Linux Kernel: 25 Vulnerabilities Patched Across Multiple Subsystems on Sep 24, 2026

Key findings

• 25 Linux kernel vulnerabilities disclosed on September 24, 2026, affecting diverse subsystems.
• Fixes target issues like null pointer dereferences, out-of-bounds access, and error handling flaws.
• Key areas addressed include GFS2, Wi-Fi drivers, Thunderbolt, and DRM components.
• High-severity vulnerabilities (CVSSv3 7.1-8.8) were patched in GFS2, Thunderbolt, and DRM.
• Updates enhance stability and security across a wide range of hardware and kernel functionalities.

On September 24, 2026, a batch of 25 vulnerabilities was disclosed in the Linux kernel, spanning various subsystems including GFS2, Wi-Fi, Thunderbolt, and DRM. These vulnerabilities, all resolved on the same day, range in severity and address issues such as null pointer dereferences, out-of-bounds access, and improper error handling. The disclosures highlight ongoing efforts to secure complex kernel components.

Several vulnerabilities were found in the GFS2 (Global File System 2) component. CVE-2026-97521 addresses a potential issue in gfs2_quota_init() where duplicate quota initialization scans could occur while holding locks, potentially leading to race conditions. CVE-2026-97520 refactors the iterator increment in gfs2_quota_init() to improve clarity and avoid mixing iterator progression with duplicate slot handling.

The Wi-Fi subsystem saw multiple fixes. CVE-2026-97518 resolves an issue where duplicate cipher suite entries could be accepted in wiphy->cipher_suites, causing problems for consumers. CVE-2026-97517 fixes a check for the correct size of the HE operation element in beacons, preventing potential parsing errors. CVE-2026-97516 adds a NULL check for chip->edcca_th in rtw_fw_adaptivity_result() to prevent dereferencing a null pointer on certain chipsets. CVE-2026-97517 addresses a bug where beacons with incorrect HE operation element lengths were not properly rejected. CVE-2026-97511 prevents an out-of-bounds access in monitor mode within the mac80211 component when handling NAN frames. Finally, CVE-2026-97500 adds a length check before parsing PHY status IE in the rtw89 driver to prevent out-of-range access.

The Thunderbolt subsystem also had several related fixes. CVE-2026-97513, a high-severity vulnerability, ensures that an XDomain reference is maintained for the lifetime of a service to prevent use-after-free issues. CVE-2026-97514 addresses a potential leak in __tb_xdomain_response() by releasing a request if tb_cfg_request() fails. CVE-2026-97508, rated high, ensures that tb->root_switch is set to NULL when a domain is stopped, preventing improper request handling.

Other notable fixes include:

• CVE-2026-97509, a high-severity vulnerability in Thunderbolt, ensures XDomain references are maintained for the lifetime of a service.
• CVE-2026-97508, rated high, addresses an issue where tb->root_switch was not set to NULL when a Thunderbolt domain was stopped.
• CVE-2026-97517, a fix in the Wi-Fi subsystem for malformed HE operation elements in beacons.
• CVE-2026-97516, a NULL check in the rtw89 Wi-Fi driver to prevent null pointer dereferences.
• CVE-2026-97515, a fix in the dm1105 media driver to check for errors during DMA memory allocation.
• CVE-2026-97506, a fix in the ixp4xx crypto driver to properly unwind buffer chains on allocation failure.
• CVE-2026-97505, which adds a CAP_SYS_ADMIN check to __resource_resize_store() in the PCI/sysfs component to restrict resizing of BARs.
• CVE-2026-97504, a fix for potential use-after-free and resource leak risks in the lenovo_se10_wdt watchdog driver.
• CVE-2026-97503, addressing buffer overflows when naming interrupt directories in /proc/irq/ for large interrupt numbers.
• CVE-2026-97502, preventing a NULL dereference of host->data in the mmc_davinci_irq() handler.
• CVE-2026-97501, bypassing the pinctrl GPIO layer in mediatek: paris to avoid sleeping in pinctrl_gpio_direction_input/output.
• CVE-2026-97498, ensuring that mqd and fw objects are pinned in the drm/amdgpu/userq component to prevent eviction.
• CVE-2026-97497, a high-severity vulnerability in drm/amdkfd, adds bounds checking for allocate_sdma_queue when a specific SDMA queue ID is provided.

These fixes collectively enhance the stability and security of the Linux kernel across a wide range of hardware and subsystems. Users are advised to update to the latest kernel versions to incorporate these patches. The timely disclosure and resolution of these issues demonstrate the active security maintenance of the Linux kernel.