VF NIX logical function to modify shared packet kind configuration and disrupt network parsing behavior.

Only CGX-mapped virtual functions sharing a LMAC with a physical function using special parse kinds are affected.

5) Race condition (CVE-ID: CVE-2026-74568)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the KVM arm64 VGIC LPI handling logic when releasing and re-registering LPIs with the same INTID concurrently. A local user can trigger concurrent DISCARD and MAPTI operations to cause a denial of service.

The issue occurs in the direct release and deferred release paths and can result in deletion of a newly registered LPI or leakage of an orphaned LPI.

6) Reliance on undefined behavior (CVE-ID: CVE-2026-89568)

CWE-ID: CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger undefined behavior.

The vulnerability exists due to an incorrect integer shift size calculation in kho_preserved_memory_reserve() when processing properly aligned preservation reservations larger than 2 GiB. A local user can cause an oversized preservation reservation to be processed to trigger undefined behavior.

Such reservations can be obtained through kho_preserve_pages(), including by memblock reserve_mem.

7) Use-after-free (CVE-ID: CVE-2026-89764)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a use-after-free condition.

The vulnerability exists due to a race condition in the Rust Devres resource-management component when concurrently revoking a Devres object. A local user can trigger concurrent resource revocation to cause a use-after-free condition.

The condition occurs when the release callback and Devres destruction execute concurrently.

8) Out-of-bounds write (CVE-ID: CVE-2026-89907)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to improper input validation in the LoongArch KVM pch_msi_set_irq() function when processing user-supplied MSI data. A local user can supply an MSI data value of 256 or greater through KVM MSI routing or signaling interfaces to corrupt kernel memory.

The DMSINTC path is unaffected.

9) NULL pointer dereference (CVE-ID: CVE-2026-90144)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in dpll_device_ops() when a DPLL device is unregistered while a queued pin notification still references it. A local user can trigger the teardown race to cause a denial of service.

10) Use-after-free (CVE-ID: CVE-2026-90155)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in ksmbd byte-range lock handling when processing SMB byte-range lock requests with blocked dependent waiters. A remote attacker can submit lock requests that leave a dependent waiter attached to a freed lock to cause a denial of service.

11) Use-after-free (CVE-ID: CVE-2026-90162)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a use-after-free and double-free.

The vulnerability exists due to improper synchronization in smb2_lock() when processing SMB2_LOCK request arrays. A remote attacker can submit a crafted SMB2_LOCK request with a later failing lock element while concurrently sending an UNLOCK request to cause a use-after-free and double-free.

The concurrent UNLOCK request must target the same connection before rollback processing occurs.

12) Race condition (CVE-ID: CVE-2026-90167)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect oplock state handling.

The vulnerability exists due to a race condition in ksmbd oplock handling when handling concurrent SMB requests that close files and break oplocks. A remote attacker can trigger concurrent oplock close and break operations to cause incorrect oplock state handling.

13) Use-after-free (CVE-ID: CVE-2026-90317)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access a freed task_struct object.

The vulnerability exists due to improper handling of RCU-protected pointers in the BPF verifier when releasing the final BPF spin lock in a sleepable BPF program and subsequently using an RCU-protected kptr. A local user can execute a BPF program that uses an RCU-protected kptr after releasing its final spin lock to access a freed task_struct object.

The pointer remains valid to the verifier after the final lock release, allowing another CPU to free the referenced object before it is used.

14) Use-after-free (CVE-ID: CVE-2026-93175)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free condition.

The vulnerability exists due to use-after-free in amdgpu_dm_crtc_reset_state() when allocating a new CRTC state after freeing the old state. A local user can invoke CRTC state reset when memory allocation fails to trigger a use-after-free condition.

15) NULL pointer dereference (CVE-ID: CVE-2026-98038)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a null pointer dereference.

The vulnerability exists due to improper reference ownership tracking in the BPF verifier when verifying BPF programs that acquire references from borrowed RCU kptrs. A local user can load a crafted BPF program that uses a borrowed RCU kptr without a required NULL check to trigger a null pointer dereference.

The issue occurs when the refcounted object does not contain a graph node and its last real reference is dropped during an RCU critical section.

16) Out-of-bounds read (CVE-ID: CVE-2026-98375)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to insufficient validation of the Ethernet header length in xen/netfront handle_incoming_queue() when processing backend-supplied receive packets. A local user can supply a packet whose first receive slot is shorter than ETH_HLEN and is followed by additional slots to cause a denial of service.

Exploitation requires control over the receive slot lengths supplied by the backend.

17) Use-after-free (CVE-ID: CVE-2026-98432)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to potentially cause a denial of service through access to freed IPv6 request socket options.

The vulnerability exists due to use-after-free in tcp_v6_reqsk_destructor() when request socket migration leaves concurrent processing using shared options after they have been freed. A remote attacker can send TCP traffic that encounters concurrent request socket migration and destruction to potentially cause a kernel crash.

The affected ipv6_opt options are only set by CALIPSO.

18) Use-after-free (CVE-ID: CVE-2026-98432)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to use-after-free in the Linux kernel IPv4 TCP socket option handling when socket destruction frees shared options while another CPU is still using them to build a SYNACK or create a child socket. A remote attacker can send TCP traffic that encounters these concurrent processing paths to potentially cause a kernel crash.

The request socket migration path requires net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program. IPv6 is not affected by the child socket ownership-transfer path because it duplicates the options.

19) Incorrect authorization (CVE-ID: CVE-2026-98655)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel instruction addresses and bypass kernel address space layout randomization (KASLR).

The vulnerability exists due to improper authorization in the Linux kernel perf subsystem when processing events that request text-poke records with exclude_kernel=1. A local user can open and mmap a task-local software event with text_poke=1 without kernel perf access to receive raw kernel instruction addresses from text-poke records and, with a known kernel image, determine the runtime kernel text base.

20) Use-after-free (CVE-ID: CVE-2026-98656)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a potential kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel IIO trigger subsystem when pending reenable_work executes after its owning trigger has been freed by iio_trig_release(). A local user can potentially trigger a race between deferred interrupt work and trigger teardown to cause access to freed kernel memory and crash the system.

21) Use-after-free (CVE-ID: CVE-2026-98657)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by accessing freed kernel memory.

The vulnerability exists due to a use-after-free in the Linux kernel pulsedlight proximity driver when runtime power management setup fails during device probing. The error handling frees the device structure without unregistering the IIO device, leaving live sysfs and character device nodes pointing to freed memory. A local user can access these stale device nodes to potentially trigger a kernel crash.

22) Out-of-bounds read (CVE-ID: CVE-2026-98658)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger out-of-bounds reads of kernel memory, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel AW96103 proximity driver's firmware parser when processing firmware with insufficiently validated length fields. A local privileged user can supply a truncated or malformed firmware image to trigger reads beyond the copied firmware buffer, potentially causing a kernel crash. Subtracting the four-byte register count field from a smaller declared length also causes an integer underflow, producing an excessively large payload length used to iterate over six-byte register/value entries.

23) Return of Wrong Status Code (CVE-ID: CVE-2026-98659)

CWE-ID: CWE-393 - Return of Wrong Status Code

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to obtain invalid pressure sensor data reported as successfully read when a sensor read fails.

The vulnerability exists due to incorrect error status reporting in the Linux kernel's bm1390_read_data() function when reading pressure sensor data. A local user can request a sensor reading that encounters a read error and receive a success status despite the invalid data, because the function unconditionally returns zero instead of the cached error value.

24) Out-of-bounds read (CVE-ID: CVE-2026-98660)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger an out-of-bounds kernel memory read, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel bmp280 pressure sensor driver's bmp280_write_sampling_frequency() function when looking up a requested sampling frequency. The function treats the number of flattened integer elements as the number of two-element frequency entries. A local privileged user can request a sampling frequency that causes the lookup to iterate beyond the table boundary, potentially causing a kernel fault and a denial of service.

25) Unchecked Return Value (CVE-ID: CVE-2026-98661)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service in buffered sensor acquisition.

The vulnerability exists due to an unchecked error return value in the Linux kernel ROHM BU27034 light sensor driver's bu27034_buffer_thread() function when reading the sensor integration time fails. A local user can initiate buffered sensor acquisition that encounters this error to cause the error code to be used in calculating the sleep duration, potentially leaving the acquisition thread delayed indefinitely.

26) Use-after-free (CVE-ID: CVE-2026-98662)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel use-after-free.

The vulnerability exists due to a use-after-free in the Linux kernel gp2ap020a00f light sensor driver when queued IRQ work executes after device removal has freed the trigger object. A local user can exploit this timing window to cause pending work to call iio_trigger_poll() on the freed object, potentially crashing the kernel.

27) Use-after-free (CVE-ID: CVE-2026-98663)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by triggering access to freed kernel memory.

The vulnerability exists due to a use-after-free in the Linux kernel adis16480 driver's debugfs file operations when firmware_revision or firmware_date is read concurrently with device unbinding. A local privileged user can trigger a read that remains in progress during device unbinding, allowing the read operation to access the freed iio_dev structure and potentially crash the kernel.

28) Use-after-free (CVE-ID: CVE-2026-98664)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel adis16400 driver's serial_number debugfs read handler when a read overlaps device unbinding. A local privileged user can read the debugfs file concurrently with device unbinding to potentially trigger a kernel crash, because debugfs removal does not wait for the read to finish before the underlying iio_dev is freed.

29) NULL pointer dereference (CVE-ID: CVE-2026-98665)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel crash.

The vulnerability exists due to a null pointer dereference in max30102_interrupt_handler() in the Linux kernel when an interrupt arrives while no buffer is enabled. A local user can cause the handler to dereference a null active_scan_mask pointer to crash the kernel if able to induce this interrupt condition.

30) Use-after-free (CVE-ID: CVE-2026-98666)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by triggering access to freed kernel memory.

The vulnerability exists due to a use-after-free in the Linux kernel adis16136 gyroscope driver's serial_number debugfs file operations when a read overlaps device unbinding. A local privileged user can read this file during device unbinding to trigger access to an iio_dev structure that has already been freed, potentially crashing the kernel.

31) Use of Uninitialized Variable (CVE-ID: CVE-2026-98667)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to use of uninitialized variables in the Linux kernel's adf4377_clk_register() function when registering device clocks. A local user can potentially trigger clock registration that uses uninitialized clock-parent metadata to cause a kernel crash.

The issue is exposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is enabled.

32) Use of uninitialized resource (CVE-ID: CVE-2026-98668)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information from kernel heap memory.

The vulnerability exists due to missing initialization of the bounce buffer in iio_push_to_buffers_with_ts_unaligned() when processing data whose length is not a multiple of 8 bytes with timestamps enabled. A local user can read affected IIO buffer output to obtain uninitialized kernel heap data.

33) Race condition (CVE-ID: CVE-2026-98669)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to invalidate kernel buffer state and potentially cause a denial of service.

The vulnerability exists due to a race condition in the Linux kernel Industrial I/O buffer subsystem when device unregistration disables and deactivates buffers without holding the mlock mutex while a buffer-mode claim is held. A local user can potentially trigger overlapping device unregistration and buffer-mode operations to invalidate buffer state still relied upon by the claim holder, potentially causing a denial of service.

34) Use-after-free (CVE-ID: CVE-2026-98670)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by triggering a kernel use-after-free.

The vulnerability exists due to a use-after-free in the Linux kernel Xilinx XADC driver when device unbinding overlaps with alarm interrupt handling. A local privileged user can potentially trigger this race so that the interrupt handler requeues zynq_unmask_work after delayed work has been cancelled, allowing the work to access the freed xadc structure and potentially crash the kernel.

35) Incomplete cleanup (CVE-ID: CVE-2026-98671)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through incomplete driver cleanup.

The vulnerability exists due to incomplete cleanup in the Linux kernel sun4i-gpadc-iio driver's probe function when thermal zone registration fails with an error other than -ENODEV. A local user can potentially trigger this failure path to leave the IIO map array registered and runtime power management enabled, which may disrupt system operation.

36) Division by zero (CVE-ID: CVE-2026-98672)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to an unchecked division by zero in the Linux kernel STM32 ADC driver's stm32_adc_read_raw() function when processing a failed conversion or a zero conversion result. A local user can request a processed channel reading that encounters such a conversion result to potentially trigger a kernel fault and cause a denial of service.

37) NULL pointer dereference (CVE-ID: CVE-2026-98673)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a null pointer dereference in pac1934_acpi_parse_channel_config() in the Linux kernel PAC1934 ADC driver when a terminating byte is written after ACPI label duplication fails. A local user can trigger the affected configuration-processing path under allocation-failure conditions to potentially cause a kernel crash.

38) Missing initialization of resource (CVE-ID: CVE-2026-98674)

CWE-ID: CWE-909 - Missing initialization of resource

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering kernel operations that use an uninitialized mutex.

The vulnerability exists due to missing initialization of the state mutex in the Linux kernel ADI AXI ADC driver when accessing ADC registers. A local user can trigger affected register access paths to potentially disrupt kernel operation and cause a denial of service.

39) Off-by-one (CVE-ID: CVE-2026-98675)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent Phase C dip events from being reported.

The vulnerability exists due to an off-by-one error in the Linux kernel ADE9000 ADC driver's IRQ1 handler when scanning STATUS1 event bits. A local user can take advantage of the scan excluding bit 25, ADE9000_ST1_DIPC_BIT, to leave Phase C dip events unreported.

40) NULL pointer dereference (CVE-ID: CVE-2026-98676)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to a null pointer dereference in ade9000_setup_clkout() when probing an ADE9000 configured as a clock provider with an external input clock. A local privileged user can trigger probing of the affected device, if permitted, to cause a kernel crash because the divider clock is registered with a null register address that clk_divider_recalc_rate() dereferences through readl().

41) Use-after-free (CVE-ID: CVE-2026-98677)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel's ad_sigma_delta ADC driver when device unbinding releases the sample buffer before the trigger handler is detached. A local privileged user can trigger device unbinding while data-ready interrupts remain active to cause ad_sd_trigger_handler() to copy incoming samples into freed memory, potentially crashing the system.

42) Improper input validation (CVE-ID: CVE-2026-98678)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger undefined arithmetic behavior that may disrupt ADC driver operation.

The vulnerability exists due to improper input validation in the ad4030_set_avg_frame_len() function of the Linux kernel AD4030 ADC driver when configuring the oversampling ratio. A local privileged user can supply a zero or negative value to cause ilog2() to process an invalid input before validation, producing an undefined result that may disrupt driver operation.

43) Improper update of reference count (CVE-ID: CVE-2026-98679)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to underflow the runtime power-management usage count and trigger a kernel warning.

The vulnerability exists due to improper runtime power-management reference counting in kxcjk1013_write_event_config() in the Linux kernel's kxcjk-1013 accelerometer driver when processing repeated writes that disable events. A local privileged user can submit duplicate disable requests through the event enable attribute to drop a runtime power-management reference that was not acquired for the request, causing a usage-count underflow and a "Runtime PM usage count underflow" warning.

44) Memory leak (CVE-ID: CVE-2026-98680)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory leaks and potentially disrupt accelerometer operation.

The vulnerability exists due to missing memory cleanup and incomplete state restoration in the Linux kernel kionix-kx022a accelerometer driver's kx022a_fifo_enable() function when register operations fail during buffer enablement. A local user can attempt to enable buffered sampling under these failure conditions to leak allocated sample memory and potentially leave interrupts, hardware buffers, or driver state flags incorrectly configured.

45) Race condition (CVE-ID: CVE-2026-98681)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially corrupt SMB client file state by causing concurrent flag updates to be lost.

The vulnerability exists due to a race condition in the Linux kernel SMB client's struct cifsFileInfo when concurrent code paths update flags stored in the same bitfield byte under different locks. A local user can potentially trigger overlapping SMB file operations to cause byte-level read-modify-write operations on one flag to overwrite concurrent changes to another flag, leaving file state inconsistent.

46) Race condition (CVE-ID: CVE-2026-98682)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt file data on an SMB share.

The vulnerability exists due to a race condition in the Linux kernel SMB client's cifs_file_copychunk_range() function and the clone path of cifs_remap_file_range() when performing server-side copy or clone operations with outstanding destination writes. A local user can initiate these operations while asynchronous destination writeback is pending to cause stale data to overwrite the newly copied or cloned data, corrupting the destination file.

47) Race condition (CVE-ID: CVE-2026-98683)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt file contents by causing stale data to reappear in a range that was zeroed.

The vulnerability exists due to improper synchronization of dirty data writeback in the Linux kernel SMB client's smb3_zero_range() function when zeroing an interior file range that does not reach the end of the file. A local user can trigger zero-range operations on a file with overlapping dirty cached data, allowing subsequent writeback to overwrite the zeroed range on the server with stale data.

48) Improper synchronization (CVE-ID: CVE-2026-98684)

CWE-ID: CWE-662 - Improper Synchronization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt file contents on an SMB share by causing recently written data to be overwritten with zeroes.

The vulnerability exists due to improper synchronization of written data and allocated-range queries in the Linux kernel SMB client's smb3_simple_fallocate_range() function when emulating mode 0 or FALLOC_FL_KEEP_SIZE allocation for small interior ranges on Windows servers. A local user can perform writes followed by affected allocation operations on an accessible file to cause an incoherent FSCTL_QUERY_ALLOCATED_RANGES response to identify live data as unallocated holes, resulting in that data being overwritten with zeroes.

49) Incomplete cleanup (CVE-ID: CVE-2026-98685)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt file content by making stale page-cache data visible after a file is extended.

The vulnerability exists due to incomplete page-cache invalidation in the Linux kernel SMB client's cifs_remap_file_range() function when a clone-range operation extends a file beyond its previous end. A local user can dirty data past the end of a file through a memory mapping and extend the file through a clone-range operation to expose that data as file content because the cached folio straddling the previous end is not discarded.

50) Incomplete cleanup (CVE-ID: CVE-2026-98686)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause cached data written past the end of a file to become visible as file content after the file is extended.

The vulnerability exists due to incomplete page-cache invalidation in the Linux kernel SMB client's smb3_zero_range() function when extending a file through a zero-range operation. A local user can write past the existing end of the file through a memory mapping and extend the file through a zero-range operation to expose retained cached data as file content.

51) Out-of-bounds read (CVE-ID: CVE-2026-98687)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to read beyond an allocated kernel heap buffer, potentially disclosing sensitive information.

The vulnerability exists due to an out-of-bounds read in the Linux kernel Thunderbolt driver's tb_xdp_properties_request() function when processing XDomain properties responses with oversized header-derived data lengths. A remote attacker on the local network can supply a malicious peer response with the six-bit length field set to 63 to trigger a 192-byte read from a 180-byte data array when data_len is at least 48, potentially exposing 12 bytes of adjacent kernel heap memory.

52) Race condition (CVE-ID: CVE-2026-98689)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through invalid kernel memory accesses.

The vulnerability exists due to a race condition in the Linux kernel Thunderbolt DisplayPort tunnel handling when DPRX capability reads are canceled during domain suspension or teardown. A local user can potentially trigger concurrent DPRX work and tunnel teardown to cause accesses to adapters or routers that are no longer available, which may crash the kernel.

53) Improper update of reference count (CVE-ID: CVE-2026-98690)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by making Thunderbolt driver unbinding wait indefinitely.

The vulnerability exists due to improper reference counting in the Linux kernel Thunderbolt DisplayPort tunnel handling when pending DPRX read work is canceled without releasing its domain reference. A local privileged user can trigger DisplayPort tunnel teardown before the DPRX read completes, such as by unplugging within the timeout, and subsequently unbind the driver to cause an indefinite wait for domain release.

54) Incomplete cleanup (CVE-ID: CVE-2026-98691)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a temporary denial of service by delaying Thunderbolt domain unbinding until the DPRX timeout expires.

The vulnerability exists due to incomplete cleanup of inactive DisplayPort tunnels in tb_stop() in drivers/thunderbolt/tb.c when stopping a Thunderbolt domain with pending dprx_work. A local user can potentially trigger domain teardown while this work is pending to leave a callback running against an already torn-down domain, retaining a domain reference and blocking unbinding until the timeout expires.

55) Improper update of reference count (CVE-ID: CVE-2026-98692)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to consume kernel resources and potentially cause a denial of service.

The vulnerability exists due to improper reference counting in the Linux kernel Thunderbolt DisplayPort tunnel handling when reactivating discovered tunnels without an activation callback during hibernation restore. A local user can trigger the affected tunnel activation path to leave tunnel references unreleased, potentially exhausting kernel resources and causing a denial of service.

