SB2026111401 - Debian update for linux
Published: November 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 44 vulnerabilities.
1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-99172)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to exhaust kernel resources and potentially cause a denial of service.
The vulnerability exists due to improper release of long-term mount resources in create_ipc_ns() when IPC namespace initialization fails after creating the mqueue mount. A local user can trigger affected initialization failure paths to leak mqueue mounts and their superblocks, potentially exhausting kernel resources and causing a denial of service.
2) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98996)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause mounts that are still in use to be detached, potentially disrupting filesystem access.
The vulnerability exists due to incomplete reference checks in the Linux kernel's propagate_mount_busy() function in fs/pnode.c when evaluating mounts affected by synchronous unmount propagation. A local privileged user can arrange nested copies of a shared mount tree inside a container and retain an open file descriptor to a copied tree to cause a subsequent host unmount to detach that tree despite its outstanding reference.
3) Stack-based buffer overflow (CVE-ID: CVE-2026-99021)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to corrupt kernel memory, potentially causing a denial of service.
The vulnerability exists due to a stack-based buffer overflow in of_regulator_bulk_get_all() in the Linux kernel regulator subsystem when copying device-tree supply names into a fixed 64-byte stack buffer without bounding the copy to the buffer size. A local privileged user can provide an excessively long supply name, if able to influence the device-tree properties processed by this function, to overwrite stack memory and potentially cause a kernel crash.
4) Access of Uninitialized Pointer (CVE-ID: CVE-2026-99021)
CWE-ID: CWE-824 - Access of Uninitialized Pointer
CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to potentially cause a denial of service through a kernel crash.
The vulnerability exists due to an uninitialized pointer in the Linux kernel regulator subsystem when regulator_bulk_enable() reports a supply-enable failure using an array returned by of_regulator_bulk_get_all(). A local privileged user can trigger this failure path, if able to influence the affected regulator operations, to potentially cause a kernel crash when the uninitialized supply-name pointer is dereferenced.
5) Memory leak (CVE-ID: CVE-2026-99026)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to exhaust socket write-memory resources and potentially cause a denial of service.
The vulnerability exists due to a memory leak in the Linux kernel team driver's bc_transmit() function when handling broadcast transmissions with no transmit-capable port. A local user can send AF_PACKET traffic through an affected team interface to retain unconsumed socket buffers and their socket write-memory charges, potentially exhausting resources and disrupting further transmissions.
A transmit-enabled port whose link is down keeps the broadcast transmit operation installed.
6) Observable discrepancy (CVE-ID: CVE-2026-99076)
CWE-ID: CWE-203 - Observable discrepancy
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to discover the ephemeral port used by a connected UDP socket.
The vulnerability exists due to an observable discrepancy in IPv6 exception cache updates in the Linux kernel's UDP error handling when locally delivered ICMPv6 Packet Too Big or Redirect messages quote a UDP packet. A remote attacker can send crafted messages containing guessed UDP source ports and observe whether an exception is created in the cache to identify the port associated with an existing connected UDP socket.
7) NULL pointer dereference (CVE-ID: CVE-2026-99086)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause a denial of service.
The vulnerability exists due to insufficient validation of superblock geometry in dm_integrity_resume() when reloading the superblock after a device suspension. A local privileged user can increase log2_sectors_per_block on the underlying device while the dm-integrity device is suspended to make journal indexing exceed the allocated journal structures after resume, triggering a 512-byte write through lowmem_page_address(NULL) and causing a kernel crash.
8) NULL pointer dereference (CVE-ID: CVE-2026-99087)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause a denial of service by crashing the kernel.
The vulnerability exists due to a null pointer dereference in the Linux kernel's dm_integrity_resume function when activating a dm-integrity device in 'R' mode with the SB_FLAG_DIRTY_BITMAP flag set. A local privileged user can activate a device under these conditions to trigger an attempt to read the journal containing the bitmap and cause a kernel crash.
9) Heap-based buffer overflow (CVE-ID: CVE-2026-99109)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service through kernel memory corruption.
