Linux Kernel: 25 Vulnerabilities Patched in Single-Day Disclosure on October 23, 2026
A batch of 25 vulnerabilities affecting the Linux kernel was disclosed on October 23, 2026, with fixes released simultaneously for issues ranging from NULL pointer dereferences to memory leaks across various subsystems.
Key findings
- 25 Linux kernel vulnerabilities disclosed together on October 23, 2026, affecting diverse subsystems.
- Fixes address critical issues including NULL pointer dereferences, heap overflows, and memory leaks.
- Networking stack vulnerabilities patched include KVM, bnxt_en, mlx5e, and IPv4/IPv6 handling.
- Updates also cover device mapper, file systems, CPU hotplug, and input driver components.
- All disclosed vulnerabilities were patched concurrently, emphasizing the need for prompt kernel updates.
On October 23, 2026, a batch of 25 vulnerabilities was disclosed in the Linux kernel, affecting various subsystems and components. These vulnerabilities, all patched on the same day, range in severity and impact, with some addressing potential crashes, memory leaks, and data corruption issues. The disclosures highlight ongoing efforts to secure the core of the Linux operating system.
Several vulnerabilities touch upon the device mapper (dm) subsystem. CVE-2026-99087 addresses a NULL pointer dereference in dm-integrity when the 'R' flag is used with a dirty bitmap. CVE-2026-99086 improves the validation of the superblock on resume in dm-integrity to prevent potential issues. Additionally, CVE-2026-99063 fixes a bug in the dm ioctl handler that could allow data_start to run past the buffer.
Networking components also saw several fixes. CVE-2026-99082 resolves an issue with the per-vCPU MMIO cache in KVM for x86, ensuring it uses active memslots. CVE-2026-99081 fixes a DMA mapping length issue for padded small packets in the bnxt_en driver, addressing potential IOMMU faults. The net/mlx5e driver has two related fixes: CVE-2026-99079 and CVE-2026-99078, both preventing stale XSK buffer releases on refill retries under different conditions. Furthermore, CVE-2026-99077 and CVE-2026-99076 address issues in IPv4 and IPv6 UDP handling, respectively, ensuring exceptions are created before socket matching. Several other IPv4-related vulnerabilities (CVE-2026-99074, CVE-2026-99073, CVE-2026-99072, CVE-2026-99071) and one IPv6 vulnerability (CVE-2026-99069) deal with route notification sizing and exception handling when nexthop groups change or are replaced, preventing potential races and warnings.
Memory management and integrity are addressed in several other CVEs. CVE-2026-99080 fixes a long-standing, hard-to-hit leak of xarray nodes in the fs subsystem. CVE-2026-99067 resolves a local_root reference leak in the btrfs scrub functionality when warning inodes are processed. CVE-2026-99066 ensures proper SKB header initialization in the can:dev driver. CVE-2026-99068 fixes a memory leakage issue in the ALSA ctxfi component when clearing DAO input mappers.
Other notable fixes include CVE-2026-99085, which addresses a CPU hotplug hang in the sched_ext component when a dying CPU's tasks are in the BPF scheduler. CVE-2026-99084 prevents the inode lock from being taken on an immutable directory during readdir operations. CVE-2026-99083 fixes a heap out-of-bounds write in the ksmbd component's krb5_authenticate() function. CVE-2026-99075 ensures proper rescheduling of node refcount updates on thread exit in rust_binder. CVE-2026-99069 corrects type confusion in the ati_remote2 input driver's device attribute handlers. Finally, CVE-2026-99064 adjusts cached option offsets when removing CIPSO in the cipso module.
These vulnerabilities were patched concurrently, indicating a coordinated release of fixes by the Linux kernel developers. Users are advised to update to the latest kernel versions to incorporate these security enhancements.
Key findings include:
- A large batch of 25 vulnerabilities affecting diverse Linux kernel subsystems were disclosed on October 23, 2026.
- Several fixes address potential crashes and memory leaks in areas like dm-integrity, xarray, and btrfs.
- Networking components, including KVM, bnxt_en, mlx5e, and IPv4/IPv6 handling, received multiple security updates.
- Issues related to CPU hotplug, directory access, and authentication mechanisms were also resolved.
- All disclosed vulnerabilities were patched simultaneously, emphasizing the importance of timely kernel updates.
- The fixes span various components including device mapper, networking, file systems, and input drivers.