Linux Kernel: Twelve Vulnerabilities Disclosed in Single Batch on October 26, 2026
Twelve vulnerabilities affecting the Linux kernel were disclosed on October 26, 2026, spanning CPU errata, graphics, networking, and memory management subsystems.
Key findings
- Twelve Linux kernel vulnerabilities disclosed on October 26, 2026, affecting diverse subsystems.
- Fixes address CPU errata, driver issues, core kernel functions, and networking components.
- Vulnerabilities range from buffer overflows and bounds checks to memory management and hardware-specific errata.
- Patching is available through updated Linux kernel versions; users should consult distribution advisories.
On October 26, 2026, a batch of twelve vulnerabilities affecting the Linux kernel was disclosed. These vulnerabilities span various subsystems, including CPU errata, device mapping, I/O, graphics, Bluetooth, memory management, and networking. The disclosures highlight the ongoing need for diligent patching and security auditing within the kernel's complex architecture.
Several vulnerabilities address specific hardware or driver issues. CVE-2026-99099 resolves an AMD TLBI erratum where the processor might fail to invalidate a TLB entry, with a software workaround applied when a microcode fix is unavailable. CVE-2026-99094 fixes a TX descriptor bounds check in the Bluetooth btintel_pcie driver, preventing an out-of-bounds access. In the graphics stack, CVE-2026-99095 addresses the need to drain the hangcheck timer and works on V3D unbind in the drm/vc4 driver, while CVE-2026-99090 serializes vblank counter reads against GPU resets in the drm/amdgpu driver to prevent race conditions. CVE-2026-99089 ensures the op_clk is enabled during probe in the ASoC: samsung: i2s driver to correctly balance runtime power management.
Other issues touch upon core kernel functionalities. CVE-2026-99098 fixes a buffer overflow in dm-integrity when operating in inline mode with large tag sizes. CVE-2026-99097 addresses a security gap in tee: shm by rejecting zero-sized allocations in tee_dyn_shm_alloc_helper(), preventing potential issues with page allocation. CVE-2026-99096 prevents disabled I/O rings from being exempted from task restrictions in io_uring/register. Memory management is touched by CVE-2026-99093, which prevents scheduling deferred kernel page table freeing while booting, avoiding a potential panic. CVE-2026-99092 fixes the handling of BPF-JIT execution memory addresses in the RISC-V architecture. Finally, CVE-2026-99088 validates transport header presence in net: openvswitch when rewriting IPv6 addresses on fragments, preventing issues with checksum updates.
The batch also includes a fix for Bluetooth management functionality, with CVE-2026-99091 addressing the status of pending commands flushed on power off in the Bluetooth: MGMT subsystem.
These fixes are integrated into the Linux kernel, and users are advised to update to the latest stable kernel versions to incorporate these security enhancements. The broad range of affected subsystems underscores the importance of timely kernel updates to mitigate potential security risks across diverse hardware and software configurations.
This disclosure event, with all CVEs published simultaneously, emphasizes the coordinated nature of security vulnerability management within the Linux kernel community. Users should consult their distribution's advisories for specific patching instructions and timelines.
The timely resolution and disclosure of these issues demonstrate the ongoing efforts to maintain the security and stability of the Linux kernel. Staying informed about these updates and applying them promptly is crucial for all users.