56) Use-after-free (CVE-ID: CVE-2026-98693)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to trigger access to freed kernel memory, potentially causing a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel Thunderbolt driver when removing a router while DisplayPort tunnel work remains pending. An attacker with physical access to system can disconnect a cable while a tunnel is waiting for a DPRX capabilities read to finish, causing subsequent HopID releases in tb_path_free() to access freed ID allocators and potentially disrupt kernel operation.

57) Use-after-free (CVE-ID: CVE-2026-98694)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to a use-after-free in the Linux kernel Thunderbolt control channel request handling when request completion races with cancellation. A local user can potentially trigger this race during control channel operations to cause a request worker to be scheduled again after its request has been dequeued and freed, potentially resulting in a kernel crash.

58) Race condition (CVE-ID: CVE-2026-98695)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel NULL-pointer dereference.

The vulnerability exists due to a race condition in the Linux kernel USB serial tty callbacks when ioctl operations overlap with device hangup. A local user can issue tty ioctl operations concurrently with a USB serial device disconnect, including during lengthy break signalling, to trigger access to unavailable driver data or hardware and cause a denial of service.

59) Use-after-free (CVE-ID: CVE-2026-98696)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by crashing the kernel.

The vulnerability exists due to use-after-free in USB serial completion handlers when driver deregistration unbinds ports before ongoing I/O has stopped. A local privileged user can potentially trigger overlapping I/O and driver module unloading to cause completion handlers to access freed port data, which may crash the kernel.

60) Race condition (CVE-ID: CVE-2026-98697)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leak kernel memory, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to a race condition in the Linux kernel USB serial subsystem when driver deregistration overlaps with writes to the new_id attribute. A local privileged user can write to the attribute during deregistration to add a dynamic ID that escapes cleanup, leaking its allocated memory.

61) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98698)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel failure.

The vulnerability exists due to improper handling of zero-length allocations in mac80211 AES-SIV encryption when processing an association or reassociation request ending with a FILS Session element. A local user can trigger encryption of such a request to cause an invalid page to be placed in a scatterlist, triggering a kernel BUG when CONFIG_DEBUG_SG is enabled and potentially causing a denial of service otherwise.

62) Use-after-free (CVE-ID: CVE-2026-98699)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through access to freed kernel memory.

The vulnerability exists due to a use-after-free in the Linux kernel mac80211 mesh fast transmit cache when mesh path deletion races with cache entry insertion. A local user can potentially trigger concurrent mesh path deletion and cache insertion to leave a cache entry referencing a freed mesh_path object, which may cause a kernel crash when accessed.

63) Improper initialization (CVE-ID: CVE-2026-98700)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disrupt wireless communication through incorrect transmit-rate selection.

The vulnerability exists due to improper initialization of transmit band metadata in the mac80211 ieee80211_8023_xmit() function when processing 802.3 encapsulation offload frames on non-MLD interfaces. A local user can trigger transmission of affected frames to cause transmit-rate selection using an incorrect frequency band, potentially disrupting wireless communication.

64) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98701)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by exhausting the mesh path quota and preventing new paths to reachable destinations from being created.

The vulnerability exists due to failure to release reserved mesh path slots in the Linux kernel mac80211 mesh_path_add() function when path allocation fails or insertion encounters an error or an existing destination. A local user can trigger repeated failed or duplicate mesh path additions to exhaust MESH_MAX_MPATHS even though the path table contains fewer installed paths, preventing new mesh paths from being created.

65) Use of Uninitialized Variable (CVE-ID: CVE-2026-98702)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to use of an uninitialized variable in the Linux kernel mac80211 HT/VHT channel definition validator when processing a channel switch announcement frame indicating 320 MHz bandwidth on a non-6 GHz link. A remote attacker on the local network can send a specially crafted frame to trigger a warning and subsequent use of the uninitialized vht_operation.chan_width value by ieee80211_chandef_vht_oper(), causing a kernel panic under the configuration described below.

The kernel panic requires panic_on_warn to be enabled.

66) Out-of-bounds write (CVE-ID: CVE-2026-98703)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the Linux kernel mac80211 minstrel_ht rate-control component when processing an invalid fixed rate index supplied through the fixed_rate_idx debugfs file. A local privileged user can write a value such as 65535 to select group 4095 and rate index 15, causing minstrel_ht_set_rate() to access and update rate statistics outside the valid arrays and corrupt adjacent kernel memory.

67) Use-after-free (CVE-ID: CVE-2026-98704)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to potentially cause a denial of service by triggering access to freed kernel memory during wireless association.

The vulnerability exists due to use-after-free in the Linux kernel mac80211 ieee80211_assoc_config_link() function when associating with a non-transmitted MBSSID profile using an association response that omits WMM, HT, or VHT information. Pointers copied from the fallback parse reference merged-profile storage that is freed before channel, bandwidth, and HT capability configuration finishes. A remote attacker on the local network can supply a specially crafted association response to trigger reads through these dangling pointers and potentially crash the kernel.

68) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-98705)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to bypass mesh path limits, potentially exhausting kernel memory and causing a denial of service.

The vulnerability exists due to improper resource quota accounting in the Linux kernel mac80211 mesh path management code when creating and removing proxy paths. Proxy-path additions do not increment the shared path counter, but removals decrement it, allowing the counter to become negative. A remote attacker on the local network can induce repeated proxy-path creation and removal to allow subsequent mesh path additions to exceed MESH_MAX_MPATHS and potentially exhaust kernel memory.

69) Race condition (CVE-ID: CVE-2026-98706)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to a race condition in the mac80211 station teardown and power-save delivery code when removing an AP or mesh station while power-save delivery work is running. A local user can exploit overlapping teardown and delivery operations to cause driver notifications and queue updates after the corresponding station state has been removed or cleaned up, potentially causing a denial of service.

70) Use-after-free (CVE-ID: CVE-2026-98707)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service by potentially crashing the Linux kernel.

The vulnerability exists due to use-after-free in mac80211 RX BA session timer handling when an RX BAR handler races with session teardown. A remote attacker on the local network can send RX BAR frames during teardown to cause a stale handler to rearm the session timer, potentially causing subsequent timer processing to access freed memory and crash the kernel.

71) Use-after-free (CVE-ID: CVE-2026-98708)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel mac80211 channel-context management code when releasing or reassigning the last assigned link during an in-place channel-context replacement. A local user can trigger these operations while a replacement pairing remains active to leave a stale replace_ctx pointer that subsequent unreserve or switch-finalization operations may dereference, potentially crashing the kernel.

72) Use-after-free (CVE-ID: CVE-2026-98709)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel mac80211 function ieee80211_vif_use_reserved_switch() when reservations belonging to different channel-context replacement operations are incorrectly counted toward completion of the current replacement. A local user can potentially trigger channel-context replacement with mismatched reservations to cause premature freeing of a channel context still used by a link and its driver, potentially causing a kernel crash during subsequent beacon generation.

73) Memory leak (CVE-ID: CVE-2026-98710)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a kernel memory leak that may lead to resource exhaustion and a denial of service.

The vulnerability exists due to missing release of allocated EEPROM memory in il3945_pci_remove() when removing a PCI device after a successful probe. A local privileged user can trigger removal of an affected device to leave its EEPROM allocation unreleased, potentially exhausting kernel memory if the operation is repeated.

74) Out-of-bounds read (CVE-ID: CVE-2026-98711)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to disclose kernel heap data to a malicious wireless device.

The vulnerability exists due to an out-of-bounds read in the Linux kernel cw1200 wireless driver's transmit path when sending frames with bus alignment padding from buffers without sufficient tailroom. An attacker with physical access to system can use a malicious device to collect bytes read past the end of the frame buffer, exposing up to 511 bytes of kernel heap data per transmitted frame over SDIO.

75) Use-after-free (CVE-ID: CVE-2026-98712)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through invalid kernel memory access.

The vulnerability exists due to a use-after-free in the Linux kernel arm64 KVM virtual interrupt controller when an interrupt referenced by last_lr_irq is reclaimed during concurrent local peripheral interrupt (LPI) unmapping. A local user can trigger interrupt handling that races with LPI unmapping to potentially cause access to a freed interrupt object and a denial of service.

76) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-98713)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a spurious kernel warning through incorrectly handled guest instructions in arm64 KVM.

The vulnerability exists due to incorrect conditional gating of fine-grained undefined-instruction trap configuration in arm64 KVM when initializing nested virtualization traps on hardware without FEAT_FGT. A local privileged user can execute a TLBI OS instruction at guest vEL1 without FEAT_TLBIOS to reach handle_tlbi_el1(), which expects an EL1 TLBI only from vEL2, and trigger a kernel warning instead of the intended undefined-instruction exception.

77) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98714)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect virtual machine control-state handling, potentially disrupting subsequent guest execution.

The vulnerability exists due to improper handling of exceptional conditions in the Linux kernel KVM SVM svm_vcpu_run() function when a VMRUN instruction fails. A local user can exercise virtual machine execution paths that encounter this failure to cause control fields to be cleared or marked clean even though the processor may not have performed the requested operations.

78) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98715)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 7.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially bypass memory isolation and access or modify memory through stale address translations.

The vulnerability exists due to improper invalidation of cached address translations in the Linux kernel KVM SVM component when a VMRUN instruction fails. A local user can exploit a dropped pending TLB flush to potentially access or modify memory through stale translations, including translations retained when an address space identifier (ASID) is reused.

79) Protection mechanism failure (CVE-ID: CVE-2026-98716)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to interfere with correct handling of model-specific register state in nested virtual machines, potentially weakening isolation between execution contexts.

The vulnerability exists due to incorrect selection of the MSR permission bitmap in KVM's SVM msr_write_intercepted() function when checking MSR write interception while a nested guest is active. A local user can trigger nested guest MSR accesses to cause interception checks to consult vmcb02's bitmap even when it is not the active virtual machine control block's bitmap, potentially resulting in incorrect MSR state handling.

80) NULL pointer dereference (CVE-ID: CVE-2026-98717)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel NULL pointer dereference.

The vulnerability exists due to a null pointer dereference in the Linux kernel KVM x86 shadow page-table walker when memory-slot creation races with a stage-2 page fault from a nested guest (L2). A local user can trigger this race to cause a shadow page-table walk through a dummy root backed by the zero page, resulting in a kernel crash.

81) Race condition (CVE-ID: CVE-2026-98718)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt data in host memory reallocated to another owner.

The vulnerability exists due to a race condition in the Linux kernel KVM SEV sev_migrate_from() function when intra-host migration overlaps with memory reclamation. A local user can exploit the interval between clearing the source VM's SEV active state and flushing its caches to cause stale guest ciphertext to overwrite data in a freed and reallocated page.

82) Double free (CVE-ID: CVE-2026-98719)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to a double free in the Linux kernel KVM SEV component when cleaning up after a failed SEV guest initialization and subsequently destroying the virtual machine. A local user can trigger this failure and destruction sequence to cause the have_run_cpus mask to be freed twice, potentially crashing the host kernel.

83) Incorrect authorization (CVE-ID: CVE-2026-98720)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read and modify the host hypervisor's task priority register from a nested virtual machine.

The vulnerability exists due to incorrect access control caused by a stale MSR bitmap in the Linux kernel's KVM nested VMX implementation when runtime enlightened VMCS controls are modified. A local privileged user can configure an L1 hypervisor not to intercept TPR writes and run the same L2 guest first with TPR virtualization enabled and then disabled to read and write L0's task priority register.

84) Use of uninitialized resource (CVE-ID: CVE-2026-98721)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to use of uninitialized synchronization resources in the Linux kernel Cadence NAND interrupt handler when a pending interrupt is handled after IRQ registration but before initialization of the IRQ lock and completion object. A local user can potentially exploit this initialization window to disrupt kernel operation and cause a denial of service.

85) Division by zero (CVE-ID: CVE-2026-98722)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service in the Linux kernel.

The vulnerability exists due to division by zero in the block2mtd driver's add_device() function when processing a zero erase size supplied through the block2mtd module parameter. A local privileged user can set the erase size to zero to trigger a kernel divide error during the device-size modulo calculation and cause a denial of service.

86) Improper initialization (CVE-ID: CVE-2026-98723)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass persistent reservation abort enforcement and leave outstanding I/O active after reservation preemption.

The vulnerability exists due to incorrect initialization ordering in the Linux kernel NVMe target controller allocation path when creating per-controller reservation references before copying the host identifier into the controller. A remote user can submit I/O that remains active when another host successfully issues Preempt and Abort because the reservation references contain a nil UUID that prevents matching and aborting the preempted host's outstanding operations.

The issue occurs when a namespace with reservations enabled exists before the host connects, including on reconnection.

87) Out-of-bounds read (CVE-ID: CVE-2026-98724)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds kernel memory read that may cause a denial of service.

The vulnerability exists due to an out-of-bounds read in nvmet_pci_epf_get_sgl_segment() when processing a host-controlled SGL segment with a nonzero length smaller than one descriptor. A local user can supply such a segment to make the descriptor count zero and trigger a read of the type byte of sgls[-1] before the allocated buffer, potentially causing a kernel panic.

88) Out-of-bounds write (CVE-ID: CVE-2026-98725)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to an out-of-bounds write in the Linux kernel's nvmet_auth_challenge() function when handling an AUTH_RECEIVE request with a short output buffer. A remote attacker can submit a request with an insufficient response buffer length to bypass a size check that undercounts the fixed challenge header by 15 bytes, causing the challenge to be written beyond the allocated buffer and potentially crashing the kernel.

89) Integer underflow (CVE-ID: CVE-2026-98726)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger out-of-bounds kernel memory reads, potentially causing a denial of service or disclosing sensitive information.

The vulnerability exists due to integer underflow in the Linux kernel NVMe multipath ANA log parser when processing inconsistent controller-supplied ANA data. A local privileged user can supply malformed ANA data with object sizes exceeding the allocated log buffer to bypass bounds checks and trigger reads beyond ana_log_buf while parsing group descriptors or namespace ID arrays.

90) Incorrect Bitwise Shift of Integer (CVE-ID: CVE-2026-98727)

CWE-ID: CWE-1335 - Incorrect Bitwise Shift of Integer

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger undefined kernel behavior that may result in a denial of service.

The vulnerability exists due to an invalid bitwise shift in the Linux kernel NVMe multipath component when reporting zones or processing writes through a namespace head that advertises zoned capability with a zero zone size. A local user can trigger these operations on an affected namespace head to cause a shift by ilog2(0), potentially resulting in a denial of service.

91) Out-of-bounds read (CVE-ID: CVE-2026-98728)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose stale buffer contents through random bytes returned to a caller.

The vulnerability exists due to an out-of-bounds read in the Linux kernel's tpm2_get_random() function when processing a truncated TPM response carrying the TPM2_ST_SESSIONS tag. A local user can supply such a response to bypass a length check that fails to account for the skipped 4-byte parameter size field, causing memcpy() to read up to 4 bytes past the response end and copy stale buffer contents into the caller's random bytes.

92) Reachable assertion (CVE-ID: CVE-2026-98729)

CWE-ID: CWE-617 - Reachable Assertion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel assertion failure.

The vulnerability exists due to incorrect virtual address alignment in the Linux kernel's x86 huge page mapping code when applying va_align.bits to hugetlbfs mappings. A local user can trigger the creation and teardown of a misaligned huge page mapping to cause a denial of service through the BUG_ON assertion in __unmap_hugepage_range().

The issue can be triggered on Carrizo and FX-8370E processors with both huge page size states.

93) Buffer overflow (CVE-ID: CVE-2026-98730)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to a buffer overflow in the Linux kernel Bluetooth btintel_pcie driver when processing oversized transmit packets. A local privileged user can inject an oversized packet through HCI_CHANNEL_USER to cause btintel_pcie_prepare_tx() to copy packet data beyond a fixed 4096-byte DMA buffer after a 4-byte PCIe type header is prepended, corrupting kernel memory and potentially causing a denial of service.

94) Integer overflow (CVE-ID: CVE-2026-98731)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass packet-length validation and cause incorrect truncation of Bluetooth packets.

The vulnerability exists due to an integer overflow in btintel_pcie_recv_frame() in the Linux kernel when calculating packet lengths for Bluetooth ACL or ISO frames. A local user can supply a crafted frame with a dlen value of at least 0xFFFC to overflow the 16-bit plen calculation, bypass the skb->len < plen check, and cause skb_trim() to truncate the packet incorrectly.

95) Out-of-bounds read (CVE-ID: CVE-2026-98732)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disclose kernel memory through diagnostic output.

The vulnerability exists due to an out-of-bounds read in btintel_hw_error() in drivers/bluetooth/btintel.c when logging a Bluetooth exception payload that is not NUL-terminated. A local user can trigger logging of such a payload to potentially expose memory beyond its boundary through the unbounded "Exception info %s" format operation.

96) Use-after-free (CVE-ID: CVE-2026-98733)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to a use-after-free in the Linux kernel Bluetooth hci_queue_iso() function when fragmented ISO packets are queued concurrently with transmit worker dequeues without holding the queue lock. A local user can send fragmented ISO packets to trigger a race in which queue insertion writes through a previously freed packet pointer, corrupting kernel memory and potentially causing a denial of service.

97) Use-after-free (CVE-ID: CVE-2026-98734)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause kernel memory corruption that may result in a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth SCO and ISO schedulers when connection teardown overlaps transmission scheduling. A local user can trigger concurrent connection teardown and transmission scheduling to potentially cause a denial of service by accessing a connection freed after hci_low_sent() releases its RCU read lock.

98) Use-after-free (CVE-ID: CVE-2026-98735)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a potential kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth ACL and LE transmit schedulers when channel deletion races with channel selection and transmission. A local user can trigger overlapping channel transmission and teardown to cause a denial of service if the transmit path accesses channel memory after it has been freed.

99) Use-after-free (CVE-ID: CVE-2026-98736)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth hci_enhanced_setup_sync() function when enhanced SCO setup accesses an ACL parent connection concurrently with its teardown. A local user can trigger overlapping connection setup and disconnection processing to potentially cause a kernel crash by accessing the freed parent connection during capability checks or parameter selection.

100) Use-after-free (CVE-ID: CVE-2026-98737)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering access to freed Bluetooth inquiry-cache entries.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth inquiry-cache handling in hci_acl_create_conn_sync() and hci_stop_discovery_sync() when preparing connection or discovery-cancellation commands concurrently with cache updates or flushes. A local user can trigger an HCIINQUIRY ioctl concurrently with these operations to free a cache entry after lookup but before the worker reads its fields, potentially causing a kernel crash.

101) Use-after-free (CVE-ID: CVE-2026-98738)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth build_pairing_cmd() function when accessing remote out-of-band (OOB) data during pairing. A local privileged user can trigger concurrent pairing and remote OOB data removal operations to cause the function to access a freed list entry, potentially crashing the kernel.

102) Use-after-free (CVE-ID: CVE-2026-98739)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel use-after-free.

The vulnerability exists due to a use-after-free in the Linux kernel Bluetooth RFCOMM TTY component when device installation and release concurrently manage the initial port reference for RFCOMM_RELEASE_ONHUP devices. A local user can trigger overlapping installation and release operations to cause both paths to drop the same initial reference, resulting in access to a freed port and potentially a kernel crash.

103) Use-after-free (CVE-ID: CVE-2026-98740)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service.

The vulnerability exists due to use-after-free in the Altera EDAC ECC setup callbacks and their helpers when device probing executes after initialization memory has been freed. A local privileged user can potentially trigger a deferred probe or a manual device unbind/rebind to invoke functions incorrectly marked __init, potentially crashing the kernel by executing freed memory.

104) Heap-based buffer overflow (CVE-ID: CVE-2026-98741)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to corrupt kernel heap memory and cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in the Linux kernel ALSA ua101 USB audio driver when calculating playback write sizes from capture packets without validating the relative endpoint packet sizes and channel counts. An attacker with physical access to system can connect a USB device advertising crafted capture and playback descriptors and induce a user to open its playback PCM node to trigger writes beyond the allocated playback buffer, corrupting kernel memory and causing a denial of service.

105) Use-after-free (CVE-ID: CVE-2026-98742)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel use-after-free.

The vulnerability exists due to missing synchronization leading to a use-after-free in the ALSA sequencer compatibility port-info ioctl handler when processing concurrent port-creation requests. A local user can issue concurrent compat CREATE_PORT requests to bypass the port-count check, cause port indices to wrap to an existing address, and trigger access to a freed subscriber during subsequent teardown to potentially cause a kernel crash.