The vulnerability exists due to a heap-based buffer overflow in the Linux kernel SMB client's CIFSSMBSetEA() function when processing extended attribute values on an SMB1 mount. A local user can invoke setxattr() with a specially crafted attribute name and value to write beyond the allocated request buffer and potentially crash the kernel.
10) Origin validation error (CVE-ID: CVE-2026-99122)
CWE-ID: CWE-346 - Origin Validation Error
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to reset VMCI socket connections and cause a denial of service.
The vulnerability exists due to missing packet source validation in the Linux kernel VMCI vsock receive paths when a destination-only lookup selects a non-listening socket without verifying that the packet originated from its stored peer. A local user can send a crafted RST packet from a different VMCI context to reset a socket in the TCP_SYN_SENT state.
11) Improper input validation (CVE-ID: CVE-2026-99146)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to write to MMIO addresses outside the intended DMC firmware program range, potentially disrupting graphics operation.
The vulnerability exists due to missing firmware load address validation in the Linux kernel i915 DMC firmware loader when processing firmware with header version 3. A local privileged user can supply firmware with a crafted start_mmioaddr value to direct firmware loading writes outside the valid program address range for the target DMC.
12) Memory leak (CVE-ID: CVE-2026-98989)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to exhaust kernel memory and cause a denial of service.
The vulnerability exists due to insufficient checks for mount namespace reference cycles in do_loopback() in fs/namespace.c when recursively bind-mounting a source from another mount namespace. A local user can stack mount namespace file descriptors from an older mount namespace and repeatedly perform recursive bind mounts to create self-referencing namespaces, leaking the namespaces and their mounts until memory is exhausted.
13) Use-after-free (CVE-ID: CVE-2026-99270)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially cause a denial of service through a kernel use-after-free.
The vulnerability exists due to use-after-free in reqsk_timer_handler() when TCP socket migration fails at inet_ehash_insert() and a newly allocated request socket is freed without stopping its timer. A remote attacker can trigger the affected TCP socket migration failure to potentially cause a kernel crash when the timer accesses the freed request socket.
14) Use-after-free (CVE-ID: CVE-2026-99271)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause a denial of service by triggering a read from freed kernel memory.
The vulnerability exists due to a use-after-free in the Linux kernel ALSA Line6 USB audio driver when playback accesses a capture buffer after all capture streams have been closed. A local user can trigger playback, such as through the impulse test signal volume control, after the capture buffer is released to cause submit_audio_out_urb() to dereference the stale prev_fbuf pointer, potentially causing a denial of service.
15) Out-of-bounds write (CVE-ID: CVE-2026-99273)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to corrupt kernel memory, potentially causing a denial of service.
The vulnerability exists due to an out-of-bounds write in the Linux kernel ksmbd get_file_stream_info() function when generating stream information without reserving space for a terminating UTF-16 unit. A remote user can trigger processing of a stream entry that exactly fills the 448-byte response buffer to cause a two-byte write past the allocation, potentially causing a denial of service.
16) Out-of-bounds read (CVE-ID: CVE-2026-99274)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service in the Linux kernel.
The vulnerability exists due to an out-of-bounds read in smb3_fiemap() when processing an empty, truncated allocated-range response from an SMB2 server. A remote attacker can return STATUS_BUFFER_OVERFLOW with OutputCount == 0 in response to FSCTL_QUERY_ALLOCATED_RANGES to trigger a read before a NULL response buffer and a kernel crash when an FS_IOC_FIEMAP ioctl is issued on the mounted share.
17) Missing Authorization (CVE-ID: CVE-2026-99281)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain unauthorized access to TUN/TAP network devices.
The vulnerability exists due to a missing capability check in the Linux kernel TUN/TAP device attachment logic when neither an owner nor a group is assigned to a device. A local user can open an accessible /dev/net/tun device node and attach to an existing ownerless and groupless device without CAP_NET_ADMIN to gain unauthorized access to its packet interface.
18) Use-after-free (CVE-ID: CVE-2026-99282)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service through access to freed kernel memory.
