CVE-2026-98744

A flaw was found in the Linux kernel's MAX98363 audio codec driver. A local user could trigger this vulnerability during audio stream configuration because internal stream parameters are left uninitialized in memory. This issue allows uninitialized values to be processed by the sound subsystem,...

CVE-2026-98743

A flaw was found in the Linux kernel's rt1017 SDCA audio codec driver. The driver fails to initialize stream configuration data before passing it to the sound subsystem, leaving configuration fields populated with uninitialized memory. A local user could exploit this flaw during audio stream...

CVE-2026-98741

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture UA-101 USB audio driver. The driver does not validate that packet sizes and channel numbers match between capture and playback endpoints during device initialization. An attacker who connects a specially crafted USB...

CVE-2026-98740

A flaw was found in the Linux kernel's Altera Error Detection and Correction EDAC driver. Certain setup functions were incorrectly designated as temporary initialization routines that are released from memory after startup. When device registration is deferred or manually re-triggered, the driver...

CVE-2026-98739

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. A local user could exploit this flaw to cause a Denial of Service DoS or potentially escalate privileges. A race condition between concurrent device installation and release operations allows reference counts to be dropped...

CVE-2026-98736

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs during enhanced Synchronous Connection-Oriented SCO link setup due to missing locking when accessing parent connection structures. A local user or adjacent attacker could exploit this timing window by concurrently...

CVE-2026-98735

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition occurs when outgoing network packets are scheduled while the associated communication channel is concurrently closed and freed during connection teardown. A local attacker could exploit this flaw to trigger a...

CVE-2026-98731

A flaw was found in the Linux kernel's Intel Bluetooth PCIe driver. An integer overflow vulnerability exists in the packet reception function when calculating the total length of incoming Bluetooth frames. An adjacent attacker within Bluetooth range could exploit this flaw by transmitting special...

CVE-2026-98732

A flaw was found in the Linux kernel's Intel Bluetooth driver. When processing hardware error events, the driver logs event data as a string without verifying that the received payload is properly null-terminated. A physically proximate attacker or compromised Bluetooth device could exploit this...

kernel: calipso: Don't call calipso functions for AF_INET sk.

In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AFINET sk. syzkaller reported a null-ptr-deref in txoptget. 0 The offset 0x70 was of struct ipv6txoptions in struct ipv6pinfo, so struct ipv6pinfo was NULL there. However, this never...

kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation

A flaw was found in the Linux kernel's DisplayPort DP Multi-Stream Transport MST subsystem. This vulnerability involves multiple buffer overflows within the drmdpsidebandappendpayload function when handling data from connected devices. A physically connected, malicious DP MST device can exploit...

kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap()

A flaw was found in the Linux kernel's perf subsystem. A race condition exists between the perf mmap revival and the last munmap operation. This allows a local unprivileged user to exploit a use-after-free vulnerability, leading to local privilege escalation to root...

kernel: ALSA: hda/cs35l41: Fix firmware load work teardown

A flaw was found in the Linux kernel's ALSA sound driver for the cs35l41 component. This vulnerability occurs because the driver fails to properly remove controls and cancel firmware load work during component unbinding or device removal, especially when firmware autostart is disabled. This can...

kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

A flaw was found in the drm/amdgpu component of the Linux kernel. A use-after-unlock vulnerability exists where a virtual machine VM pointer is dereferenced after its protective lock has been released. This allows the pointer to be modified, potentially leading to memory corruption. An attacker...

kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound

A flaw was found in the drm/vmwgfx component of the Linux kernel. An integer overflow vulnerability exists in the vmwshaderdefine function due to improper validation of user-supplied shader window size and offset. When the offset value is close to its maximum, an unsigned addition can wrap around...

kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS

A flaw was found in the Linux kernel's AMD GPU amdgpu driver. The driver fails to validate the size of Video BIOS VBIOS tables, allowing the calculated entry count to exceed the bounds of an internal array. A local attacker or compromised firmware image could exploit this flaw to trigger an...

kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

A flaw was found in the Linux kernel's Server-Message-Block Direct SMC-D client. A remote attacker can exploit this vulnerability by sending a specially crafted SMC-Dv2 proposal with a Channel Identifier CHID of 0. This malicious proposal can cause a null pointer dereference in the kernel's SMC...

kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5

A flaw was found in the Linux kernel's handling of IPv4 raw sockets. An unprivileged attacker with CAPNETRAW capabilities can craft and inject a malformed IPv4 packet with an invalid Internet Header Length IHL. This can lead to an out-of-bounds memory access when the packet is processed by certai...

kernel: ALSA: seq: close a re-opened queue timer in the destructor

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture sequencer component. An unprivileged local user with access to the sound device can exploit a timing window during the cleanup of a queue timer. This allows the user to re-open a timer that has already been closed,...

kernel: drm/amd/display: set new_stream to NULL after release

A flaw was found in the Linux kernel's drm/amd/display component. Specifically, within the dmupdatecrtcstate function, a stream pointer is released but not subsequently set to NULL. This can lead to a double release of the same pointer if an error occurs later in the process, creating a...