106) Use of Uninitialized Variable (CVE-ID: CVE-2026-98743)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disrupt audio processing through an incorrectly configured SoundWire stream.

The vulnerability exists due to use of an uninitialized variable in the Linux kernel's rt1017_sdca_pcm_hw_params() function when configuring an audio stream. A local user can trigger stream configuration with an uninitialized stream_config.type value that is passed to sdw_stream_add_slave() and subsequently copied to stream->type by sdw_config_stream(), potentially disrupting audio processing.

107) Use of Uninitialized Variable (CVE-ID: CVE-2026-98744)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect audio stream configuration, potentially disrupting audio operation.

The vulnerability exists due to use of an uninitialized variable in max98363_sdw_dai_hw_params() in the Linux kernel MAX98363 codec driver when configuring SoundWire audio streams. A local user can trigger stream configuration with an indeterminate stream_config.type value, which is passed to sdw_stream_add_slave() and later copied to stream->type by sdw_config_stream(), potentially disrupting audio operation.

108) Improper input validation (CVE-ID: CVE-2026-98745)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to improper input validation in restore_sve_fpsimd_context() in the Linux kernel arm64 signal-handling code when restoring a user-supplied SVE signal context. A local user can supply a crafted context with SVE_SIG_FLAG_SM clear and an SVE payload present to establish unsupported non-streaming SVE state, causing subsequent state restoration to trigger a fatal kernel undefined-instruction exception.

Exploitation requires an arm64 system that supports SME but does not support SVE.

109) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98746)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause clock reference leaks that may degrade system availability.

The vulnerability exists due to missing release of clock references in the Linux kernel ma35d1 serial driver when device probing fails or a serial port is removed. A local privileged user can trigger the affected driver lifecycle paths to leave clock references acquired by of_clk_get() unreleased, potentially degrading system availability through repeated resource leakage.

110) NULL pointer dereference (CVE-ID: CVE-2026-98747)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a kernel crash.

The vulnerability exists due to a null pointer dereference in serial_core_unregister_port() when unregistering a serial port whose port device is absent. A local privileged user can trigger the affected unregistration path after port teardown or an early registration failure to cause a kernel crash and denial of service.

111) Use-after-free (CVE-ID: CVE-2026-98748)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel's 8250_bcm7271 serial driver when port removal races with a receive-timeout interrupt while hardware flow control is enabled. A local privileged user can potentially exploit this race to re-arm a timer after its cancellation, causing brcmuart_hrtimer_func() to dereference freed private data and potentially crash the kernel.

112) Use-after-free (CVE-ID: CVE-2026-98749)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel MAX3100 serial driver when an SPI device is unbound during system suspend before resume. A local privileged user can trigger this device-removal sequence, if permitted, to leave the polling timer armed after the port is freed, allowing max3100_timeout() to access freed memory and potentially crash the system.

113) Use-after-free (CVE-ID: CVE-2026-98750)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially corrupt kernel memory or cause a denial of service.

The vulnerability exists due to a use-after-free in the Linux kernel TTY subsystem when closing a TTY and saving its termios settings races with device re-registration that resets saved termios state. A local user can attempt to trigger these concurrent operations for a reused minor number to access freed memory, potentially corrupting kernel memory or causing a denial of service.

114) Race condition (CVE-ID: CVE-2026-98751)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger driver calls for an unavailable tty device, potentially causing a denial of service.

The vulnerability exists due to a race condition in the Linux kernel tty subsystem's send_break() function when processing timed break ioctls concurrently with a hangup. A local user can issue TCSBRK or TCSBRKP ioctls with a user-controlled timeout to trigger a delayed break_ctl() callback after the device has disappeared or powered down, potentially disrupting system operation if the driver does not safely handle the race.

115) Use-after-free (CVE-ID: CVE-2026-98752)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a use-after-free or NULL-pointer dereference in the Linux kernel.

The vulnerability exists due to a use-after-free caused by missing synchronization in tty_port_tty_vhangup() and tty_port_hangup() when concurrent hangups overlap with port deregistration and resource teardown. A local user can trigger racing ioctl or hangup operations during teardown to access resources after they have been freed or encounter a NULL-pointer dereference, potentially causing a kernel crash.

116) Race condition (CVE-ID: CVE-2026-98753)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to improper error-state handling in tty_port_open() in drivers/tty/tty_port.c when port activation fails and a TTY ioctl races with hangup and open operations. A local user can trigger this race to cause I/O attempts on a powered-down or deregistered port, leading to a kernel panic through unclocked accesses or NULL-pointer dereferences.

117) Use-after-free (CVE-ID: CVE-2026-98754)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a use-after-free in the Linux kernel vcc driver when terminal cleanup races with LDC callback processing. A local user can potentially trigger concurrent vcc_cleanup() and vcc_event() execution, causing a callback to dereference freed memory through tty->port and crash the kernel.

118) Use of Uninitialized Variable (CVE-ID: CVE-2026-98755)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to obtain potentially sensitive kernel stack data.

The vulnerability exists due to use of an uninitialized stack variable in vcc_send_ctl() in drivers/tty/vcc.c when sending control packets through ldc_write(). A local user can receive control packets as the LDC peer to obtain kernel stack data potentially exposed through the uninitialized tag.stype_env field of the struct vio_vcc packet.

119) NULL pointer dereference (CVE-ID: CVE-2026-98756)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by crashing the Linux kernel.

The vulnerability exists due to a NULL pointer dereference in the Cadence USBSS driver's cdns3_pci_probe() function when probing the controller's second PCI function after the first function has been enabled but before its driver data has been stored. A local privileged user can potentially trigger this probe timing condition to cause pci_get_drvdata() to return NULL, leading to a kernel crash when the driver assigns wrap->devfn.

120) Use-after-free (CVE-ID: CVE-2026-98757)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a kernel crash and denial of service.

The vulnerability exists due to a use-after-free in cdns3_gadget_exit() in the Linux kernel USB cdns3 gadget driver when tearing down a gadget device with deferred work still queued. A local user can exploit deferred work accessing freed device memory after teardown to potentially cause a kernel crash and denial of service.

121) Use-after-free (CVE-ID: CVE-2026-98758)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption that may result in a denial of service through a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel UCSI GLINK driver when queued work executes after the UCSI instance has been unregistered during device removal. Notification callbacks can continue queuing work before device-managed cleanup releases the pmic_glink client, allowing that work to dereference the freed connector array or register and unregister the instance again. A local user can potentially exploit this removal-time race to access freed kernel state and cause a kernel crash.

122) Use of Uninitialized Variable (CVE-ID: CVE-2026-98759)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to expose kernel stack data and potentially cause a denial of service.

The vulnerability exists due to use of an uninitialized stack variable in cd321x_update_work() in the USB Type-C tipd driver when registering a USB Type-C partner. An attacker with physical access to system can connect a USB device to an affected port to trigger device linking that may invoke uninitialized callback pointers, potentially crashing the kernel; uninitialized descriptor fields also expose kernel stack data through partner sysfs.

123) Use of Uninitialized Variable (CVE-ID: CVE-2026-98760)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to potentially cause a denial of service and disclose kernel stack data.

The vulnerability exists due to use of an uninitialized stack variable in tps6598x_connect() in the Linux kernel USB Type-C tipd driver when registering a port partner. An attacker with physical access to system can connect a USB device to an affected port to trigger the use of uninitialized descriptor fields, potentially causing a kernel crash through invalid callback invocation and exposing stack data through partner sysfs attributes.

124) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98761)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to leave a disconnected USB Type-C port supplying VBUS power.

The vulnerability exists due to improper handling of a failed fast role swap operation in the Linux kernel TCPM event handler when processing a fast role swap signal during cable disconnection. An attacker with physical access to system can cause a cable to signal a fast role swap to a capable port during disconnection to leave VBUS power sourcing enabled after the operation fails to start.

125) Use-after-free (CVE-ID: CVE-2026-98762)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a use-after-free in the Linux kernel DWC2 USB host controller driver when host-owned state is freed before the wakeup timer callback has been synchronized and prevented from rearming. A local user can potentially exploit the race between dwc2_wakeup_detected() and host resource cleanup to access freed memory and cause a denial of service.

126) Use-after-free (CVE-ID: CVE-2026-98763)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel use-after-free.

The vulnerability exists due to incomplete clearing of endpoint pointers in usb_disable_endpoint() when disabling a non-zero USB control endpoint with reset_hardware set. A local user can trigger this endpoint lifecycle to leave the opposite direction's endpoint array entry pointing to disabled or freed memory, potentially causing a kernel crash if the stale pointer is subsequently used.

127) NULL pointer dereference (CVE-ID: CVE-2026-98764)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to a null pointer dereference in the FunctionFS ffs_epfile_ioctl() function when processing a FUNCTIONFS_ENDPOINT_DESC ioctl for a gadget operating at a speed for which no endpoint descriptor was supplied. A local user can configure FunctionFS with only full-speed descriptors and issue the ioctl while the gadget operates at a higher speed to trigger a kernel panic and cause a denial of service.

128) Race condition (CVE-ID: CVE-2026-98765)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through a race between USB gadget request completion and driver teardown.

The vulnerability exists due to incomplete synchronization of request completion callbacks in the Linux kernel dummy-hcd driver when waiting for outstanding callbacks during gadget driver teardown. A local privileged user can trigger overlapping request completion and teardown operations, potentially allowing a gadget driver's module to be unloaded while a completion handler is still running and causing a kernel crash.

129) Use-after-free (CVE-ID: CVE-2026-98766)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering access to freed kernel memory.

The vulnerability exists due to a use-after-free in the Linux kernel's aspeed-vhub USB gadget driver when queued wakeup work executes after device removal has freed the virtual hub and its ports. A local user can exploit overlapping gadget wakeup activity and device removal to potentially crash the system, as an in-flight wakeup request can also re-arm the work during removal.

130) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98767)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering an interrupt storm and kernel panic.

The vulnerability exists due to improper handling of an invalid event count in the Linux kernel DWC3 USB gadget driver's dwc3_check_event_buf() function when the GEVNTCOUNT register value exceeds the event buffer length. A local privileged user can write an oversized count directly to GEVNTCOUNT to leave the level-triggered interrupt source asserted, causing repeated unhandled interrupts that trigger a kernel panic.

131) Race condition (CVE-ID: CVE-2026-98768)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to a race condition in the Linux kernel ANX7411 USB Type-C driver when interrupt handling overlaps with device removal and workqueue destruction. A local user can potentially trigger interrupt-driven work submission during teardown to cause a kernel crash through access to a workqueue being destroyed.

132) Out-of-bounds write (CVE-ID: CVE-2026-98769)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to read or corrupt kernel heap memory, potentially disclosing sensitive information or causing a denial of service.

The vulnerability exists due to out-of-bounds reads and writes in the Linux kernel USB gadget f_uac1_legacy generic_set_cmd() and generic_get_cmd() functions when handling class-specific USB audio control requests. An attacker with physical access to system can use a malicious USB host to send crafted SET_CUR or GET_CUR requests whose bRequest low nibble selects an index from 5 through 15 into the five-element con->data array, accessing up to 44 bytes beyond the array to read or corrupt adjacent heap memory.

133) Out-of-bounds write (CVE-ID: CVE-2026-98770)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the USB MIDI gadget driver's jack descriptor arrays in struct f_midi2_usb_config when configuring a large number of jacks via configfs. A local privileged user can configure enough input and output jacks to exceed the array capacities and corrupt adjacent kernel memory, potentially causing a denial of service.

134) Use of uninitialized resource (CVE-ID: CVE-2026-98771)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to disclose stale kernel heap memory to unprivileged userspace.

The vulnerability exists due to use of uninitialized memory in the Linux kernel sierra_ms USB storage driver when accepting short responses to GetSwocInfo requests. An attacker with physical access to system can connect a malicious USB device with vendor ID 0x1199 and product ID 0x0fff that returns a short response to expose up to 5 bytes of stale kernel heap memory per read of the world-readable truinst sysfs attribute on kernels built without init_on_alloc.

135) Use-after-free (CVE-ID: CVE-2026-98772)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a use-after-free in the Linux kernel USB serial subsystem when shared USB request completion handlers race with port teardown. A local user can potentially trigger this race during device disconnection, causing a completion handler to access freed port driver data and crash the kernel.

136) Use-after-free (CVE-ID: CVE-2026-98773)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by potentially crashing the kernel.

The vulnerability exists due to a use-after-free in the Linux kernel USB CDC ACM driver when port shutdown overlaps with device disconnection. A local user can trigger concurrent port shutdown and device disconnection to cause resubmitted USB request blocks to access freed DMA buffers in acm_ctrl_irq() or acm_read_bulk_callback(), potentially crashing the kernel.

The described USB request resubmission occurs when the ALWAYS_POLL_CTRL quirk is set.

137) Incomplete cleanup (CVE-ID: CVE-2026-98774)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave deferred work items uncleared, potentially causing resource exhaustion and a denial of service.

The vulnerability exists due to incomplete cleanup in the Linux kernel rust_binder Thread::release() method when a thread exits with deferred work items on its todo list. A local user can cause a thread to exit while it has an active outgoing transaction to leave deferred work items uncanceled, potentially retaining resources and causing a denial of service.

138) Use-after-free (CVE-ID: CVE-2026-98775)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel Nitro Enclaves driver when ne_create_vm_ioctl() handles a SLOT_ALLOC failure after anon_inode_getfile() succeeds. A local user can trigger this error path to cause deferred file cleanup to invoke ne_enclave_release() after ne_enclave has been freed, leading to an invalid read of slot_uid that may crash the kernel.

139) Use-after-free (CVE-ID: CVE-2026-98776)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through kernel memory corruption.

The vulnerability exists due to use-after-free in the Linux kernel binderfs device creation path when a device entry is removed concurrently with its creation. A local user can race device creation with unlinkat() to cause binder_add_device() to write to a freed device object, potentially corrupting kernel memory and causing a denial of service.

140) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98777)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through exhaustion of system-wide file resources.

The vulnerability exists due to missing resource release in the Linux kernel Binder transaction cleanup when a TF_UPDATE_TXN transaction supersedes a pending asynchronous transaction in a frozen process. A local user can repeatedly trigger transaction replacement to leak binder_txn_fd_fixup entries and their file references, eventually exhausting the system-wide file limit.

The leaked resources survive process exit.

141) Improper resource shutdown or release (CVE-ID: CVE-2026-98778)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to close unrelated file descriptors in a target process, potentially causing a denial of service.

The vulnerability exists due to improper resource release in the Linux kernel Binder driver when cleaning up a pending asynchronous transaction superseded by a TF_UPDATE_TXN transaction. A local user can trigger transaction replacement to cause the BINDER_TYPE_FDA cleanup handler to interpret stale buffer contents as installed file descriptor numbers and close unrelated file descriptors in the target process.

142) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98779)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a device resource leak that may lead to a denial of service.

The vulnerability exists due to missing release of registered child platform devices in the AMDGPU driver's acp_hw_init() function when power-domain attachment fails or ACP reset or clock enable operations time out after successful MFD device registration. A local user can potentially trigger an affected initialization failure to leave child devices registered and consume system resources, which may impair system availability.

143) Memory leak (CVE-ID: CVE-2026-98780)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to consume kernel memory and potentially cause a denial of service.

The vulnerability exists due to a memory leak in amdgpu_discovery_sysfs_ips() when kobject_add() fails during IP instance registration. A local user can potentially trigger this failure path to leave ip_hw_instance allocations unreleased because the initial kobject reference is not dropped and normal sysfs teardown cannot find the failed object. Repeated failures may exhaust kernel memory and cause a denial of service.

144) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98781)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a device-reference leak that may lead to resource exhaustion.

The vulnerability exists due to a missing release of a device reference in the Linux kernel MediaTek DRM driver's mtk_drm_bind() function when binding a device that is not the mmsys master. A local privileged user can trigger the affected binding path to leave a reference acquired through of_find_device_by_node() unreleased, potentially exhausting resources through repeated triggering.

145) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98782)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leak kernel resources, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to missing release of a registered OVL adaptor platform device in the MediaTek DRM driver when initialization fails after device registration or the driver is unbound. A local privileged user can trigger these driver lifecycle operations, where permitted, to leave platform devices registered and potentially exhaust system resources.

The affected device is created only when the display pipeline requires the OVL adaptor.

146) Unchecked Return Value (CVE-ID: CVE-2026-98783)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to an unchecked error return in the MediaTek DRM driver's mtk_drm_probe() function when registering the ovl_adaptor platform device. A local user can potentially trigger a kernel crash if able to induce a platform_device_register_data() failure, because the returned error pointer is used without validation and an invalid pointer is passed to subsequent component operations.

147) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98784)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially exhaust system resources and cause a denial of service.

The vulnerability exists due to missing release of firmware resources in the Linux kernel AMDGPU GFX6 component when tearing down the GFX block. A local privileged user can potentially trigger resource exhaustion through repeated teardown operations because the PFP, ME, CE and RLC firmware resources requested by gfx_v6_0_init_microcode() remain allocated.

148) NULL pointer dereference (CVE-ID: CVE-2026-98785)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel crash during GPU reset recovery.

The vulnerability exists due to a NULL pointer dereference in the Linux kernel AMD display driver when resuming after a failed display-state allocation during suspend. A local user can potentially trigger GPU reset recovery under allocation-failure conditions to cause dm_resume() to dereference a NULL cached_dc_state and crash the kernel.

149) NULL pointer dereference (CVE-ID: CVE-2026-98786)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel NULL pointer dereference.

The vulnerability exists due to unchecked NULL pointer dereferences in the AMD display driver's dm_dp_mst_is_port_support_mode() and get_conv_frl_bw() functions when mode validation races with DisplayPort multi-stream transport (MST) unplug handling. A local user can trigger overlapping mode validation and MST unplug processing to potentially crash the kernel when either function accesses an asynchronously cleared dc_sink pointer.

150) Use-after-free (CVE-ID: CVE-2026-98788)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering access to freed memory in the Linux kernel.

The vulnerability exists due to use-after-free in the private futex hash implementation when resizing the hash and tracking RCU grace periods. A local user can trigger concurrent futex operations during hash resizing to potentially crash the kernel, because futex_ref_drop() can proceed while a reader still holds a pointer to the old hash.

151) Memory leak (CVE-ID: CVE-2026-98789)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust kernel memory and potentially cause a denial of service.

The vulnerability exists due to a memory leak in the BPF memory allocator when objects are queued for freeing during an ongoing RCU tasks trace grace period. A local user can trigger BPF memory allocation and freeing operations under these conditions to leave an unbounded number of objects unreclaimed, potentially exhausting kernel memory and causing a denial of service.

Objects can remain stranded indefinitely if no further bulk allocation or freeing occurs for the same BPF memory cache.

152) Race condition (CVE-ID: CVE-2026-98790)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning through a race condition in performance-event handling.

The vulnerability exists due to improper synchronization between perf_event_exit_task() and perf_pending_task() in the Linux kernel performance-event subsystem when executing a new program through begin_new_exec(). A local user can trigger concurrent execution and performance-event processing to cause perf_sigtrap() to continue after the event context's task has been set to TASK_TOMBSTONE, triggering WARN_ON_ONCE(event->ctx->task != current).

153) NULL pointer dereference (CVE-ID: CVE-2026-98791)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to a NULL pointer dereference in mlx5e_xsk_fill_timestamp() when completing outstanding transmit descriptors without a completion queue entry during AF_XDP TX queue teardown. A local user can trigger teardown with an outstanding descriptor that requested a transmit timestamp to cause a denial of service.

154) Race condition (CVE-ID: CVE-2026-98792)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to a race condition in the Linux kernel netfilter flowtable subsystem when flow garbage collection overlaps with pending hardware offload work. A local user can trigger overlapping flow statistics retrieval and flow removal operations to potentially disrupt kernel operation and cause a denial of service.

155) Improper input validation (CVE-ID: CVE-2026-98793)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to improper input validation in the Linux kernel netfilter function bpf_ct_set_nat_info() when handling NAT manipulation types. A local privileged user can supply an invalid NAT manipulation type through this function to trigger a kernel warning and potentially cause a kernel crash. If execution continues after the warning, inconsistent connection tracking state causes cleanup to attempt to unlink an uninitialized list node.

156) Improper input validation (CVE-ID: CVE-2026-98794)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to disrupt IPVS connection handling, potentially causing a denial of service.