The vulnerability exists due to use-after-free in the Linux kernel's teql_master_xmit() function when a slave consumes and frees a packet but returns NET_XMIT_DROP rather than NETDEV_TX_OK. A local user can send a packet through a configured TEQL device with a VLAN slave whose lower queueing discipline drops the packet to trigger further access to the freed packet buffer, potentially causing a kernel crash.
19) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-99283)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service by prematurely expiring connection-tracking entries for established TCP connections.
The vulnerability exists due to improper control of connection-tracking entry lifetimes in the Linux kernel netfilter TCP connection-tracking component when processing RST packets that do not close an established connection. A remote attacker can send successive in-window RST packets with non-exact sequence numbers to force a 10-second timeout while per-socket challenge ACK rate limiting suppresses a subsequent response, allowing the connection-tracking entry to expire while both TCP endpoints remain established and potentially disrupting the connection.
20) Race condition (CVE-ID: CVE-2026-99286)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause a denial of service by triggering invalid memory access in the Linux kernel.
The vulnerability exists due to a race condition in Xen netback connection failure cleanup when queue statistics are read concurrently with queue deallocation. A local user can potentially trigger overlapping connection failure cleanup and statistics collection to cause statistics readers to access freed queue memory, potentially crashing the kernel.
21) Double free (CVE-ID: CVE-2026-99287)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause a denial of service.
The vulnerability exists due to a double-free condition in the Linux kernel xen-netback driver when cleaning up a failed frontend data-ring mapping operation. A local user can trigger a mapping failure after a ring is already mapped to potentially cause a kernel crash through repeated unmapping of the same ring memory.
22) NULL pointer dereference (CVE-ID: CVE-2026-99288)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service by triggering a kernel NULL pointer dereference and panic.
The vulnerability exists due to a race condition leading to a null pointer dereference in the Linux kernel TCP established-socket lookup functions __inet_lookup_established() and __inet6_lookup_established() when processing TCP traffic concurrently with socket memory reuse. A remote attacker can send TCP traffic that triggers reuse of a socket address with the same connection tuple, causing a lookup to return an unhashed request socket and subsequently dereference its null listener pointer to cause a denial of service.
23) Race condition (CVE-ID: CVE-2026-98682)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to corrupt file data on an SMB share.
The vulnerability exists due to a race condition in the Linux kernel SMB client's cifs_file_copychunk_range() function and the clone path of cifs_remap_file_range() when performing server-side copy or clone operations with outstanding destination writes. A local user can initiate these operations while asynchronous destination writeback is pending to cause stale data to overwrite the newly copied or cloned data, corrupting the destination file.
24) Out-of-bounds read (CVE-ID: CVE-2026-92499)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to trigger an out-of-bounds read.
The vulnerability exists due to improper validation of directory entry offsets in ext4_readdir() when resuming directory reads from an invalid position in a corrupted directory. A local user can invoke directory reads that resume from an invalid position in a corrupted directory to trigger an out-of-bounds read.
The minimum safe directory entry length differs for encrypted, casefolded, and metadata-checksummed directories.
25) Integer underflow (CVE-ID: CVE-2026-98176)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to produce an incorrect EOP ring size field value.
The vulnerability exists due to integer underflow in the drm/amdkfd update_mqd() functions when calculating the EOP ring size field using an ffs() result of zero or one. A local user can trigger the affected calculation to produce an incorrect EOP ring size field value.
The advisory describes a theoretical condition: in practice, the ring buffer size cannot be less than 4096 bytes. It does not establish a reachable exploitation scenario.
26) Integer underflow (CVE-ID: CVE-2026-98177)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause an incorrect EOP ring size calculation.
The vulnerability exists due to integer underflow in the AMD KFD EOP ring size calculation when subtracting one from an order_base_2 result of zero. A local user can potentially trigger this arithmetic condition to cause an incorrect EOP ring size calculation.
The advisory describes this condition as theoretical because the ring buffer size cannot be less than 4096 bytes in practice.
27) Use-after-free (CVE-ID: CVE-2026-98180)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to read freed kernel memory.
