CVE-2026-99071

In the Linux kernel, dm-integrity has a NULL pointer dereference when a device with the SB_FLAG_DIRTY_BITMAP flag is activated in 'R' mode. The dm_integrity_resume function attempts to read the journal containing the bitmap, causing a crash. The fix skips writes to the device in 'R' mode during resume.

In the Linux kernel, dm-integrity does not validate the superblock on resume, allowing a user to modify the superblock on the underlying device while the dm-integrity device is suspended. This can cause a mismatch in in-memory structure sizes and an out-of-bounds write past the journal, including a 512-byte write through a NULL pointer. The fix snapshots the validated superblock in the constructor and refuses to resume if the on-disk geometry changed.

A Linux kernel vulnerability was fixed in the sched_ext scheduler that caused a CPU hotplug hang when a dying CPU's tasks remained in the BPF scheduler. Such tasks were still counted on the runqueue, but an inactive CPU no longer called ops.dispatch() and could not pull them back, blocking the hotplug thread and cpu_down() while holding cpu_hotplug_lock. The fix re-enqueues tasks on the offline rq to the local DSQ so balance_push() can move them off.

In the Linux kernel, a flaw was fixed in iterate_dir() where the directory's i_rwsem lock was held during readdir even for immutable directories that are never removed. For the nullfs instance directory (shared across mount namespaces and kernel threads), a malicious reader could hold the lock indefinitely, blocking mkdir, lookups, and mounts for other users. A new FOP_IMMUTABLE flag was added to skip the lock for such directories.

In the Linux kernel, clear_inode() has an xarray node leak that can be triggered, among other ways, via madvise. Rather than fixing the leaks where they occur, the fix calls xa_destroy(), which has the side effect of cycling the i_pages lock.

A vulnerability in the Linux kernel's IPv6/UDP handling allowed off-path attackers to conduct a side-channel attack on the exception cache to discover the ephemeral port used by a connected UDP socket. Previously, an exception was only created if the UDP packet could be matched to an existing socket. The fix always creates an exception before attempting socket matching.

In the Linux kernel, the rust_binder module has a bug in node refcount update on thread exit. When a thread exits via BINDER_THREAD_EXIT, a pending node refcount increment could be dropped because Node::cancel() and NodeWrapper::cancel() were no-ops. This desynchronizes the node's delivery and count state, and userspace may not receive the notification, potentially causing the node to never be freed.

In the Linux kernel IPv4 subsystem, a null-ptr-deref occurs during PMTU update when a nexthop group shrinks. __ip_rt_update_pmtu() iterates over paths, and a concurrent nexthop replacement can cause fib_info_nhc() to return NULL, which is then dereferenced in update_or_create_fnhe(). This requires CAP_NET_ADMIN in the network namespace, but where unprivileged user namespaces are permitted, a local user can obtain it.

In the Linux kernel IPv4 subsystem, a null-ptr-deref occurs during FIB exception dump when a nexthop group shrinks. fib_dump_info_fnhe() uses fib_info_num_path() as the loop bound, then fib_info_nhc() independently reloads nh->nh_grp; if RTM_NEWNEXTHOP replaces the group with fewer paths, fib_info_nhc() returns NULL and the dump dereferences it. The fix stops the walk when the indexed path is absent.

In the Linux kernel IPv4 subsystem, a null-ptr-deref occurs during route notification sizing when a nexthop group shrinks. fib_nlmsg_size() checks fib_info_num_path() before each iteration, then fib_info_nhc() independently reloads nh->nh_grp; if RTM_NEWNEXTHOP replaces the group with fewer paths, fib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences it. The fix stops sizing when the indexed path is absent.