The vulnerability exists due to improper validation of connection flags in the Linux kernel IPVS backup server when processing synchronization messages. A remote attacker on the local network can send crafted messages containing the NO_CPORT+TEMPLATE flag combination to make normal connection lookups match templates, or use the ONE_PACKET flag in protocol version 0 messages to create connections that are not hashed and are immediately dropped, potentially disrupting service.

157) NULL pointer dereference (CVE-ID: CVE-2026-98795)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to a null pointer dereference in sparx5_ptp_deinit() when unbinding the driver after PTP initialization was skipped because the SPX5_FEATURE_PTP flag or a described "ptp" interrupt was absent. A local privileged user can unbind the driver to trigger cleanup of uninitialized PTP resources and cause a denial of service.

158) NULL pointer dereference (CVE-ID: CVE-2026-98796)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering network interface startup failure or a kernel NULL pointer dereference.

The vulnerability exists due to an initialization race in the Linux kernel MediaTek Ethernet driver when a network interface is opened after registration but before the internal dummy network device and shared NAPI structures are initialized. A local privileged user can trigger an interface open during this window to cause a denial of service by accessing the missing dummy device or an uninitialized NAPI device pointer.

159) Out-of-bounds read (CVE-ID: CVE-2026-98797)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering an out-of-bounds kernel memory access that may crash the system.

The vulnerability exists due to an out-of-bounds read in the Linux kernel's transmit queue handling and taprio_enqueue() when nested packet transmissions leak the skip_txqueue flag into an outer transmission, causing a stale queue mapping to index beyond taprio's child array. A local user can configure skbedit and mirred actions with CAP_NET_ADMIN in a network namespace and redirect traffic between devices with different queue counts to trigger an invalid queue pointer dereference and potentially cause a denial of service.

160) NULL pointer dereference (CVE-ID: CVE-2026-98798)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by leaving networking unresponsive until a reboot.

The vulnerability exists due to a null pointer dereference in the Linux kernel bcmgenet driver's receive coalescing handling when setting receive coalescing parameters on an interface that has never been opened. A local privileged user can run a command such as "ethtool -C eth0 rx-usecs 50" to dereference an uninitialized receive ring private pointer and trigger a kernel fault while the RTNL lock is held, leaving networking stuck.

161) Use-after-free (CVE-ID: CVE-2026-98799)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel fault.

The vulnerability exists due to use-after-free in the Linux kernel BPF trampoline subsystem when a detached program is freed while an active trampoline image still references it. A local privileged user can trigger program detachment while a task sleeps in an earlier sleepable BPF program, causing the task to access the freed program when execution resumes and cause a denial of service.

162) Use-after-free (CVE-ID: CVE-2026-98800)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through invalid kernel memory access.

The vulnerability exists due to use-after-free in the Linux kernel BPF trampoline program lifecycle when a detached program is freed while a task on a preemptible kernel is paused in the trampoline before acquiring the program's RCU read lock. A local privileged user can trigger concurrent program detachment and trampoline execution to cause a denial of service when the paused task resumes and accesses the freed program.

163) Integer overflow (CVE-ID: CVE-2026-98801)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt socket memory reservation accounting and potentially cause a denial of service.

The vulnerability exists due to integer overflow in the Linux kernel's sk_setsockopt() handling of SO_RESERVE_MEM when processing reservation values near INT_MAX. A local user can supply an excessively large reservation value to overflow signed 32-bit arithmetic in sk_mem_pages(delta) and (pages << PAGE_SHIFT), corrupting sk_forward_alloc and sk_reserved_mem and potentially disrupting memory management and system availability.

164) Race condition (CVE-ID: CVE-2026-98801)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt socket memory accounting and potentially cause a denial of service.

The vulnerability exists due to improper synchronization in the Linux kernel's UDP socket memory reservation handling when processing SO_RESERVE_MEM operations concurrently with packet reception or release. A local user can invoke setsockopt(SO_RESERVE_MEM) on a UDP socket during these operations to corrupt sk_forward_alloc and memory control group accounting, potentially disrupting memory management and system availability.

165) Modification of assumed-immutable data (CVE-ID: CVE-2026-98802)

CWE-ID: CWE-471 - Modification of Assumed-Immutable Data

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the integrity of packet data delivered to packet sockets.

The vulnerability exists due to modification of shared packet data without ensuring writability in the advance_nextseg() and seg6_next_csid_advance_arg() functions when processing IPv6 segment routing packets. A remote attacker can send packets that undergo segment routing processing while their data is shared with a clone queued to an AF_PACKET socket to cause socket readers to receive modified packet contents instead of the originally received contents.

166) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-98803)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause oversized network frames to be forwarded in truncated form.

The vulnerability exists due to improper handling of multi-buffer frames in the stmmac native XDP receive path when jumbo frames are enabled and an accepted frame extends into the secondary receive buffer. A remote attacker on the local network can send an oversized frame to make the XDP program process only the primary buffer, causing truncated forwarding if the program returns a TX or REDIRECT verdict.

167) Integer underflow (CVE-ID: CVE-2026-98803)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to corrupt receive-buffer length calculations, potentially causing a denial of service.

The vulnerability exists due to an unsigned integer underflow in stmmac frame check sequence removal when a received frame overflows a buffer by one to three bytes. A remote attacker on the local network can send a frame whose frame check sequence straddles receive-buffer boundaries to make subtraction of the frame check sequence length wrap to an excessively large unsigned value, potentially disrupting packet processing.

168) Use of uninitialized resource (CVE-ID: CVE-2026-98803)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service in network receive processing.

The vulnerability exists due to use of an uninitialized secondary DMA buffer in the stmmac receive path when processing frames larger than dma_buf_sz without split-header mode. A remote attacker on the local network can send a frame that overflows the primary receive buffer to trigger a DMA write to an unmapped secondary-buffer address and an SMMU translation fault on IOMMU-based platforms.

AF_XDP zero-copy receive queues also expose this fault condition because their secondary buffer is programmed with DMA address 0.

169) Use-after-free (CVE-ID: CVE-2026-98804)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption that may result in a denial of service.

The vulnerability exists due to a use-after-free in page_pool_recycle_ring_bulk() when updating recycle statistics after releasing the producer lock. A local user can potentially trigger concurrent bulk recycling and page pool destruction to cause a statistics update to access freed pool memory, potentially crashing the kernel.

The vulnerability requires CONFIG_PAGE_POOL_STATS=y and recycling the last inflight netmems of a pool being destroyed.

170) Reusing a Nonce, Key Pair in Encryption (CVE-ID: CVE-2026-98805)

CWE-ID: CWE-323 - Reusing a Nonce, Key Pair in Encryption

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise the confidentiality of encrypted TIPC traffic and forge authenticated packets.

The vulnerability exists due to reuse of AES-GCM nonces in the Linux kernel TIPC encryption implementation when a peer reports a receive-key change and the per-peer counter resets while the sender retains the same transmit key and salt. A remote attacker can analyze captured packets with reused nonces to compromise traffic confidentiality, recover the GCM authentication key, and generate valid authentication tags for modified ciphertexts.

171) NULL pointer dereference (CVE-ID: CVE-2026-98806)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a kernel crash and denial of service.

The vulnerability exists due to a null pointer dereference in the Linux kernel octeontx2 network driver when assigning backpressure identifiers for SDP virtual functions with CONFIG_DCB enabled. A local user can trigger an affected initialization path that dereferences the uninitialized queue_to_pfc_map pointer to potentially cause a kernel crash and denial of service.

172) Out-of-bounds read (CVE-ID: CVE-2026-98807)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to an out-of-bounds read in the mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event() functions when processing team device events. A local privileged user can trigger team device events that cause bonding-specific APIs to interpret smaller team_port structures as bond slave structures, potentially causing a kernel crash.

173) Out-of-bounds write (CVE-ID: CVE-2026-98808)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to an out-of-bounds write in bcm_sysport_get_stats() when collecting network interface statistics through ethtool. A local user can trigger statistics collection to potentially corrupt kernel memory because the function uses the full statistics index rather than the compacted destination index when writing to the allocated buffer.

The issue occurs on SYSTEMPORT Lite, where unsupported statistics are skipped during collection.

174) Resource exhaustion (CVE-ID: CVE-2026-98809)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by blocking Bluetooth controller unregistration for an extended period.

The vulnerability exists due to uncontrolled resource consumption in the Linux kernel Bluetooth HCI synchronous command worker when draining an unbounded command backlog during controller unregistration after command processing has been disabled. A local privileged user can queue MGMT commands against an unresponsive controller and close /dev/vhci to cause controller unregistration to wait for a separate timeout for each queued command.

Each queued HCI command incurs a two-second timeout; a locally reproduced backlog of more than 5,000 entries resulted in hours of blocking.

175) Out-of-bounds read (CVE-ID: CVE-2026-98810)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by triggering an out-of-bounds kernel memory read.

The vulnerability exists due to an out-of-bounds read in the Linux kernel mac80211 monitor packet handling functions when processing non-linear packets. Length checks use the total packet length, including non-linear fragments, rather than the length of the linear head buffer containing the accessed headers. A local privileged user can send specially crafted packets through AF_PACKET to trigger reads beyond the allocated head buffer, potentially causing a kernel crash.

176) Race condition (CVE-ID: CVE-2026-98811)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to retain kernel resources unnecessarily, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to a race condition in the Linux kernel traffic-control classifier error handling in net/sched/cls_api.c when concurrent filter-add requests on the same chain and priority both fail. A local user can trigger these concurrent failures to leave an empty classifier proto linked to the chain, retaining chain, block, and classifier module references and potentially exhausting resources.

Exploitation requires CAP_NET_ADMIN, but namespace-local capability obtained through unshare -Urn is sufficient.

177) NULL pointer dereference (CVE-ID: CVE-2026-98812)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to premature publication of an incompletely initialized object in the Linux kernel MCTP subsystem's mctp_add_dev() function when concurrent readers access a device during initialization. A local user can trigger MCTP message processing during this window to dereference the still-NULL mdev->dev pointer and cause a kernel crash.

178) Use-after-free (CVE-ID: CVE-2026-98813)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a kernel use-after-free.

The vulnerability exists due to use-after-free in the BPF memory allocator destructor context for non-preallocated hash maps and resizable hash maps when deferred teardown accesses map BTF data after it has been freed. A local privileged user can trigger teardown of a BPF map with pending RCU callbacks and release the associated BTF-owning program to cause deferred destructor processing to dereference freed memory, potentially crashing the kernel.

179) Use-after-free (CVE-ID: CVE-2026-98814)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel NVMe command effects log handling when processing an I/O passthrough command through a multipath namespace head after the controller path that first created the head has been removed. A local user can submit an I/O passthrough command through the remaining namespace head to trigger a read from freed log memory, potentially causing a kernel crash.

180) Integer overflow (CVE-ID: CVE-2026-98816)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by crashing the kernel.

The vulnerability exists due to a signed integer overflow in bpf_jit_blind_insn() when adjusting backward jump offsets during BPF constant blinding. A local user can run a specially crafted BPF program with a backward jump offset of -32767 or -32768 to make the adjusted offset wrap around, directing execution beyond the end of the program and crashing the kernel.

Exploitation requires bpf_jit_harden=2.

181) Improper update of reference count (CVE-ID: CVE-2026-98817)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disrupt runtime power management and prevent an affected audio device from entering runtime suspend.

The vulnerability exists due to improper runtime power-management reference counting in class_function_probe() in the Linux kernel ASoC SDCA subsystem when device initialization fails. A local user can trigger a probe failure, if able to influence device initialization, to leave a runtime power-management reference unreleased and potentially prevent the device from suspending.

182) Deadlock (CVE-ID: CVE-2026-98818)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel deadlock.

The vulnerability exists due to improper lock ordering in the Linux kernel SLUB allocator when kfree_rcu() allocates memory with __GFP_KSWAPD_RECLAIM while holding the scheduler's pi_lock. A local user can trigger an affected allocation path that attempts to wake kswapd, which also requires pi_lock, to potentially cause a deadlock and render the system unresponsive.

183) Integer overflow (CVE-ID: CVE-2026-98819)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger out-of-bounds reads and potentially cause a denial of service.

The vulnerability exists due to integer wraparound and insufficient record-length validation in the Linux kernel Bluetooth btintel DDC configuration parser when processing firmware records. A local privileged user can supply malformed DDC configuration data, if able to influence the firmware input, to cause record lengths to wrap or exceed the remaining firmware bytes, potentially triggering out-of-bounds reads and a denial of service.

184) Improper initialization (CVE-ID: CVE-2026-98820)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by stalling a block I/O queue.

The vulnerability exists due to incorrect initialization of the RQF_USE_SCHED flag in the Linux kernel blk-mq subsystem when cached requests allocated for passthrough commands are reused for read/write operations. A local user can trigger this request reuse to bypass the prepare_request() and finish_request() scheduler callbacks, leaking domain tokens and stalling the queue when the kyber scheduler is used.

185) Type Confusion (CVE-ID: CVE-2026-98821)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel fault.

The vulnerability exists due to type confusion in the Linux kernel block direct I/O polling path when processing polled I/O with user integrity metadata. A local user can submit io_uring IOPOLL requests with a protection information attribute on an integrity device, causing bio_poll() to interpret a uio_meta object as a bio object and trigger a kernel fault.

186) Improper access control (CVE-ID: CVE-2026-98822)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass VLAN isolation and potentially disclose network traffic to a station on a different VLAN within the same basic service set (BSS).

The vulnerability exists due to improper access control in the Linux kernel mac80211 function ieee80211_lookup_ra_sta() when resolving destination stations for AP and AP VLAN unicast frames. A local user can submit a unicast frame on one interface addressed to a station on another VLAN in the same BSS to cause unauthorized cross-VLAN delivery, because the station lookup searches across the BSS rather than restricting matches to the transmitting interface.

187) Double free (CVE-ID: CVE-2026-98823)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to a double free in the Linux kernel cfg80211 scan-entry handling when merging a hidden-group probe-response entry into an associated entry after a channel switch. A remote attacker on the local network can trigger the affected processing to give two entries ownership of the same beacon information-element allocation, causing it to be freed twice when the entries are released and potentially resulting in a kernel crash.

188) Improper Validation of Array Index (CVE-ID: CVE-2026-98824)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt mac80211 state and potentially cause a denial of service.

The vulnerability exists due to improper validation of array indices in the Linux kernel mac80211 minstrel_ht rate-control component when processing driver-reported HT/VHT TX status rate metadata. A local user can supply malformed metadata, if able to influence driver-reported values, to cause out-of-bounds rate-table accesses through unchecked MCS, spatial stream count, or bandwidth values and corrupt mac80211 state.

189) Unchecked Return Value (CVE-ID: CVE-2026-98825)

CWE-ID: CWE-252 - Unchecked Return Value

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by triggering a kernel crash.

The vulnerability exists due to an unchecked error return in the Linux kernel's mpfs_rtc_probe() function when acquiring the RTC reference clock. A local privileged user can potentially trigger driver probing under conditions where devm_clk_get() returns an error pointer, causing clk_get_rate() to dereference that pointer and crash the kernel.

190) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98826)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially prevent successful initialization of the AC100 RTC device.

The vulnerability exists due to missing release of the RTC-32k clock in the Linux kernel AC100 RTC driver when probing fails after clock registration, including when the ADDA 4M parent clock cannot be found. A local user can potentially trigger an affected failure path to leave the clock registered, causing a later probe of the same device to fail because its clock name is already present in the global clock list.

191) Use-after-free (CVE-ID: CVE-2026-98826)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel AC100 RTC clock provider when RTC device registration fails after the clock provider has been registered. A local user can potentially trigger a subsequent clock lookup that accesses freed chip->clk_data through of_clk_hw_onecell_get() to cause a kernel fault and denial of service.

The triggering RTC device registration failure occurs only when devm_rtc_register_device() returns -ENOMEM.

192) Out-of-bounds write (CVE-ID: CVE-2026-98827)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to an out-of-bounds write in the ath9k_htc driver's __hif_usb_tx() function when aggregating outgoing frames without checking their cumulative byte length against the transmit buffer capacity. A local user can trigger aggregation of large outgoing frames to exceed the 32768-byte buffer and corrupt kernel memory, potentially causing a denial of service.

193) Out-of-bounds read (CVE-ID: CVE-2026-98828)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger an out-of-bounds read that may disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in ath9k_wmi_rsp_callback() when processing a WMI command response shorter than the expected response length. A local user can supply a truncated response, if able to control device responses, to cause the kernel to copy bytes beyond the socket buffer payload into the waiting command's response buffer.

194) Integer overflow (CVE-ID: CVE-2026-98829)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service by crashing the Linux kernel.

The vulnerability exists due to integer overflow in the Linux kernel mac80211 ieee80211_rx_h_defragment() function when accumulating payload lengths from oversized IEEE 802.11 fragments. A remote attacker on the local network can transmit a crafted fragment sequence whose accumulated payload length exceeds 65535 bytes to wrap the 16-bit entry->extra_len counter, resulting in insufficient buffer tailroom and a kernel panic when the queued payloads are appended.

195) Out-of-bounds write (CVE-ID: CVE-2026-98830)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause memory corruption and potentially a denial of service in the Linux kernel.

The vulnerability exists due to an out-of-bounds write and an out-of-bounds read in wfx_hif_read_mib() in the wfx wireless driver when processing firmware responses to MIB read requests. A local privileged user can supply a firmware response with a length field exceeding the caller-provided val_len to overwrite the caller's buffer and read beyond the reply allocation, potentially causing a kernel crash.

196) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98831)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak kernel resources, potentially causing a denial of service through resource exhaustion.

The vulnerability exists due to missing release of fragment references in the Linux kernel device tree overlay component when overlay changeset initialization fails after some fragments have been initialized. A local user can potentially trigger repeated initialization failures to accumulate unreleased target and overlay references and exhaust kernel resources.

197) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-98833)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering invalid memory access in the kernel.

The vulnerability exists due to an incorrect callback argument in __get_mtd_device() in the Linux kernel MTD core when acquiring a gluebi partition device. A local user can trigger device acquisition for a gluebi partition to potentially crash the kernel because gluebi_get_device() uses container_of() on a partition MTD object instead of the required master MTD object.

198) Double free (CVE-ID: CVE-2026-98834)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a double free in the Linux kernel MTD core function mtd_otp_nvmem_add() when factory OTP setup fails after the user OTP NVMEM device has been registered. A local user can potentially trigger the affected error-handling or teardown path to cause a kernel crash because the device is unregistered without clearing mtd->otp_user_nvmem, allowing it to be unregistered again.

199) Off-by-one (CVE-ID: CVE-2026-98835)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause an out-of-bounds read that may disclose kernel memory or cause a denial of service.

The vulnerability exists due to an off-by-one array bounds check in the Linux kernel Kionix KX022A accelerometer driver's kx022a_read_raw() function when converting a register value into a sampling-frequency table index. A local user can trigger an out-of-bounds read if the masked register value equals the number of table entries, potentially disclosing kernel memory or causing a denial of service.

200) Out-of-bounds write (CVE-ID: CVE-2026-98836)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an attacker with physical access to system to corrupt kernel memory, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds write in the Linux kernel ALSA Line6 driver's submit_audio_out_urb() function when preparing playback packets whose calculated sizes exceed the allocated output buffer capacity. An attacker with physical access to system can connect a specially crafted USB device declaring a large input endpoint packet size and a small output endpoint packet size to cause playback data copies or idle-stream memory initialization to write beyond the allocated buffer and corrupt kernel memory.

201) Use-after-free (CVE-ID: CVE-2026-98837)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel ALSA caiaq driver when device probing fails after an input device has been registered. A local user can read the input device's "uevent" attribute after this failure to trigger a dereference of freed device state, potentially causing a kernel crash.

202) Out-of-bounds read (CVE-ID: CVE-2026-98838)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger an out-of-bounds kernel memory read, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel virtual terminal and framebuffer console rendering path when processing a DEC alignment test on a background console with a changed font size. A local privileged user can configure different font sizes on visible and background consoles, enable framebuffer rotation, and write the ESC # 8 sequence to the background console to trigger rendering against a backing buffer that was not resized, potentially causing a kernel crash.

203) Out-of-bounds read (CVE-ID: CVE-2026-98839)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disclose sensitive kernel memory.

The vulnerability exists due to an unsigned integer underflow in paste_selection() in drivers/tty/vt/selection.c when a concurrent selection update replaces the selection buffer with a shorter buffer while a paste operation is sleeping. A local user can race a TIOCLINUX (TIOCL_SETSEL) ioctl against the paste operation to make vc_sel.buf_len smaller than the number of bytes already pasted, triggering an out-of-bounds read of up to 4094 bytes that may expose adjacent kernel memory through the terminal line discipline.