The vulnerability exists due to use-after-free in the DRM MSM driver's embedded GPU schedulers when retrieving a fence timeline name after the containing ringbuffer or virtual memory object has been freed. A local user can query a finished, exported fence through SYNC_IOC_FILE_INFO to read freed kernel memory.
The affected fences include submit out-fences and VM_BIND fences exported to userspace through sync_file or drm_syncobj.
28) Improper synchronization (CVE-ID: CVE-2026-98228)
CWE-ID: CWE-662 - Improper Synchronization
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to insufficient memory ordering in the MIPS arch_cmpxchg() implementation when executing lld/scd loops. A local user can stress an anonymous pipe with concurrent read and write operations to cause a denial of service.
The issue occurs on I6500 CPU cores, where lld and scd instructions provide no ordering guarantees. The reported failure occurred on a Mobile EyeQ5 MP5 evaluation board.
29) Division by zero (CVE-ID: CVE-2026-98408)
CWE-ID: CWE-369 - Divide By Zero
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to division by zero in the rzv2h_wdt_probe() function of the RZ/V2H watchdog driver when initializing the watchdog with a zero clock rate. A local user can trigger the affected initialization path under this condition to cause a denial of service.
30) Improper resource shutdown or release (CVE-ID: CVE-2026-98439)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service by preventing an SMB connection from closing.
The vulnerability exists due to improper resource shutdown in the Linux kernel SMB server when closing a connection with active asynchronous requests. A remote user can initiate an asynchronous request that remains pending and disconnect to cause connection teardown to stall while the server waits for the request to finish.
31) Race condition (CVE-ID: CVE-2026-98449)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause incorrect SMB credit accounting, potentially disrupting SMB client operation.
The vulnerability exists due to a race condition in the Linux kernel SMB client's compound_send_recv() function when handling a compound request send failure during reconnection. A local user can trigger a socket send failure during a compound request to leave pending request entries accessible to reconnect callbacks, causing both the callbacks and the send-error path to return the same credits and decrement the in_flight counter twice.
32) Improper access control (CVE-ID: CVE-2026-98466)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to potentially access hypervisor stack memory from the host, compromising isolation between the host and hypervisor.
The vulnerability exists due to incomplete memory ownership enforcement in the arm64 KVM fix_host_ownership() function when establishing host stage-2 memory ownership. A local privileged user can potentially access hypervisor stack pages that remain accessible through the host stage-2 mappings because the ownership walk covers only linear-map aliases and omits the per-CPU hypervisor stacks in the private virtual address range.
33) Missing initialization of resource (CVE-ID: CVE-2026-98674)
CWE-ID: CWE-909 - Missing initialization of resource
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially cause a denial of service by triggering kernel operations that use an uninitialized mutex.
The vulnerability exists due to missing initialization of the state mutex in the Linux kernel ADI AXI ADC driver when accessing ADC registers. A local user can trigger affected register access paths to potentially disrupt kernel operation and cause a denial of service.
34) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89866)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper runtime power-state handling in the Wave5 VPU decoder EOS handling when setting the EOS flag while the device is runtime suspended. A local user can issue a V4L2 stop command or stream-off operation to cause a denial of service.
35) Race condition (CVE-ID: CVE-2026-98683)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to corrupt file contents by causing stale data to reappear in a range that was zeroed.
The vulnerability exists due to improper synchronization of dirty data writeback in the Linux kernel SMB client's smb3_zero_range() function when zeroing an interior file range that does not reach the end of the file. A local user can trigger zero-range operations on a file with overlapping dirty cached data, allowing subsequent writeback to overwrite the zeroed range on the server with stale data.
36) Improper synchronization (CVE-ID: CVE-2026-98684)
CWE-ID: CWE-662 - Improper Synchronization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to corrupt file contents on an SMB share by causing recently written data to be overwritten with zeroes.
The vulnerability exists due to improper synchronization of written data and allocated-range queries in the Linux kernel SMB client's smb3_simple_fallocate_range() function when emulating mode 0 or FALLOC_FL_KEEP_SIZE allocation for small interior ranges on Windows servers. A local user can perform writes followed by affected allocation operations on an accessible file to cause an incoherent FSCTL_QUERY_ALLOCATED_RANGES response to identify live data as unallocated holes, resulting in that data being overwritten with zeroes.
