CVE-2026-99087

In the Linux kernel, dm-integrity does not validate the superblock on resume, allowing a user to modify the superblock on the underlying device while the dm-integrity device is suspended. This can cause a mismatch in in-memory structure sizes and an out-of-bounds write past the journal, including a 512-byte write through a NULL pointer. The fix snapshots the validated superblock in the constructor and refuses to resume if the on-disk geometry changed.

A Linux kernel vulnerability was fixed in the sched_ext scheduler that caused a CPU hotplug hang when a dying CPU's tasks remained in the BPF scheduler. Such tasks were still counted on the runqueue, but an inactive CPU no longer called ops.dispatch() and could not pull them back, blocking the hotplug thread and cpu_down() while holding cpu_hotplug_lock. The fix re-enqueues tasks on the offline rq to the local DSQ so balance_push() can move them off.

In the Linux kernel, a flaw was fixed in iterate_dir() where the directory's i_rwsem lock was held during readdir even for immutable directories that are never removed. For the nullfs instance directory (shared across mount namespaces and kernel threads), a malicious reader could hold the lock indefinitely, blocking mkdir, lookups, and mounts for other users. A new FOP_IMMUTABLE flag was added to skip the lock for such directories.

In the Linux kernel, the ksmbd server has a heap out-of-bounds write in krb5_authenticate(). When SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the out_len calculation omits work->next_smb2_rsp_hdr_off, overstating available buffer space and allowing memcpy() to write the AP-REP blob past response_buf. The fix subtracts this value when computing out_len.

A bug was fixed in the Linux kernel KVM on x86 regarding the per-vCPU MMIO cache. The cache was tagged with a memslot generation, but both the fill and validation paths used kvm_memslots(), which unconditionally selects address space 0 even when the vCPU runs in SMM and uses address space 1. As a result, an SMM memslot update could leave an apparently valid entry from the old SMM address space after the vCPU returns to the normal address space, letting a guest force a KVM_EXIT_MMIO for valid RAM.

In the Linux kernel, clear_inode() has an xarray node leak that can be triggered, among other ways, via madvise. Rather than fixing the leaks where they occur, the fix calls xa_destroy(), which has the side effect of cycling the i_pages lock.

In the Linux kernel, the net/mlx5e driver can release a stale XSK buffer during refill retry on a legacy cyclic RQ. When refill succeeds only partially, a WQE left without a replacement retains its old buffer pointer, which may be allocated to another WQE, leading to freeing a live buffer and double-publishing the same UMEM frame. The fix marks the WQE as released immediately after the driver-side free.

In the Linux kernel, the net/mlx5e driver can release a stale XSK buffer during MPWQE refill retry on a striding RQ. When XSK allocation returns -ENOMEM, actual_wq_head is not advanced and a later NAPI poll may call xsk_buff_free() again through stale pointers after frames return to the XSK pool. The fix sets all skip_release_bitmap bits in the error path of mlx5e_xsk_alloc_rx_mpwqe().

A vulnerability in the Linux kernel's IPv4/UDP handling allowed off-path attackers to conduct a side-channel attack on the FIB nexthop exception (FNHE) cache. Previously, an exception was only created if the UDP packet could be matched to an existing socket, enabling discovery of the ephemeral port used by a connected UDP socket. The fix always creates a FNHE before attempting socket matching.

A vulnerability in the Linux kernel's IPv6/UDP handling allowed off-path attackers to conduct a side-channel attack on the exception cache to discover the ephemeral port used by a connected UDP socket. Previously, an exception was only created if the UDP packet could be matched to an existing socket. The fix always creates an exception before attempting socket matching.