204) Use-after-free (CVE-ID: CVE-2026-98840)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel's vcs_write() function when a copy failure exits the write loop without refreshing a virtual console pointer following concurrent console deallocation. A local user can perform virtual console writes that encounter a copy failure while racing with console deallocation to trigger a stale-pointer dereference in vcs_notifier() and potentially crash the kernel.

205) NULL pointer dereference (CVE-ID: CVE-2026-98841)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a guest kernel panic.

The vulnerability exists due to a NULL pointer dereference in the Linux kernel VM Generation ID driver when a notification handler runs before driver_data is assigned during device probing. A local user can trigger a generation-change notification or a shared-line interrupt during this initialization window to cause a kernel panic, provided they can influence the relevant notification or interrupt source.

206) Memory leak (CVE-ID: CVE-2026-98842)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leak kernel memory, potentially causing a denial of service through memory exhaustion.

The vulnerability exists due to missing release of allocated memory in the Linux kernel module loader when codetag_load_module() fails while loading a livepatch module. A local privileged user can initiate livepatch module loads that encounter this error path to leave the module's mod->klp_info allocation unreleased, potentially exhausting kernel memory if the leak is repeatedly triggered.

207) Return of Wrong Status Code (CVE-ID: CVE-2026-98842)

CWE-ID: CWE-393 - Return of Wrong Status Code

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause failed kernel module loads to be reported as successful.

The vulnerability exists due to incorrect error propagation in the Linux kernel load_module() function when codetag_load_module() fails. A local privileged user can initiate a module load that encounters this failure to cause load_module() to return a success status even though the module has been torn down.

208) Use of uninitialized resource (CVE-ID: CVE-2026-98843)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause stale memory contents to be written to files, potentially disclosing sensitive information or corrupting file data.

The vulnerability exists due to use of uninitialized memory in the Linux kernel's netfs_read_gaps() function when a server read of gaps around a streaming write's dirty region returns a short response or reaches end of file. A local user can trigger file operations that encounter this condition to cause stale folio contents to be written back, potentially exposing residual data or corrupting file contents.

209) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-98844)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to expose stale memory-mapped data as file contents when extending a file.

The vulnerability exists due to incomplete clearing of stale pagecache data in the Linux kernel netfs buffered and unbuffered/direct write paths when extending a file beyond its previous end. A local user can leave data beyond the end of a file through a memory mapping and subsequently write at a later offset to expose that stale data in the newly created hole instead of zero-filled contents.

210) Return of Wrong Status Code (CVE-ID: CVE-2026-98845)

CWE-ID: CWE-393 - Return of Wrong Status Code

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass TPM reset-attack protections and cause authentication sessions to use an uninitialized key handle.

The vulnerability exists due to an incorrect success return in the Linux kernel's tpm2_load_null() function when a null key name mismatch is detected. A local user can induce this mismatch during a TPM reset attack to leave the chip serving commands despite the integrity failure and cause tpm2_start_auth_session() to use an uninitialized stack value as the salt key handle.

211) Use-after-free (CVE-ID: CVE-2026-98846)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel use-after-free.

The vulnerability exists due to a use-after-free in the Linux kernel SCTP function sctp_sendmsg_to_asoc() when a connection wait overlaps with a read-side socket shutdown and processing of an out-of-the-blue ABORT. A local user can trigger concurrent SCTP socket operations under these conditions to leave the send path using a freed association, potentially causing a kernel crash.

212) Race condition (CVE-ID: CVE-2026-98847)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a race condition in the Linux kernel SPEAr RTC driver when enabling the alarm interrupt before initializing the MMIO address and spinlock. A local user can potentially exploit an interrupt occurring during device initialization to cause the interrupt handler to access uninitialized state and crash the kernel.

213) Improper initialization (CVE-ID: CVE-2026-98848)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service on systems configured to trap bounds-sanitizer violations.

The vulnerability exists due to improper initialization of the array element count in ac100_rtc_register_clks() in the Linux kernel AC100 RTC driver when probing the device with CONFIG_UBSAN_BOUNDS, CONFIG_UBSAN_TRAP, and a compiler supporting __counted_by. A local privileged user can trigger the affected probe path, if permitted, to cause a bounds-sanitizer trap because clock pointers are stored in .hws[] before its associated .num count is initialized.

214) NULL pointer dereference (CVE-ID: CVE-2026-98849)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a kernel NULL pointer dereference.

The vulnerability exists due to a NULL pointer dereference in the Linux kernel PFCP driver's socket cleanup when network device registration fails after device initialization succeeds. A local privileged user can trigger PFCP network device creation under these failure conditions to cause the error path to release an already released and cleared socket, resulting in a denial of service.

215) Integer overflow (CVE-ID: CVE-2026-98850)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel BUG.

The vulnerability exists due to integer overflow in the Linux kernel's tpacket_snd() function when accumulating transmitted packet lengths during a blocking TX_RING send call. A local user can use CAP_NET_RAW to submit packets while concurrently recycling completed frames, causing the signed byte count to wrap to -EIOCBQUEUED and trigger a BUG in sock_sendmsg_nosec().

On systems configured to panic on oops, exploitation can panic the host kernel.

216) Improper update of reference count (CVE-ID: CVE-2026-98851)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by preventing the removal of netfilter flowtables.

The vulnerability exists due to improper reference count management in nft_flow_offload_init() when nf_ct_netns_get() fails during flow offload rule initialization. A local privileged user can attempt rule additions that encounter this failure to leak flowtable references and prevent the affected flowtables from being removed.

217) Improper input validation (CVE-ID: CVE-2026-98852)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt network communication by triggering the dropping of tunneled IPv6 packets.

The vulnerability exists due to improper validation of IPv6 extension headers in the Linux kernel's segmentation and checksum offload handling in net/core/dev.c when processing tunneled packets. A local user can generate affected tunneled traffic that reaches an incompatible software checksum fallback path, triggering kernel warnings and packet drops that disrupt network communication.

218) Uncontrolled Recursion (CVE-ID: CVE-2026-98853)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by exhausting the kernel stack.

The vulnerability exists due to uncontrolled recursion in the Linux kernel's inet_gso_segment() and ipv6_gso_segment() handlers when processing deeply nested IP-in-IP packets during generic segmentation offload. A local user can supply packets with deeply nested IP headers for segmentation to exhaust the kernel stack, potentially causing a system crash.

219) NULL pointer dereference (CVE-ID: CVE-2026-98854)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to improper handling of a negative changeset identifier in free_overlay_changeset() when cleaning up after an ID allocation failure during device tree overlay application. A local privileged user can trigger this error path, if able to initiate overlay application under these failure conditions, to cause a kernel crash and denial of service.

220) Double free (CVE-ID: CVE-2026-98855)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to a double free in add_changeset_property() in the Linux kernel device tree overlay subsystem when adding a property to a not-yet-live target node fails. A local privileged user can trigger this failure during overlay processing to potentially cause a kernel crash: the error path frees the property while leaving its pointer in the node's deadprops list, and of_node_release() frees it again when the aborted overlay's node is released.

221) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-98856)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disrupt kernel execution and potentially cause a denial of service.

The vulnerability exists due to premature termination of overlap checks in get_optimized_kprobe() in kernel/kprobes.c when arming overlapping probes on x86. A local privileged user can arrange overlapping probes with an intervening disabled probe so that a new probe's INT3 instruction overwrites part of an active optimized probe's jump displacement, redirecting kernel execution to an incorrect address and potentially causing a denial of service.

222) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-98857)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to exhaust kernel memory and potentially cause a denial of service.

The vulnerability exists due to unrestricted cache entry allocation in the Linux kernel IPVS LBLC and LBLCR schedulers when handling traffic to previously unseen destination addresses. A remote attacker can generate traffic to many distinct destination addresses and continue using the resulting cache entries to prevent their reclamation, allowing cache growth to exhaust kernel memory and potentially cause a denial of service.

223) Use-after-free (CVE-ID: CVE-2026-98858)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel io_uring task_work handling when an SQPOLL thread completes the last request holding a ring alive while io_req_normal_work_add() is still accessing its context. A local user can trigger concurrent request completion and ring teardown to cause a denial of service.

224) Use-after-free (CVE-ID: CVE-2026-98859)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by potentially crashing the kernel.

The vulnerability exists due to a use-after-free in the Linux kernel HID multitouch driver when a report rearms the sticky-finger release timer during driver removal. A local user can potentially trigger a report at this point to leave the timer queued after its associated device data is freed, causing mt_expired_timeout() to access freed memory and potentially crash the kernel.

225) Signed to Unsigned Conversion Error (CVE-ID: CVE-2026-98860)

CWE-ID: CWE-195 - Signed to Unsigned Conversion Error

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause BPF programs to operate on uninitialized or stale data.

The vulnerability exists due to an implicit signed-to-unsigned conversion in hid_bpf_hw_request() when comparing a negative transport-driver error code against an unsigned buffer size. A local privileged user can issue a HID hardware request that encounters a transport error to cause the negative error code to be treated as a large positive value, incorrectly report success, and copy unmodified buffer contents back to the BPF program.

226) Use-after-free (CVE-ID: CVE-2026-98861)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a potential kernel crash.

The vulnerability exists due to a use-after-free in the Linux kernel fprobe subsystem when handlers execute while RCU is not watching and their fprobe is freed after unregistration without waiting for those handlers to complete. A local privileged user can trigger overlapping handler execution and fprobe unregistration under these conditions to access freed kernel memory and potentially crash the kernel.

227) Use-after-free (CVE-ID: CVE-2026-98862)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel audit subsystem's kill_rules() function when pruning an audit tree containing mixed AUDIT_DIR and AUDIT_EXE rules. A local privileged user can install a rule using AUDIT_ADD_RULE with CAP_AUDIT_CONTROL and remove the watched directory while another task evaluates the rule, causing audit_mark_compare() to access an executable mark already freed by fsnotify and potentially trigger a kernel crash.

228) Expired pointer dereference (CVE-ID: CVE-2026-98863)

CWE-ID: CWE-825 - Expired pointer dereference

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access memory through stale mappings, potentially disclosing or corrupting memory.

The vulnerability exists due to reuse of stale page frame numbers in the Linux kernel's x86 KVM nested virtualization code when resuming a virtual CPU after nested-state page retrieval fails. A local user can re-run a virtual CPU whose vmcs02 retains page frame numbers from a previous L2 run to cause L2 to execute with stale, unpinned memory mappings, potentially disclosing or corrupting memory.

229) NULL pointer dereference (CVE-ID: CVE-2026-98931)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the Linux kernel SPI-NAND subsystem when probing a device with the "nand-no-ecc-engine" device tree property set. A local privileged user can trigger probing of such a device, if able to do so, to cause a kernel oops because the code checks the ECC engine's integration type without verifying that the engine pointer is non-null.

230) Use-after-free (CVE-ID: CVE-2026-98932)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to a use-after-free in the Linux kernel Altera EDAC driver's altr_edac_a10_device_add() and altr_portb_setup() functions when error-path cleanup frees the dci structure before unregistering managed interrupt handlers. A local user can potentially exploit an interrupt occurring during this cleanup window to cause a handler to dereference freed memory, potentially crashing the kernel.

231) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98933)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service on affected AMD platforms.

The vulnerability exists due to excessive retention of a runtime power-management reference in the Linux kernel USB3 root hub handling code when resuming a hub on affected AMD platforms. A local user can repeatedly trigger USB subsystem wakeups to cause system crashes because the reference remains held for 200 milliseconds after each resume.

232) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-98934)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a kernel warning and potentially disrupt system availability.

The vulnerability exists due to failure to supply a required network namespace pointer in seg6_make_flowlabel() when computing flow hashes for packets without an associated device or socket. A local privileged user can trigger transmission of a TIPC UDP bearer discovery message through the affected path to provoke a warning in __skb_flow_dissect(), potentially disrupting system availability.

The reported trigger requires an IPv4 route using segment routing encapsulation and net.ipv6.seg6_flowlabel set to 1.

233) Use of Uninitialized Variable (CVE-ID: CVE-2026-98935)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose uninitialized kernel stack data.

The vulnerability exists due to uninitialized padding in the struct rtc_wkalrm structure in rtc_dev_ioctl() when handling RTC_WKALRM_RD ioctl requests. A local user can issue this ioctl to obtain a structure containing residual kernel stack data in padding bytes after the pending member.

234) Improper initialization (CVE-ID: CVE-2026-98936)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by preventing new wireless stations or mesh peers from connecting.

The vulnerability exists due to improper reinitialization of the station counter in the Linux kernel ath11k driver's ath11k_mac_op_start() function when restarting wireless hardware. A local user can potentially exploit stale station accounting after repeated hardware restarts to cause new station or mesh peer connections to be rejected because the driver incorrectly considers its station limit reached.

235) Incorrect authorization (CVE-ID: CVE-2026-98937)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to collect kernel callchains without the required kernel profiling privilege, potentially disclosing kernel execution information.

The vulnerability exists due to incorrect authorization in perf_event_open() in kernel/events/core.c when processing requests for kernel callchain collection. A local user can request PERF_SAMPLE_CALLCHAIN with attr.exclude_kernel == 1 and attr.exclude_callchain_kernel == 0 to bypass the perf_allow_kernel() permission check and capture kernel callchains.

236) Deadlock (CVE-ID: CVE-2026-98939)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel deadlock.

The vulnerability exists due to a circular locking dependency in pud_free_pmd_page() in the x86 memory-management subsystem when a GFP_KERNEL allocation can enter memory reclaim while the init_mm mmap lock is held during huge PUD mapping setup. A local user can exercise the affected mapping and memory-reclaim paths to potentially cause a deadlock involving the mmap lock, memory reclaim, and the TTM page-pool lock, resulting in a denial of service.

237) Out-of-bounds write (CVE-ID: CVE-2026-98940)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to an out-of-bounds write in the Qualcomm LPASS CPU driver's asoc_qcom_lpass_cpu_platform_probe() function when configuring playback channel constraints for a DAI using LPAIF_I2SCTL_MODE_QUAD01 on platforms with sparse DAI IDs. A local privileged user can trigger the affected probe path to cause a hardware port ID to be used as a DAI driver table index, potentially corrupting kernel memory and causing a denial of service.

238) Use-after-free (CVE-ID: CVE-2026-98944)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to a use-after-free in the Linux kernel Steam HID driver's registration error handling when registration fails after a wireless device's battery has been registered. A local user can exercise the affected registration failure path to potentially cause a kernel crash if the lingering power_supply object accesses device state after the associated steam object has been freed.

239) Use-after-free (CVE-ID: CVE-2026-98945)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel Steam HID driver when callbacks are scheduled during device teardown and subsequently access a freed steam structure. A local user can potentially trigger this teardown race to cause a kernel crash by accessing freed memory.

240) Race condition (CVE-ID: CVE-2026-98946)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to a race condition in the Linux kernel vc4 V3D interrupt handling code when suspending the GPU at runtime. A local user can potentially trigger the race during a power transition to cause an interrupt handler to access powered-down hardware and reschedule previously cancelled overflow memory work, potentially disrupting system availability.

The described interrupt-dispatch race occurs on Raspberry Pi 0–3 systems using the ARMCTRL interrupt controller, which does not expose an active interrupt state.

241) Memory leak (CVE-ID: CVE-2026-98947)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust kernel memory and potentially cause a denial of service.

The vulnerability exists due to a memory leak in the Linux kernel VMCI vsock datagram transport when receiving datagrams during socket closure. A local user can trigger datagram reception concurrently with socket closure to cause packet buffers to be moved from the socket backlog into an already-cleared receive queue, leaving them allocated and potentially exhausting kernel memory.

242) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98948)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to exhaust port range register resources and potentially cause a denial of service.

The vulnerability exists due to missing release of port range register resources in mlxsw_sp_flower_tmplt_create() when parsing flow classification offload templates containing port ranges. A local privileged user can repeatedly trigger creation of these templates to accumulate unreleased register allocations and potentially prevent subsequent operations that require those resources.

243) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-98949)

CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger inconsistent GPU mapping associations and a kernel warning.

The vulnerability exists due to incorrectly specified function arguments in pvr_vm_gpuva_remap() in the Linux kernel imagination graphics driver when an overlapping mapping splits an existing mapping associated with a different buffer object. A local user can request such a mapping to cause the remaining mapping parts to be linked to the new object's vm_bo rather than the original object's vm_bo, triggering the object-mismatch warning in drm_gpuva_link().

244) Memory leak (CVE-ID: CVE-2026-98949)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to retain shared memory after mappings are closed, potentially causing a denial of service through memory exhaustion.

The vulnerability exists due to a memory leak in pvr_vm_gpuva_remap() in the Linux kernel imagination graphics driver when an overlapping GPU mapping splits an existing mapping. A local user can repeatedly request overlapping mappings to accumulate unreleased GEM object references and retain backing memory, potentially exhausting available memory.

245) Numeric Truncation Error (CVE-ID: CVE-2026-98950)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause incorrect packet header offset calculations.

The vulnerability exists due to integer truncation in the Linux kernel's bpf_flow_dissect() function when sanitizing packet header offsets with an hlen value greater than 65535. A remote attacker can supply specially crafted packet data to cause the upper bound used for offset clamping to be truncated to 16 bits, resulting in incorrect network and transport header offsets.

246) Use of Uninitialized Variable (CVE-ID: CVE-2026-98951)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt a target process's vector register state or shadow stack pointer with uninitialized kernel stack data.

The vulnerability exists due to use of uninitialized stack memory in the Linux kernel's riscv_vr_set() and riscv_cfi_set() functions when processing PTRACE_SETREGSET requests with a short iov_len. A local user can submit a request that supplies only part of a register-set buffer to cause the remaining uninitialized bytes to be used in the target process's vector state or shadow stack pointer.

247) Out-of-bounds read (CVE-ID: CVE-2026-98952)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause out-of-bounds reads that populate tunnel metadata with unintended memory contents.

The vulnerability exists due to an out-of-bounds read in pfcp_session_recv() in drivers/net/pfcp.c when processing PFCP packets with the S flag set without ensuring that the entire session endpoint identifier (SEID) is present in the linear packet data. A remote attacker can send a short PFCP packet or one whose session header lies in a fragment to cause an eight-byte SEID read beyond the available packet data, with the resulting value stored in tunnel metadata used by flower for classification.

248) Improper update of reference count (CVE-ID: CVE-2026-98953)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to exhaust kernel resources, potentially causing a denial of service.

The vulnerability exists due to improper reference counting in the Linux kernel devlink notification scheduling functions when notification work is already pending or is queued again while running. A local privileged user can repeatedly register and unregister nested devlink instances to leak devlink_rel objects and their indices, potentially exhausting kernel resources and causing a denial of service.

249) Out-of-bounds read (CVE-ID: CVE-2026-98954)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger out-of-bounds reads in kernel memory, potentially causing a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel's GSO packet processing when handling specially crafted packets without VIRTIO_NET_HDR_F_NEEDS_CSUM. A local user can supply malformed packets through an affected virtio network header processing path to bypass flow dissection in __virtio_net_hdr_to_skb(), leaving the transport header unset or outside linear packet data and triggering an out-of-bounds read in skb_gso_transport_seglen().

250) Numeric Truncation Error (CVE-ID: CVE-2026-98955)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect transport-header identification during network packet processing.

The vulnerability exists due to integer truncation in the Linux kernel's __skb_flow_dissect() function when computing transport-header offsets using lengths cast to 16-bit integers before comparison. A local user can supply an oversized packet whose length modulo 65536 is smaller than the computed header offset to cause callers to identify an incorrect location as the transport header, potentially pointing inside the Ethernet header.

251) Improper Following of Specification by Caller (CVE-ID: CVE-2026-98956)

CWE-ID: CWE-573 - Improper Following of Specification by Caller

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger kernel warnings during audio codec power transitions.

The vulnerability exists due to use of a non-sleeping GPIO API in the ASoC ADAU1372 driver's adau1372_set_power() function when controlling a powerdown GPIO whose provider can sleep. A local user can trigger affected codec power transitions to cause the GPIO API to emit kernel warnings.

252) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98957)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through kernel instability.

The vulnerability exists due to improper resource lifetime management in the mt7915e driver's receive NAPI teardown when removing a device, as NAPI remains enabled when it is destroyed. A local privileged user can unload and reload the module on a system using MT7916 hardware to trigger kernel warnings and system instability, potentially causing a denial of service.