37) Incomplete cleanup (CVE-ID: CVE-2026-98685)
CWE-ID: CWE-459 - Incomplete cleanup
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to corrupt file content by making stale page-cache data visible after a file is extended.
The vulnerability exists due to incomplete page-cache invalidation in the Linux kernel SMB client's cifs_remap_file_range() function when a clone-range operation extends a file beyond its previous end. A local user can dirty data past the end of a file through a memory mapping and extend the file through a clone-range operation to expose that data as file content because the cached folio straddling the previous end is not discarded.
38) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98714)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause incorrect virtual machine control-state handling, potentially disrupting subsequent guest execution.
The vulnerability exists due to improper handling of exceptional conditions in the Linux kernel KVM SVM svm_vcpu_run() function when a VMRUN instruction fails. A local user can exercise virtual machine execution paths that encounter this failure to cause control fields to be cleared or marked clean even though the processor may not have performed the requested operations.
39) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-98715)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 7.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to potentially bypass memory isolation and access or modify memory through stale address translations.
The vulnerability exists due to improper invalidation of cached address translations in the Linux kernel KVM SVM component when a VMRUN instruction fails. A local user can exploit a dropped pending TLB flush to potentially access or modify memory through stale translations, including translations retained when an address space identifier (ASID) is reused.
40) NULL pointer dereference (CVE-ID: CVE-2026-98786)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service through a kernel NULL pointer dereference.
The vulnerability exists due to unchecked NULL pointer dereferences in the AMD display driver's dm_dp_mst_is_port_support_mode() and get_conv_frl_bw() functions when mode validation races with DisplayPort multi-stream transport (MST) unplug handling. A local user can trigger overlapping mode validation and MST unplug processing to potentially crash the kernel when either function accesses an asynchronously cleared dc_sink pointer.
41) Uncontrolled Recursion (CVE-ID: CVE-2026-98853)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service by exhausting the kernel stack.
The vulnerability exists due to uncontrolled recursion in the Linux kernel's inet_gso_segment() and ipv6_gso_segment() handlers when processing deeply nested IP-in-IP packets during generic segmentation offload. A local user can supply packets with deeply nested IP headers for segmentation to exhaust the kernel stack, potentially causing a system crash.
42) Expired pointer dereference (CVE-ID: CVE-2026-98863)
CWE-ID: CWE-825 - Expired pointer dereference
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to access memory through stale mappings, potentially disclosing or corrupting memory.
The vulnerability exists due to reuse of stale page frame numbers in the Linux kernel's x86 KVM nested virtualization code when resuming a virtual CPU after nested-state page retrieval fails. A local user can re-run a virtual CPU whose vmcs02 retains page frame numbers from a previous L2 run to cause L2 to execute with stale, unpinned memory mappings, potentially disclosing or corrupting memory.
43) Improper initialization (CVE-ID: CVE-2026-98920)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to trigger kernel warnings and cause memory allocations to be omitted from allocation profiling records.
The vulnerability exists due to improper initialization of allocation tags in the Linux kernel netfs allocation paths when processing file operations that directly invoke mempool allocation callbacks. A local user can read files on a CIFS mount to exercise allocations that bypass alloc_hooks(), leaving current->alloc_tag unset and causing allocation profiling omissions and kernel warnings.
The allocation and free warnings occur with CONFIG_MEM_ALLOC_PROFILING_DEBUG=y.
44) Incorrect authorization (CVE-ID: CVE-2026-98978)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose files and directories concealed by locked mounts.
The vulnerability exists due to improper enforcement of mount locking in shrink_submount() in fs/namespace.c when reclaiming shrinkable mounts during unmount operations. A local user can place a shrinkable mount beneath a locked mount using MOVE_MOUNT_BENEATH in a user namespace they own, then unmount an unlocked ancestor to expose the covered directory and read otherwise hidden files.
Remediation
Install update from vendor's website.