253) Incorrect calculation (CVE-ID: CVE-2026-98958)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service by blocking transmissions for an affected wireless station.

The vulnerability exists due to incorrect per-link accounting of non-AQL frames in the Linux kernel mt76 wireless driver when processing transmission completions for a multi-link operation (MLO) peer. A remote attacker on the local network can trigger traffic that is queued on one link but completed on another to cause counter increments and decrements to affect different link counters, potentially inflating the pending-frame count until further transmissions for the station are blocked.

254) Use of uninitialized resource (CVE-ID: CVE-2026-98959)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt filesystem metadata and cause a denial of service affecting Btrfs filesystem operations.

The vulnerability exists due to use of an incompletely initialized btrfs_dir_item in the Linux kernel's btrfs_setxattr() function when replacing an extended attribute with a differently sized value while multiple attributes share the same item. A local user can create extended attributes with colliding name hashes and replace one attribute's value with a differently sized value to corrupt attribute metadata and trigger a filesystem transaction abort.

255) Memory leak (CVE-ID: CVE-2026-98960)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust kernel memory, potentially causing a denial of service.

The vulnerability exists due to a memory leak in the Btrfs io_uring encoded read and write handlers when requests return -EAGAIN and are cancelled or the ring exits before reissue. A local user can repeatedly trigger these request lifecycles to leave btrfs_uring_encoded_data allocations unreleased, potentially exhausting kernel memory and causing a denial of service.

256) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98961)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by leaving filesystem locks held, potentially blocking subsequent operations.

The vulnerability exists due to missing release of inode and extent locks in the Btrfs io_uring encoded-read failure handling when allocation of the pages array fails. A local user can trigger an encoded-read operation that encounters this allocation failure to leave the locks held and potentially block subsequent filesystem operations.

257) Memory leak (CVE-ID: CVE-2026-98962)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leak kernel memory, potentially causing a denial of service through memory exhaustion.

The vulnerability exists due to missing release of allocated memory in btrfs_uring_encoded_read() when btrfs_uring_read_extent() fails. A local user can trigger failing encoded read operations to leave the allocated iov buffer unfreed, potentially exhausting kernel memory through repeated failures.

258) Double free (CVE-ID: CVE-2026-98963)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through kernel memory corruption.

The vulnerability exists due to a double free in the Btrfs encoded-read completion handling when all bios finish before btrfs_encoded_read_regular_fill_pages() returns and the I/O status indicates an error. A local user can trigger encoded reads that encounter this condition to cause duplicate unlocking and freeing by btrfs_uring_read_extent() and btrfs_uring_read_finished(), potentially crashing the kernel.

259) Access of Uninitialized Pointer (CVE-ID: CVE-2026-98964)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through invalid pointer access in the Linux kernel.

The vulnerability exists due to use of a device pointer before initialization in nvmet_req_alloc_p2pmem_sgls() when the data scatter-gather list allocation succeeds but the metadata allocation fails. A local user can trigger request processing that reaches this failure path to potentially cause a kernel crash, as cleanup passes req->p2p_dev to pci_p2pmem_free_sgl() before the device pointer has been assigned.

260) Race condition (CVE-ID: CVE-2026-98965)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to a race condition caused by insufficient memory-write ordering in the ICE driver's transmit path when notifying the network controller of queued transmissions on arm64 systems. A local user can generate network transmission activity that may allow the controller to complete transmissions before the queued-byte accounting update becomes globally visible, triggering a kernel BUG assertion and causing a denial of service.

261) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-98966)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to exhaust kernel resources and potentially cause a denial of service.

The vulnerability exists due to failure to release references to old BPF programs in the Linux kernel bonding driver's bond_xdp_set() function when replacing XDP programs. A local privileged user can repeatedly replace XDP programs on a bonding device to accumulate unreleased programs and potentially cause a denial of service through resource exhaustion.

262) Deadlock (CVE-ID: CVE-2026-98967)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel deadlock.

The vulnerability exists due to improper locking in the Chelsio ch_ktls driver's chcr_ktls_dev_del() function and chcr_ktls_dev_add() error path when erasing entries from tid_list with softirqs enabled. A local user can trigger connection cleanup concurrent with receive processing for another connection on the same adapter and CPU to cause a receive softirq to spin on the XArray lock held by the interrupted task, resulting in a deadlock and denial of service.

263) Use-after-free (CVE-ID: CVE-2026-98968)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by potentially crashing the kernel.

The vulnerability exists due to use-after-free in the Linux kernel AMT driver's amt_dev_xmit() function when a queued General Query is transmitted after its referenced tunnel has expired and been freed. A local user can trigger this condition when a query remains queued longer than the tunnel lifetime, causing a stale tunnel pointer stored in skb->cb to be dereferenced and potentially crashing the kernel.

264) Out-of-bounds read (CVE-ID: CVE-2026-98969)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose kernel memory.

The vulnerability exists due to an out-of-bounds read in em_text_change() in net/sched/em_text.c when processing a netlink text ematch configuration with an unterminated algorithm name. A local user can supply a 16-byte algo array without a NUL terminator to cause the module-autoload path to read beyond the array and include adjacent memory contents in the usermode helper command line.

Exploitation requires CAP_NET_ADMIN in the target network namespace; obtaining this capability through unshare -Urn is sufficient.

265) Memory leak (CVE-ID: CVE-2026-98970)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through kernel memory exhaustion.

The vulnerability exists due to failure to release the buffer object cache size list in vc4_bo_cache_destroy() in the Linux kernel VC4 graphics driver when tearing down the cache during driver unbinding. A local privileged user can trigger repeated unbind operations, if permitted, to leak kernel memory and potentially cause a denial of service.

266) Improper initialization (CVE-ID: CVE-2026-98971)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disrupt device ID allocation and potentially cause a denial of service.

The vulnerability exists due to improper initialization of the stored device ID in gpio_exar_probe() when cleanup-action registration fails during device probing. A local privileged user can trigger a device initialization attempt that encounters this failure to cause exar_devm_ida_free() to release ID 0 instead of the allocated ID, potentially leaking a nonzero ID and incorrectly releasing ID 0 belonging to another device.

267) Use-after-free (CVE-ID: CVE-2026-98972)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by crashing the kernel.

The vulnerability exists due to use-after-free in the Linux kernel cpuset is_in_v2_mode() helper when a cgroup filesystem is being rebound. A local privileged user can potentially trigger dereferencing of a stale cpuset_cgrp_subsys.root pointer during rebinding to cause a kernel crash.

268) Missing Synchronization (CVE-ID: CVE-2026-98973)

CWE-ID: CWE-820 - Missing Synchronization

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger kernel list corruption that may cause a denial of service.

The vulnerability exists due to missing synchronization in the Linux kernel drm_bridge_add() function when re-adding a previously removed bridge while other operations access the shared bridge lists. A local user can trigger overlapping bridge lifecycle operations to corrupt bridge_list or bridge_lingering_list, potentially causing a denial of service.

269) Incorrect calculation (CVE-ID: CVE-2026-98974)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt another file's contents by overwriting shared filesystem blocks without triggering copy-on-write.

The vulnerability exists due to incorrect file size calculations in the Linux kernel XFS exchange-range implementation when processing XFS_IOC_EXCHANGE_RANGE operations with the TO_EOF flag and nonzero offsets on a filesystem supporting reflink and exchange-range. A local user can perform a sequence of file range exchanges that leaves shared blocks beyond the reported end of a file and incorrectly clears its reflink flag, then extend that file with a write to modify blocks still shared with another file.

270) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98975)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt data in files that share filesystem blocks.

The vulnerability exists due to improper management of reflink flags in the XFS mapping-exchange and extent-swap paths when exchanging mappings between files that retain shared blocks. A local user can perform an affected exchange and subsequently write to a shared block whose inode has lost its reflink flag, causing an in-place write instead of copy-on-write to corrupt another file sharing that block.

271) Incorrect authorization (CVE-ID: CVE-2026-98977)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to clear security flags on propagated automounts in their own namespace and prevent the host from changing flags on its own automounts.

The vulnerability exists due to incorrect authorization in the Linux kernel's attach_recursive_mnt() function in fs/namespace.c when assigning mount locks during automount propagation across user namespaces. A local user can trigger an automount through a directory descriptor referring to a host mount from a child namespace to cause the host's automount to be locked instead of the child's copy, allowing changes to mount security flags in the child namespace while blocking corresponding host operations.

272) Incorrect authorization (CVE-ID: CVE-2026-98978)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose files and directories concealed by locked mounts.

The vulnerability exists due to improper enforcement of mount locking in shrink_submount() in fs/namespace.c when reclaiming shrinkable mounts during unmount operations. A local user can place a shrinkable mount beneath a locked mount using MOVE_MOUNT_BENEATH in a user namespace they own, then unmount an unlocked ancestor to expose the covered directory and read otherwise hidden files.

273) NULL pointer dereference (CVE-ID: CVE-2026-98979)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel fault that blocks subsequent mount operations system-wide.

The vulnerability exists due to an invalid pointer dereference in the Linux kernel mount namespace handling code when attaching an automount beneath an internal mount whose namespace is represented by an error pointer. A local privileged user can access an automount through a descriptor obtained from a fanotify event on an overlay filesystem's lower layer to trigger a fault in count_mounts() while the namespace semaphore is held for writing, blocking subsequent mount operations.

274) Race condition (CVE-ID: CVE-2026-98980)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose the contents of underlying files normally hidden by overmounted entries.

The vulnerability exists due to improper synchronization in the Linux kernel's reference-based pathname traversal in fs/namei.c when resolving paths concurrently with unlink, rmdir, or rename operations. A local user can race a pathname lookup against an operation that detaches mounts and removes the underlying name to read a covered file if the lookup retains a reference to its dentry but misses the detached mount.

275) Race condition (CVE-ID: CVE-2026-98981)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose file contents hidden by mounts in another mount namespace.

The vulnerability exists due to a race condition in the Linux kernel mount namespace handling when unlink(), rmdir(), or rename() removes an entry that is a mountpoint in another mount namespace. A local user can race pathname lookups against mount detachment while the underlying directory entry remains hashed and positive to access file contents previously hidden by the mount.

276) Use-after-free (CVE-ID: CVE-2026-98982)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free in the Linux kernel, potentially causing a denial of service.

The vulnerability exists due to a use-after-free in mount namespace handling when a pseudo dentry becomes the root of a mount and is freed while a lockless path walk still accesses it. A local user can clone or bind mount a BPF token file on a caller-supplied bpffs mount and trigger a race between mount teardown and path traversal to cause access to freed kernel memory, potentially crashing the system.

277) Improper update of reference count (CVE-ID: CVE-2026-98983)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt namespace tracking and cause active namespaces to disappear from listns() output.

The vulnerability exists due to improper reference count updates in ksys_unshare() when cleaning up an nsproxy that was never installed after set_cred_ucounts() fails. A local user can invoke unshare() under conditions where the caller's real UID differs from its effective UID and alloc_ucounts() cannot allocate to trigger incorrect namespace reference decrements and remove active namespaces from listns() output.

278) Race condition (CVE-ID: CVE-2026-98984)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leave mounts persistently attached to removed directories.

The vulnerability exists due to a race condition in the Linux kernel's d_set_mounted() and attach_recursive_mnt() mountpoint handling when attaching a mount to a directory undergoing removal. A local privileged user can race directory removal with moving a bind mount beneath an existing mount between detach_mounts() and d_delete() to attach a mount to the removed directory that will never be detached.

279) Use-after-free (CVE-ID: CVE-2026-98985)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a use-after-free read that may cause a denial of service.

The vulnerability exists due to use-after-free in path_pivot_root() in fs/namespace.c when reading mount parents before verifying that the mounts belong to the caller's mount namespace. A local privileged user can invoke pivot_root() with a reference to an unmounted mount while its parent is concurrently released to trigger a read of freed memory, potentially causing a denial of service.

The same invalid parent read can also occur through the caller's root set via chroot().

280) Incorrect Synchronization (CVE-ID: CVE-2026-98986)

CWE-ID: CWE-821 - Incorrect Synchronization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through invalid kernel locking during mount namespace destruction.

The vulnerability exists due to improper synchronization in mount namespace cleanup when fanotify marks are removed from RCU softirq context, where acquiring a mutex can sleep. A local user can use root privileges within a user namespace to place a FAN_MARK_MNTNS mark on another task's mount namespace that the user namespace owns and trigger cleanup when that task exits to potentially cause a denial of service.

281) Off-by-one (CVE-ID: CVE-2026-98987)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt access to mounted content and prevent synchronous unmounting of an affected mount.

The vulnerability exists due to an off-by-one error in attach_recursive_mnt() in the Linux kernel mount namespace implementation when traversing a source mount's overmount chain. A local user can trigger mount propagation with a mount namespace file as the topmost and only such mount in the chain, causing an existing mount in a propagated copy to be attached beneath an unreachable nsfs dentry, hiding its content and preventing synchronous unmounting of its parent.

282) Incorrect authorization (CVE-ID: CVE-2026-98988)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass mount-based masking and read otherwise hidden files.

The vulnerability exists due to improper access control in create_new_namespace() in the Linux kernel when copying a mount tree using open_tree(OPEN_TREE_NAMESPACE), allowing covering child mounts to be omitted. A local user can create a user namespace, copy a mount tree without privileges over the source mount namespace, and enter the resulting mount namespace to access underlying content that the omitted mounts concealed.

283) Memory leak (CVE-ID: CVE-2026-98989)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust kernel memory and cause a denial of service.

The vulnerability exists due to insufficient checks for mount namespace reference cycles in do_loopback() in fs/namespace.c when recursively bind-mounting a source from another mount namespace. A local user can stack mount namespace file descriptors from an older mount namespace and repeatedly perform recursive bind mounts to create self-referencing namespaces, leaking the namespaces and their mounts until memory is exhausted.

284) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-98990)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by unmounting mounts that are still in use, disrupting filesystem access.

The vulnerability exists due to a time-of-check time-of-use error in the Linux kernel mount namespace handling in fs/namespace.c when processing successive unmounts during submount shrinking or mount expiry. A local privileged user can trigger unmount operations in a suitable mount tree to make an earlier unmount relocate a busy mount into a later unmount's propagation path, where it is removed without rechecking its reference count, disrupting access to the active mount.

Exploitation requires a mount with MNT_SHRINKABLE, such as an automounted NFS, AFS, or CIFS submount or the tracefs mount below debugfs. Bind mounts inherit this flag.

285) Use-after-free (CVE-ID: CVE-2026-98991)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel mount notification mechanism when repeated unmount operations queue the same mount more than once during a single namespace_sem hold. A local user can trigger these operations in a mount namespace with a FAN_MARK_MNTNS mark to corrupt the notification list, causing subsequent host mount operations to access freed memory and potentially crash the kernel.

Exploitation requires a mount with MNT_SHRINKABLE to bind from.

286) Improper input validation (CVE-ID: CVE-2026-98992)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to recursively copy an unmounted mount tree, including overmounts that remain attached to it.

The vulnerability exists due to improper validation of mount state in the Linux kernel mount namespace handling code when processing recursive bind-mount requests involving nsfs or pidfs files. A local user can retain a file descriptor to a lazily unmounted bind mount and request a recursive bind mount through that descriptor to copy the unmounted root and its attached overmounts.

287) Use-after-free (CVE-ID: CVE-2026-98993)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service and potentially corrupt kernel memory through a use-after-free.

The vulnerability exists due to improper inheritance of the MNT_UMOUNT flag in clone_mnt() when copying a lazily unmounted mount kept alive by an open file descriptor. A local user can perform bind-mount and namespace operations on the resulting mount to disrupt mount tracking, cause nonterminating mount traversal, or trigger access to a freed mount namespace structure.

The detached source mount can be copied through this path only when its root is an nsfs or pidfs file.

288) Use-after-free (CVE-ID: CVE-2026-98994)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel use-after-free.

The vulnerability exists due to a use-after-free in statmount_mnt_basic() in fs/namespace.c when processing STATMOUNT_BY_FD requests for an unmounted mount while its parent is concurrently released. A local user can query an unmounted mount retained by a file descriptor during concurrent parent mount teardown to trigger a dereference of freed parent mount memory and potentially crash the kernel.

289) Use-after-free (CVE-ID: CVE-2026-98995)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause kernel memory corruption that may result in a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel mount namespace code in fs/namespace.c when mnt_change_mountpoint() reparents a mount without clearing the old parent's overmount pointer. A local user can trigger a sequence of mount reparenting and unmounting operations while retaining a file descriptor to the old parent, then use that mount as the target of a mount-beneath operation to make topmost_overmount() follow the dangling pointer and do_lock_mount() take references on freed memory, potentially causing kernel memory corruption and a denial of service.

290) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98996)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause mounts that are still in use to be detached, potentially disrupting filesystem access.

The vulnerability exists due to incomplete reference checks in the Linux kernel's propagate_mount_busy() function in fs/pnode.c when evaluating mounts affected by synchronous unmount propagation. A local privileged user can arrange nested copies of a shared mount tree inside a container and retain an open file descriptor to a copied tree to cause a subsequent host unmount to detach that tree despite its outstanding reference.

291) Improper input validation (CVE-ID: CVE-2026-98997)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to discard the contents of a GPU buffer shared with them by another client on the same device.

The vulnerability exists due to improper validation of buffer object memory domains in the Linux kernel amdgpu_userq_get_doorbell_index() function when processing a queue doorbell handle. A local user can supply a regular buffer object as doorbell_handle to cause it to be pinned into the doorbell domain, where TTM moves it using ttm_bo_move_null() and discards its contents. For a buffer imported on the same device, this affects the exporting client's GEM object.

292) Use-after-free (CVE-ID: CVE-2026-98999)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel's Xe DRM buffer-object pin management when a framebuffer unpin performs the final unpin without removing the object's pinned_link list entry. A local user can trigger overlapping external and framebuffer pin operations, with the external unpin occurring first, to leave a stale list entry after the buffer object is freed and potentially cause a kernel crash when the list is subsequently walked or spliced.

293) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-99000)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a persistent memory-reclamation accounting leak that may degrade system availability.

The vulnerability exists due to improper resource lifecycle accounting in the Linux kernel Xe driver's framebuffer pin and unpin paths when a framebuffer unpin releases the final pin on a buffer object also handled by another pinning path. A local user can trigger overlapping buffer-object pin lifecycles ending in a framebuffer unpin to leave a stale pinned_link entry and a permanent shrinker accounting leak, potentially degrading system availability.

294) Integer underflow (CVE-ID: CVE-2026-99000)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt memory-reclamation accounting and potentially cause a denial of service under memory pressure.

The vulnerability exists due to accounting underflow in the Linux kernel Xe driver's buffer-object pin accounting when processing imported dma-bufs whose translation tables are marked populated but whose pages were never included in shrinker accounting. A local user can trigger external pinning of such an imported buffer to subtract pages that were never counted, producing negative counts that are interpreted as enormous unsigned reclaimable page counts and potentially causing a denial of service through excessive shrinker activity.

The affected imported translation tables have TTM_TT_FLAG_EXTERNAL set without TTM_TT_FLAG_EXTERNAL_MAPPABLE.

295) Integer underflow (CVE-ID: CVE-2026-99000)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause excessive memory-reclamation activity under memory pressure, potentially resulting in a denial of service.

The vulnerability exists due to accounting underflow in the Linux kernel Xe driver's xe_bo_pin_external() and xe_bo_unpin_external() functions when handling nested buffer-object pins. A local user can trigger multiple pins of the same external buffer object through multiple attachments or importers to repeatedly subtract already-excluded pages from the shrinker's accounting. Negative counts are interpreted as unsigned values, producing enormous apparent reclaimable page counts and potentially causing a denial of service through excessive shrinker activity.

296) Use-after-free (CVE-ID: CVE-2026-99001)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel Xe driver's I2C client work handling when device teardown overlaps queued or running work. A local user can exploit this race condition to cause the client work callback to access a released adapter or its own freed work allocation, potentially causing a kernel crash.

297) Out-of-bounds read (CVE-ID: CVE-2026-99002)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger out-of-bounds reads that may disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the Linux kernel vmwgfx cursor snooping functionality when copying surface data using insufficiently validated userspace-supplied pitch and box dimensions. A local user can supply crafted surface copy parameters to cause reads beyond the source buffer or its mapped region, potentially disclosing sensitive information or causing a denial of service.

298) Access of Uninitialized Pointer (CVE-ID: CVE-2026-99003)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by crashing the kernel.

The vulnerability exists due to insufficient queue-count validation leading to an uninitialized pointer dereference in the Linux kernel Panthor driver when creating queue groups. A local user can request more queues than the firmware-reported stream slot count, without exceeding MAX_CS_PER_CSG, to cause cs_slot_prog_locked() to access an uninitialized stream interface and potentially crash the kernel when dereferencing cs_iface->input->ringbuf_base.

299) Integer underflow (CVE-ID: CVE-2026-99004)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by exhausting system memory and triggering an out-of-memory kernel panic.

The vulnerability exists due to an integer underflow in pvr_mmu_op_context_create() in the Linux kernel's Imagination GPU driver when calculating page table preallocation counts for a mapping that crosses a page table boundary. A local user can trigger such a mapping to cause excessive MMU page allocation, exhausting system memory and triggering an out-of-memory kernel panic.

300) Race condition (CVE-ID: CVE-2026-99005)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning and taint the kernel.

The vulnerability exists due to a race condition in the i915 driver's RPS work handling when scheduling work concurrently with asynchronous GT parking. A local user can trigger this race so that rps_work() unmasks power-management interrupts after the GT has been parked, causing hardware register access without a runtime power-management wakelock and triggering a kernel warning that taints the kernel.

301) Release of invalid pointer or reference (CVE-ID: CVE-2026-99006)

CWE-ID: CWE-763 - Release of invalid pointer or reference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through invalid kernel memory deallocation.

The vulnerability exists due to invalid pointer deallocation in the i915 driver's eb_relocate_parse_slow() function when relocation cleanup uses a buffer count increased by the command parser to access entries outside the original exec array. A local user can trigger this execution path to cause kvfree() to operate on pointers obtained from out-of-bounds entries, potentially corrupting kernel memory and crashing the system.

302) Improper handling of exceptional conditions (CVE-ID: CVE-2026-99007)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning and potentially disrupt framebuffer mode restoration.

The vulnerability exists due to improper handling of probe failures in the Linux kernel DRM framebuffer helper when framebuffer probing fails with an error other than -EAGAIN. A local user can trigger a subsequent framebuffer mode restoration, such as on process exit, to commit stale display configuration with a missing framebuffer, causing a kernel warning and potentially disrupting framebuffer mode restoration.

303) NULL pointer dereference (CVE-ID: CVE-2026-99008)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to a NULL pointer dereference in the Linux kernel Bluetooth RFCOMM function rfcomm_dev_shutdown() when closing a tty whose device registration failed. A local user can open /dev/rfcommN after the RFCOMM device becomes discoverable but before tty registration completes, then close it following a registration failure to trigger a dereference of the unset dev->tty_dev pointer and cause a kernel crash.

304) Deadlock (CVE-ID: CVE-2026-99009)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a deadlock in Bluetooth RFCOMM processing.

The vulnerability exists due to inconsistent lock ordering in the Linux kernel Bluetooth RFCOMM subsystem when establishing an RFCOMM connection while a BR/EDR link is being authenticated. A local user can issue an RFCOMM socket connect() call from userspace to trigger circular acquisition of rfcomm_mutex and hdev->lock, potentially deadlocking Bluetooth processing.

305) Memory leak (CVE-ID: CVE-2026-99010)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to exhaust kernel memory and cause a denial of service.

The vulnerability exists due to a memory leak in the Linux kernel Bluetooth RFCOMM socket callback rfcomm_sk_data_ready() when processing incoming data frames for a connected data link connection whose owner has been cleared. A remote attacker on the local network can send repeated data frames during the interval before the connection closes to accumulate unreleased socket buffers and exhaust kernel memory, causing a denial of service.

306) Use-after-free (CVE-ID: CVE-2026-99011)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through kernel memory corruption.

The vulnerability exists due to a use-after-free in the Linux kernel Bluetooth SCO connection handling code when receiving SCO data concurrently with connection teardown. A local user can trigger a race between sco_recv_scodata() and sco_conn_free() to cause a denial of service when the receive path attempts to acquire a reference to an already freed sco_conn object through hcon->sco_data.

307) Use-after-free (CVE-ID: CVE-2026-99012)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering access to freed kernel socket memory.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth ISO socket implementation when concurrent connection attempts replace a socket's connection association. A local user can issue concurrent connect calls on the same socket, leaving an old connection associated with a socket that is subsequently freed, to trigger an invalid memory access during a later connection callback and potentially crash the kernel.

308) Use-after-free (CVE-ID: CVE-2026-99013)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel use-after-free.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth ISO socket implementation when concurrent listen() calls configure the same broadcast socket. A local user can race these calls to overwrite the socket's connection pointer while leaving an earlier connection referencing the socket, causing subsequent Bluetooth events to access freed socket memory after socket teardown and potentially crash the kernel.

309) Use-after-free (CVE-ID: CVE-2026-99014)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel Bluetooth HCI command handling code when setting up periodic advertising synchronization scans. A local user can potentially exercise a race between scan setup and command processing to cause a kernel crash by accessing command buffers after they have been freed.

310) Use-after-free (CVE-ID: CVE-2026-99015)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by crashing the Linux kernel.

The vulnerability exists due to a use-after-free caused by missing synchronization in Bluetooth HCI socket handling when rebinding a socket after its controller is unregistered races with monitor control replay. A local user can trigger concurrent socket rebinding and replay operations to cause a NULL pointer dereference or access to a freed controller object and crash the kernel.

311) Untrusted Pointer Dereference (CVE-ID: CVE-2026-99016)

CWE-ID: CWE-822 - Untrusted Pointer Dereference

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to read and modify arbitrary kernel memory, potentially causing a denial of service.

The vulnerability exists due to untrusted pointer dereference in the RISC-V arch_futex_atomic_op_inuser() and futex_atomic_cmpxchg_inatomic() helpers when processing tagged user pointers with the tagged-address ABI enabled. A local user can supply a crafted tagged pointer to FUTEX_WAKE_OP that passes validation after tag removal but retains its tag during the atomic access, causing an atomic read-modify-write on a kernel address and using the comparison result as a read oracle to disclose kernel memory contents.

The described overlap between tag bits and canonical-address bits occurs with Sv57 and PMLEN=16.

312) Improper initialization (CVE-ID: CVE-2026-99017)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially bypass intended CPU security protections on vulnerable T-Head C9xx systems.

The vulnerability exists due to improper initialization of the CPU vulnerability state in the Linux kernel's RISC-V T-Head Ghostwrite errata handling when early boot alternatives are not executed. A local user can potentially use the still-enabled xtheadvector extension on a vulnerable CPU to bypass intended CPU security protections.

The affected configuration has ERRATA_THEAD_GHOSTWRITE=y and ERRATA_THEAD_MAE=n.

313) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-99018)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write to arbitrary kernel memory and hijack kernel control flow to execute arbitrary code with kernel privileges.

The vulnerability exists due to reliance on a user-controlled register for a security decision in the Linux kernel RISC-V handle_exception() shadow call stack handling when entering the kernel from userspace. A local user can set tp to the linear-map address of the current task_struct and supply a malicious gp value before triggering a trap to bypass the shadow call stack pointer reload, causing kernel functions to write return addresses to attacker-controlled memory and return through attacker-controlled addresses.

Exploitation requires CONFIG_SHADOW_CALL_STACK to be enabled.

314) Memory leak (CVE-ID: CVE-2026-99019)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to leak kernel memory, potentially causing a denial of service through repeated resource exhaustion.

The vulnerability exists due to missing cleanup of allocated memory in the Linux kernel SCSI changer driver's probe error path when ch_probe() fails after ch_readconfig(). A local privileged user can trigger such probe failures to leave the allocated data transfer device pointer array unreleased, potentially exhausting kernel memory if the failures are repeated.

315) Improper update of reference count (CVE-ID: CVE-2026-99019)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by preventing replacement SCSI devices from being accepted and preventing the low-level driver's module from being unloaded.

The vulnerability exists due to missing reference-count decrements in ch_readconfig() in the Linux kernel SCSI changer driver when looking up data transfer devices reported by a changer. A local privileged user can trigger changer initialization and subsequent drive removal to leave unreleased scsi_device references that keep removed devices on the host's device list.

The changer must report its drives' SCSI IDs for the issue to occur.

316) Out-of-bounds read (CVE-ID: CVE-2026-99020)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through out-of-bounds kernel memory reads.

The vulnerability exists due to an out-of-bounds read in the Linux kernel tps6594-regulator driver when processing voltage selectors above 0x45 for TPS65224 and TPS652G1 BUCK2-4 regulators. A local user can potentially trigger these lookups to cause reads beyond tps65224_bucks_2_3_4_ranges[], because the descriptors specify four linear ranges although the array contains only two, potentially disrupting kernel operation.

The invalid lookups also occur during normal regulator registration, when the regulator core checks voltage constraints against every selector.

317) Stack-based buffer overflow (CVE-ID: CVE-2026-99021)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt kernel memory, potentially causing a denial of service.

The vulnerability exists due to a stack-based buffer overflow in of_regulator_bulk_get_all() in the Linux kernel regulator subsystem when copying device-tree supply names into a fixed 64-byte stack buffer without bounding the copy to the buffer size. A local privileged user can provide an excessively long supply name, if able to influence the device-tree properties processed by this function, to overwrite stack memory and potentially cause a kernel crash.

318) Access of Uninitialized Pointer (CVE-ID: CVE-2026-99021)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to an uninitialized pointer in the Linux kernel regulator subsystem when regulator_bulk_enable() reports a supply-enable failure using an array returned by of_regulator_bulk_get_all(). A local privileged user can trigger this failure path, if able to influence the affected regulator operations, to potentially cause a kernel crash when the uninitialized supply-name pointer is dereferenced.

319) Improper input validation (CVE-ID: CVE-2026-99022)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a board reboot.

The vulnerability exists due to improper validation of readable register addresses in the Linux kernel LTC3676 regulator driver when processing register dumps through regmap debugfs. A local privileged user can read /sys/kernel/debug/regmap/2-003c/registers to trigger access to the write-only HRST register, causing a hard reset of the chip and rebooting the board.

The CLIRQ register at address 0x1f is also incorrectly treated as readable; reading it triggers the interrupt-clear command.

320) Memory leak (CVE-ID: CVE-2026-99023)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a memory leak that may lead to a denial of service through kernel memory exhaustion.

The vulnerability exists due to failure to release an allocated regulator consumers array in drivers/power/sequencing/pwrseq-pcie-m2.c when handling probe error cleanup or device removal. A local privileged user can trigger these cleanup paths repeatedly to leak kernel memory, potentially exhausting available memory.

321) Use of uninitialized resource (CVE-ID: CVE-2026-99024)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering invalid kernel memory access during OP-TEE device initialization.

The vulnerability exists due to use of uninitialized resources in the Linux kernel OP-TEE driver when TEE devices become accessible before initialization of the associated driver state is complete. A local user can open an accessible TEE device and initiate a session or invoke an operation during this initialization window to trigger use of uninitialized mutexes and a NULL pointer dereference, potentially crashing the kernel.

322) Excessive Iteration (CVE-ID: CVE-2026-99025)

CWE-ID: CWE-834 - Excessive Iteration

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through CPU starvation, a soft lockup, and a possible kernel panic.

The vulnerability exists due to unbounded softirq processing in the Open vSwitch netlink flow dump when retrieving flow statistics under sustained packet load and voluntary preemption. A local user can initiate a netlink flow dump under these conditions to cause the dumping thread to continuously process the replenished softirq backlog without sleeping or reaching a rescheduling point, preventing other threads from running on the affected CPU.

323) Memory leak (CVE-ID: CVE-2026-99026)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust socket write-memory resources and potentially cause a denial of service.

The vulnerability exists due to a memory leak in the Linux kernel team driver's bc_transmit() function when handling broadcast transmissions with no transmit-capable port. A local user can send AF_PACKET traffic through an affected team interface to retain unconsumed socket buffers and their socket write-memory charges, potentially exhausting resources and disrupting further transmissions.

A transmit-enabled port whose link is down keeps the broadcast transmit operation installed.

324) Use-after-free (CVE-ID: CVE-2026-99027)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel team driver's queue override transmission helper when an override port's queueing discipline drops a packet buffer and transmission returns a nonzero result. A local user can trigger packet transmission through the affected queue override path to cause the freed buffer to be reused for another port or the mode transmit operation, potentially crashing the kernel.

325) Race condition (CVE-ID: CVE-2026-99028)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to corrupt freed memory through DMA writes, potentially causing a denial of service.

The vulnerability exists due to a race condition between axienet_dma_rx_cb() and axienet_stop() in the Xilinx AXI Ethernet driver's dmaengine path when receive-buffer resubmission overlaps interface teardown. A local privileged user can trigger interface shutdown during receive processing, if permitted, to leave the DMA engine writing into a buffer freed by teardown, potentially corrupting memory and causing a denial of service.

326) Memory leak (CVE-ID: CVE-2026-99028)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by exhausting memory or DMA mapping resources.

The vulnerability exists due to missing release of socket buffers and DMA mappings in the Xilinx AXI Ethernet driver's dmaengine path when stopping a network interface with outstanding DMA descriptors. A local privileged user can repeatedly bring an interface down, if permitted, to accumulate unreleased buffers and mappings, potentially exhausting a limited IOMMU aperture and causing a denial of service.

327) Memory leak (CVE-ID: CVE-2026-99029)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to consume kernel memory and potentially cause a denial of service.

The vulnerability exists due to missing release of allocated memory in sparx5_tc_matchall_destroy() when deleting offloaded matchall filters. A local privileged user can repeatedly add and delete mirror and goto matchall filters to accumulate leaked allocations and potentially degrade system availability.

328) Use of uninitialized resource (CVE-ID: CVE-2026-99030)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to obtain potentially sensitive information from stale kernel memory transmitted in outgoing packets.

The vulnerability exists due to use of uninitialized buffer contents in skb_copy_and_csum_bits() when encountering unreadable packet fragments after copying only the linear portion of a packet. A remote attacker can inspect affected outgoing ICMP error messages or driver transmissions to obtain stale memory contents from portions of the destination buffer that were not filled.

329) Uncontrolled Recursion (CVE-ID: CVE-2026-99031)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through kernel stack exhaustion.

The vulnerability exists due to uncontrolled recursion in br_multicast_sg_del_exclude_ports() in the Linux kernel bridge multicast subsystem when removing automatically added STAR_EXCL port groups from source-specific multicast entries. A local user can trigger cleanup of an entry containing a large number of these port groups to exhaust the kernel stack and potentially crash the system.

330) Use-after-free (CVE-ID: CVE-2026-99032)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to a use-after-free in the Linux kernel's smc_getname() function when processing getsockname() calls concurrently with asynchronous CLC socket release. A local user can invoke getsockname() on an SMC socket while link-group termination releases its underlying CLC socket to trigger access to freed memory or a NULL pointer dereference and cause a denial of service.

331) Improper input validation (CVE-ID: CVE-2026-99033)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to improper validation of link-layer header state in packet_rcv_spkt() when receiving packets from a device without a visible link-layer header. A local privileged user can bind a SOCK_PACKET socket to a CAN interface and cause it to receive a frame with an uninitialized MAC header offset, triggering an invalid skb_push() operation to cause a system-wide denial of service.

The panic occurs in softirq context and terminates the system even with panic_on_oops=0.

332) Improper resource shutdown or release (CVE-ID: CVE-2026-99034)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through incorrect clock handling during device removal.

The vulnerability exists due to improper runtime power management cleanup in sdhci_sprd_remove() in the Linux kernel's Spreadtrum SDHCI driver when removing a runtime-suspended device. A local privileged user can trigger device removal, if permitted, to disable clocks that runtime power management callbacks may have already disabled, potentially disrupting kernel operation.

333) Use-after-free (CVE-ID: CVE-2026-99035)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to use-after-free in the mtk-sd MMC host driver when driver unbinding overlaps with an active request timeout callback. A local privileged user can trigger this overlap to cause the callback to access freed host memory, potentially crashing the kernel.

334) Use-after-free (CVE-ID: CVE-2026-99036)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a use-after-free in the Linux kernel device-mapper do_resume() function when processing concurrent ioctls on the same device. A local privileged user can race a table swap against an unlocked dm_table_get_mode(new_map) call to trigger a read of freed table memory, potentially causing a kernel crash.

335) Out-of-bounds read (CVE-ID: CVE-2026-99037)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel oops.

The vulnerability exists due to an out-of-bounds read in the Linux kernel dm-crypt component when loading a table that combines an AEAD cipher with the lmk initialization vector mode. A local privileged user can load a table containing "capi:gcm(aes)-lmk" with the "integrity:28:aead" option to trigger a kernel oops: lmk sets tfms_count to 64, but crypt_alloc_tfms_aead allocates only one transform, causing crypt_setkey to read beyond the tfms_aead array and pass the resulting values to crypto_aead_setkey.

336) Race condition (CVE-ID: CVE-2026-99038)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by hanging memory stick host removal and blocking kernel worker threads.

The vulnerability exists due to a race condition in the Linux kernel rtsx_usb_ms driver when device removal overlaps with memory stick request processing. A local user can trigger device removal during a memory stick check to leave a request without completion, causing removal to hang when the memory stick core waits for that request without a timeout.

337) Use-after-free (CVE-ID: CVE-2026-99039)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory and potentially cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel memstick core when device identification or address configuration requests time out while asynchronous processing remains in progress. A local user can trigger request processing that encounters this timeout condition to cause a host controller driver to write into an already freed card structure, potentially crashing the system.

338) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-99040)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass keyring restrictions and link keys that should be rejected.

The vulnerability exists due to a time-of-check time-of-use race condition in __key_create_or_update() when reading the destination keyring's restriction before acquiring its semaphore. A local user can issue an add_key() call with write permission on the destination keyring and race the installation of a reject-all restriction to link a key using a stale restriction snapshot after restriction installation has completed.

339) NULL pointer dereference (CVE-ID: CVE-2026-99041)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to a null pointer dereference in ip6erspan_tunnel_xmit() when obsolete path MTU handling treats tunnel metadata attached to a packet as a route with an output device. A local user can use tc tunnel_key to attach METADATA_IP_TUNNEL metadata and mirred to redirect the packet to a native ip6erspan device to trigger a kernel panic.

The reported reproduction used self-created user and network namespaces.

340) Use-after-free (CVE-ID: CVE-2026-99043)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a potential kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel ice driver's ice_eswitch_release_repr() function when a representor is torn down while queued packets still reference its metadata_dst object. A local privileged user can trigger this teardown condition to cause a potential kernel crash when the outstanding references are subsequently used.

341) Use-after-free (CVE-ID: CVE-2026-99044)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a use-after-free in the Linux kernel ice driver's ice_dealloc_dynamic_port() function when cleaning up a dynamic port. A local privileged user can trigger the affected cleanup path, which reads dyn_port->vsi->idx after freeing the VSI to remove an entry from pf->dyn_ports, to potentially cause a denial of service through a kernel crash.

342) Use-after-free (CVE-ID: CVE-2026-99045)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause memory corruption or a denial of service.

The vulnerability exists due to a use-after-free condition in the ibmveth driver's ibmveth_open() error-handling path when receive buffer pool allocation fails after logical LAN registration. A local privileged user can trigger this failure path to leave the Power Hypervisor (PHYP) referencing a buffer-list page after it is unmapped, potentially causing memory corruption or a system crash.

343) Memory leak (CVE-ID: CVE-2026-99046)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially exhaust memory and cause a denial of service.

The vulnerability exists due to failure to release XSK buffers in the Linux kernel gve driver's gve_rx_dqo() function when processing RX completion descriptors with the error bit set. A local user can potentially trigger repeated processing of these descriptors to accumulate unreleased buffers and exhaust available memory.

The leak occurs when using AF_XDP zero-copy mode.

344) Memory leak (CVE-ID: CVE-2026-99047)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to exhaust XSK buffer resources, potentially causing a denial of service.

The vulnerability exists due to failure to release XSK buffers in the Linux kernel GVE driver's gve_rx_reset_ring_dqo() function when resetting receive ring state during queue shutdown. A local privileged user can trigger affected queue-stop operations to leak buffers posted to the NIC, potentially exhausting buffer resources and causing a denial of service.

345) Deadlock (CVE-ID: CVE-2026-99048)

CWE-ID: CWE-833 - Deadlock

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a deadlock in the Linux kernel GVE network driver.

The vulnerability exists due to recursive acquisition of the netdev lock in gve_xsk_pool_disable() when disabling XSK pools. A local privileged user can trigger an XSK pool disable operation that calls napi_disable() or napi_enable() while the calling thread already holds the netdev lock, causing the thread to deadlock and disrupting the affected network device's operation.

346) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-99049)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent the Xilinx GPIO controller from entering runtime suspend, leaving its clock enabled.

The vulnerability exists due to a missing runtime power management reference release in xgpio_request() in the Linux kernel Xilinx GPIO driver when pm_runtime_get_sync() fails. A local user can trigger a GPIO request that encounters this failure to leave the usage counter incremented and prevent the controller from entering runtime suspend, because gpiolib does not invoke the matching free callback after a failed request.

347) Use-after-free (CVE-ID: CVE-2026-99050)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the Linux kernel MPSSE GPIO driver when IRQ enabling races with USB device disconnection. A local user can trigger this race so that gpio_mpsse_disconnect() misses a poll worker scheduled before its addition to the worker list, allowing gpio_mpsse_poll() to access freed mpsse_priv memory and potentially cause a denial of service.

348) Use-after-free (CVE-ID: CVE-2026-99051)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through a kernel crash.

The vulnerability exists due to a use-after-free in the Linux kernel fs-verity subsystem when concurrent metadata lookups and removal involve different inodes in the same hash chain. A local user can potentially trigger these concurrent operations to cause a lookup to access the rhash_head or inode fields of a freed fsverity_info structure, which may crash the kernel.

349) Protection mechanism failure (CVE-ID: CVE-2026-99052)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disable SELinux per-file security labeling on shared NFSv4 mounts.

The vulnerability exists due to failure to preserve the SECURITY_LSM_NATIVE_LABELS flag in selinux_set_mnt_opts() when an already-initialized superblock is reused for a second mount. A local privileged user can trigger a second mount of an NFSv4 filesystem exported with security_label to cause nfs_get_root() to clear NFS_CAP_SECURITY_LABEL on the shared nfs_server, disabling per-file labeling for both the original and new mounts.

350) Use-after-free (CVE-ID: CVE-2026-99053)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through kernel memory corruption.

The vulnerability exists due to use-after-free in the Linux kernel TIPC link-management handlers when processing requests concurrently with timer-driven cleanup of a down peer. A local user can issue link-management requests through generic netlink to trigger access to a freed node and potentially crash the kernel.

351) Use-after-free (CVE-ID: CVE-2026-99054)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free caused by a teardown race in the Linux kernel TIPC topology server when closing subscriber connections while send and receive workqueues are still running. A local user can exploit concurrent connection activity during topology server shutdown to cause kernel crashes or stalls.

352) NULL pointer dereference (CVE-ID: CVE-2026-99055)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to a null pointer dereference in can_map_frag() in the Linux kernel TCP implementation when determining page mapping hints for zerocopy receives. A local user can trigger processing of a readable prefix followed by an unreadable net_iov fragment to cause a kernel crash when skb_frag_page() returns NULL and PageCompound() dereferences it.

Hardware end-to-end reachability remains untested and requires CONFIG_NET_DEVMEM and a supported DMA-buf-bound RX queue; the diagnostic directly inserted the net_iov fragment.

353) Use-after-free (CVE-ID: CVE-2026-99056)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel crash.

The vulnerability exists due to a race-induced use-after-free in the Linux kernel stream parser when strp_done() tears down parser resources before an in-flight strp_recv() call has completed. A local user can trigger overlapping receive processing and parser teardown to access freed memory and potentially crash the kernel.

Only the espintcp user of the stream parser is affected by this race condition.

354) Memory leak (CVE-ID: CVE-2026-99057)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to exhaust kernel memory and cause a denial of service.

The vulnerability exists due to a memory leak in the Xen netfront driver's xennet_poll() error handling when processing response chains with more slots than fit in an skb's fragments. A local privileged user can control the backend to repeatedly supply oversized response chains, leaving the dequeued skb and its attached fragment pages unfreed, to exhaust kernel memory and cause a denial of service.

355) NULL pointer dereference (CVE-ID: CVE-2026-99058)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel fault.

The vulnerability exists due to a NULL pointer dereference in is_chained_work() in kernel/workqueue.c when a kernel worker outside work-item execution queues work on a draining or destroying workqueue. A local user can potentially trigger this condition to cause the chained-work check to dereference a NULL worker->current_pwq pointer and fault.

356) Race condition (CVE-ID: CVE-2026-99059)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause WireGuard to establish the same cryptographic session more than once.

The vulnerability exists due to a race condition in WireGuard's Noise handshake processing when duplicate handshake responses are processed concurrently with an intervening handshake initiation. A remote attacker can replay a handshake response under this timing condition to cause stale handshake state to be accepted and the same session to be established more than once.

357) NULL pointer dereference (CVE-ID: CVE-2026-99060)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to missing initialization of the driver-private global station WCID in the Linux kernel's mt7603 wireless driver when queuing frames that have neither a station nor a virtual interface. A local privileged user can inject a frame through a monitor interface to make __skb_queue_tail() dereference a NULL prev pointer in an uninitialized sk_buff_head, causing a kernel fault.

358) Use-after-free (CVE-ID: CVE-2026-99061)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by crashing the kernel.

The vulnerability exists due to a use-after-free caused by a race condition in the brcmfmac driver's brcmf_detach() function when driver removal overlaps with removal of a P2P device interface by an exiting user-space process. A local privileged user can remove the driver while the process that created the P2P device is still exiting to trigger duplicate interface unregistration and access to freed memory, causing a kernel crash.

359) Integer underflow (CVE-ID: CVE-2026-99062)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt VSOCK stream reception and socket readiness reporting.

The vulnerability exists due to an integer underflow in virtio_transport_read_skb() when dequeuing a partially consumed stream packet. A local user can trigger subtraction of the full packet length rather than the remaining unread length from rx_bytes to corrupt receive accounting, cause erroneous receive failures, and hide queued data from socket reads.

The demonstrated behavior involves a connected CID_LOCAL stream with an SK_SKB verdict.

360) Out-of-bounds read (CVE-ID: CVE-2026-99063)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disclose seven bytes of kernel memory beyond an allocated buffer.

The vulnerability exists due to an out-of-bounds read in the Linux kernel device-mapper ioctl implementation when get_result_buffer() sets data_start beyond the end of a minimum-sized buffer. A local privileged user can issue a DM_LIST_DEVICES ioctl with data_size set to 305 to cause ctl_ioctl() to copy seven bytes beyond the allocation back to userspace.

361) Out-of-bounds write (CVE-ID: CVE-2026-99064)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause memory corruption and potentially a denial of service.

The vulnerability exists due to incorrect maintenance of cached IPv4 option offsets in cipso_v4_skbuff_delattr() when removing a CIPSO option that precedes other options. A remote attacker can send a specially crafted IPv4 packet to cause subsequent option processing to access incorrect bytes, potentially interpreting packet data as an option length and causing an out-of-bounds write into fixed-size option storage.

362) NULL pointer dereference (CVE-ID: CVE-2026-99065)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel NULL pointer dereference.

The vulnerability exists due to a race condition leading to a NULL pointer dereference in the Linux kernel cpuset function guarantee_active_cpus() when CPU offlining updates cpu_active_mask before cpuset_handle_hotplug() updates the affected cpusets' effective_cpus masks. A local user can potentially trigger a call to guarantee_active_cpus() during this race window to cause a kernel crash when traversal beyond the top cpuset results in dereferencing a NULL pointer.

363) Integer overflow (CVE-ID: CVE-2026-99066)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to an integer overflow caused by missing socket buffer header initialization in init_can_skb() when CAN receive buffers reach packet_rcv_spkt() through SOCK_PACKET. A local user can trigger processing of an affected buffer with mac_header set to 0xFFFF to overflow the push length calculation, triggering skb_under_panic and a system-wide kernel panic.

364) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-99067)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially exhaust kernel resources and cause a denial of service.

The vulnerability exists due to missing release of a filesystem root reference in the Linux kernel Btrfs scrub_print_warning_inode() function when inode path resolution fails while printing scrub warnings. A local user can trigger repeated failures in this error path to accumulate unreleased root references, potentially exhausting kernel resources and causing a denial of service.

365) Memory leak (CVE-ID: CVE-2026-99068)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust kernel memory and potentially cause a denial of service.

The vulnerability exists due to missing release of allocated memory in the ALSA ctxfi driver's dao_clear_input() function when clearing DAO input mappers. A local user can trigger repeated mapper clearing to leak allocated mapper arrays, potentially exhausting kernel memory and causing a denial of service.

366) Type Confusion (CVE-ID: CVE-2026-99069)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel crash.

The vulnerability exists due to type confusion in the Linux kernel ati_remote2 driver's sysfs attribute handlers when processing reads or writes to the channel_mask and mode_mask attributes. A local user can access these attributes to trigger the incorrect conversion of a usb_interface device pointer into a usb_device pointer, leading to invalid pointer accesses that may crash the kernel.

367) Race condition (CVE-ID: CVE-2026-99070)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger spurious kernel warnings.

The vulnerability exists due to a race condition in the Linux kernel IPv6 route notification function fib6_info_hw_flags_set() when calculating notification sizes and filling notification buffers using separate snapshots. A local privileged user can trigger concurrent nexthop group replacement during notification construction to cause rt6_fill_node() to return -EMSGSIZE and trigger an unwarranted kernel warning.

The race requires nexthop compatibility mode to be enabled.

368) Race condition (CVE-ID: CVE-2026-99071)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to trigger a spurious kernel warning.

The vulnerability exists due to a race condition in fib_alias_hw_flags_set() when sizing and populating asynchronous IPv4 route notifications using independent snapshots protected only by RCU. A local privileged user can trigger concurrent route updates to cause a spurious kernel warning if nexthop group replacement increases the notification size between these snapshots and fib_dump_info() returns -EMSGSIZE.

The race requires nexthop compatibility mode to be enabled.

369) NULL pointer dereference (CVE-ID: CVE-2026-99072)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service through a kernel crash.

The vulnerability exists due to a NULL pointer dereference in IPv4 route notification sizing when a nexthop group shrinks during asynchronous hardware flag notification processing. A local privileged user can trigger replacement of a nexthop group with fewer paths while fib_nlmsg_size() iterates over it, causing fib_info_nhc() to return NULL that fib_nexthop_nlmsg_size() dereferences, to cause a denial of service.

370) NULL pointer dereference (CVE-ID: CVE-2026-99073)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to a NULL pointer dereference in fib_dump_info_fnhe() when an IPv4 forwarding information base dump runs concurrently with nexthop group replacement. A local privileged user can replace a nexthop group with fewer paths during a dump, causing fib_info_nhc() to return NULL that is subsequently dereferenced through nhc_flags, to cause a denial of service.

371) NULL pointer dereference (CVE-ID: CVE-2026-99074)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering a kernel NULL pointer dereference.

The vulnerability exists due to a NULL pointer dereference in the IPv4 PMTU update path in net/ipv4/route.c when a nexthop group shrinks during path iteration. A local user can replace a nexthop group concurrently with PMTU updates so that fib_info_nhc() returns NULL for a previously accepted index, causing update_or_create_fnhe() to dereference it and crash the kernel.

Nexthop group replacement requires CAP_NET_ADMIN in the network namespace. Where unprivileged user namespaces are permitted, this capability can be obtained in a new user and network namespace.

372) Improper update of reference count (CVE-ID: CVE-2026-99075)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause kernel memory to remain allocated unnecessarily, potentially leading to a denial of service through resource exhaustion.

The vulnerability exists due to improper reference count update handling in the Rust Binder Node::cancel() and NodeWrapper::cancel() methods when a thread exits through BINDER_THREAD_EXIT with a pending node reference count increment. A local user can trigger thread exit while such an update is pending to cause the update to be discarded, leaving node delivery and count states desynchronized and preventing affected nodes from being freed after all external references are dropped.

373) Observable discrepancy (CVE-ID: CVE-2026-99076)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to discover the ephemeral port used by a connected UDP socket.

The vulnerability exists due to an observable discrepancy in IPv6 exception cache updates in the Linux kernel's UDP error handling when locally delivered ICMPv6 Packet Too Big or Redirect messages quote a UDP packet. A remote attacker can send crafted messages containing guessed UDP source ports and observe whether an exception is created in the cache to identify the port associated with an existing connected UDP socket.

374) Observable discrepancy (CVE-ID: CVE-2026-99077)

CWE-ID: CWE-203 - Observable discrepancy

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to discover the ephemeral port used by a connected UDP socket through a cache side channel.

The vulnerability exists due to an observable discrepancy in IPv4 UDP error handling in the Linux kernel when processing locally delivered ICMP Fragmentation Needed or Redirect messages that quote UDP packets. A remote attacker can send crafted ICMP messages containing guessed UDP ports and observe changes in the FIB nexthop exception (FNHE) cache to distinguish packets matching an existing socket and discover its ephemeral port.

375) Double free (CVE-ID: CVE-2026-99078)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service through kernel memory corruption.

The vulnerability exists due to a double free in the mlx5e AF_XDP receive-buffer handling code when retrying an MPWQE refill after an allocation failure on a striding receive queue. A local user can exercise this failure-and-retry path to cause xsk_buff_free() to release buffers through stale pointers after the frames have returned to the XSK pool and been reallocated, potentially corrupting kernel memory and causing a denial of service.

376) Double free (CVE-ID: CVE-2026-99079)

CWE-ID: CWE-415 - Double Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disrupt packet processing and potentially corrupt packet data.

The vulnerability exists due to a double free in the mlx5e driver's AF_XDP receive-buffer handling when an XDP redirect encounters a full socket RX ring and a subsequent batched refill of a legacy cyclic receive queue succeeds only partially. A remote attacker can send network traffic that triggers these conditions to cause a refill retry to release a live buffer through a stale pointer and publish the same UMEM frame twice, disrupting packet processing and potentially corrupting packet data.

377) Memory leak (CVE-ID: CVE-2026-99080)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to exhaust kernel memory and potentially cause a denial of service.

The vulnerability exists due to a memory leak involving xarray nodes in filesystem inode cleanup when handling madvise operations. A local user can invoke madvise to trigger xarray node leaks, potentially exhausting kernel memory and causing a denial of service.

378) Out-of-bounds read (CVE-ID: CVE-2026-99081)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through network transmit queue timeouts.

The vulnerability exists due to an out-of-bounds read in the Linux kernel bnxt_en driver's bnxt_start_xmit() function when transmitting small packets whose padded length exceeds their DMA mapping length. A local user can trigger transmission of small packets with data positioned near a page boundary to cause the NIC to read beyond the DMA-mapped region, triggering IOMMU faults and transmit queue timeouts.

379) Use of Uninitialized Variable (CVE-ID: CVE-2026-99088)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a harmless kernel debug warning.

The vulnerability exists due to use of an uninitialized transport-header offset in the Linux kernel Open vSwitch update_ipv6_checksum() function when rewriting IPv6 addresses in non-first IPv6 fragments. A local user can submit a non-first IPv6 fragment for address rewriting to trigger the warning.

The warning occurs with CONFIG_DEBUG_NET=y.

380) Improper update of reference count (CVE-ID: CVE-2026-99089)

CWE-ID: CWE-911 - Improper Update of Reference Count

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger kernel warnings and potentially disrupt audio device operation.

The vulnerability exists due to improper clock reference counting in the Samsung I2S driver when suspending a device whose operating clock was not enabled during probing. A local user can trigger runtime power-management suspension to cause an unmatched clock disable, producing a kernel warning and potentially disrupting audio device operation.

381) Missing Synchronization (CVE-ID: CVE-2026-99090)

CWE-ID: CWE-820 - Missing Synchronization

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning and set the TAINT_WARN flag during GPU recovery on systems with lockdep enabled.

The vulnerability exists due to missing synchronization in the amdgpu_get_vblank_counter_kms() callback when reading display registers and scanout position during GPU reset. A local user can cause vblank counter reads to overlap GPU recovery to trigger the lockdep assertion in amdgpu_device_skip_hw_access() and set TAINT_WARN when lockdep is enabled.

382) Return of Wrong Status Code (CVE-ID: CVE-2026-99091)

CWE-ID: CWE-393 - Return of Wrong Status Code

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service in Bluetooth management clients that mishandle incorrectly reported command success.

The vulnerability exists due to incorrect status propagation in the Linux kernel Bluetooth management function cmd_complete_rsp() when pending commands are flushed during adapter power-off or removal. A local user can trigger these conditions while a command without a completion callback is pending to cause the socket pointer's first byte to be returned as the command status instead of the intended error status. An incorrect success response with no parameters can crash affected clients, as observed with bluetoothd 5.72 handling a pending Start Discovery command.

383) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-99092)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause BPF just-in-time compilation to fail on affected RISC-V systems.

The vulnerability exists due to incorrect configuration-dependent control flow in the RISC-V patch_map() function when copying BPF instructions into read-only executable memory with CONFIG_STRICT_MODULE_RWX disabled. A local user can trigger BPF just-in-time compilation to cause instruction copying to fail because a temporary writable mapping is not created, leaving the BPF program un-JITed.

Builds without MMU support are unaffected.

384) NULL pointer dereference (CVE-ID: CVE-2026-99093)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service by triggering a kernel panic during boot.

The vulnerability exists due to a null pointer dereference in pagetable_free_kernel() when boot-time function tracing triggers deferred kernel page table freeing before workqueue initialization. A local privileged user can configure boot-time tracing with ftrace=function ftrace_filter=pud_free_pmd_page to trigger work submission through the still-null system_percpu_wq pointer and cause a kernel panic.

385) Off-by-one (CVE-ID: CVE-2026-99094)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause out-of-bounds kernel memory access, potentially resulting in a denial of service.

The vulnerability exists due to an off-by-one bounds check in the Intel Bluetooth PCIe driver's transmit processing when accessing the TFD and data buffer arrays. A local user can potentially trigger transmit processing with tfd_index equal to txq->count to access memory past the end of both arrays and cause a kernel crash.

386) Use-after-free (CVE-ID: CVE-2026-99095)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel VC4 V3D driver when pending timer and work callbacks execute during device teardown. A local user can exercise GPU job processing that leaves callbacks pending at V3D unbind to potentially trigger access to freed device memory and cause a denial of service.

387) Incorrect authorization (CVE-ID: CVE-2026-99096)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass task-level io_uring registration restrictions.

The vulnerability exists due to improper authorization in __io_uring_register() when processing registration operations on disabled rings with inherited task restrictions. A local user can create a ring with IORING_SETUP_R_DISABLED, issue otherwise prohibited registration opcodes, and enable the ring with IORING_REGISTER_ENABLE_RINGS to bypass the inherited restrictions.

388) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-99097)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service through a kernel panic.

The vulnerability exists due to improper validation of a requested allocation size in tee_dyn_shm_alloc_helper() when handling shared memory allocation requests with a zero size. A local user can submit TEE_IOC_SHM_ALLOC with the size field of struct tee_ioctl_shm_alloc_data set to 0 to trigger an allocator warning and cause a denial of service.

The allocator warning terminates boot on kernels configured with panic_on_warn.

389) Stack-based buffer overflow (CVE-ID: CVE-2026-99098)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in dm_integrity_check and dm_integrity_inline_recheck when computing block checksums in inline mode. A local privileged user can configure a tag size larger than HASH_MAX_DIGESTSIZE and trigger a read to cause checksum padding to overflow the on-stack digest buffer and cause a denial of service.

With CONFIG_STACKPROTECTOR enabled, the kernel panics in dm_integrity_check on the first read.

390) Protection mechanism failure (CVE-ID: CVE-2026-99099)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially access memory through stale address translations that should have been invalidated.

The vulnerability exists due to incomplete invalidation of translation lookaside buffer entries in the Linux kernel's AMD x86 TLB handling when executing an INVLPGB/TLBSYNC instruction pair. A local user can potentially exploit retained address translations to access memory using mappings that should no longer be valid.

391) Improper input validation (CVE-ID: CVE-2026-99999)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt IPv4 packet headers and potentially compromise system confidentiality, integrity, and availability.

The vulnerability exists due to improper validation of the checksum start offset in the Linux kernel IPv4 checksum-completion paths when processing packets with invalid checksum metadata. A remote attacker can introduce a packet whose checksum start offset precedes the end of its IPv4 header into an affected processing path to cause skb_checksum_help to corrupt the network header, potentially compromising system confidentiality, integrity, and availability.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-9018-1