VYPR
patchPublished Oct 18, 2026· Updated Oct 19, 2026· 1 source

Linux Kernel: 25 Vulnerabilities Disclosed Together on October 18, 2026

Key findings • 25 Linux kernel vulnerabilities disclosed on October 18, 2026, affecting diverse subsystems. • Issues range from memory management flaws and race conditions to networking and s…

Key findings

  • 25 Linux kernel vulnerabilities disclosed on October 18, 2026, affecting diverse subsystems.
  • Issues range from memory management flaws and race conditions to networking and storage component weaknesses.
  • Vulnerabilities found in dm-pcache, scheduler, networking stack, audit, HID, and more.
  • Patches were released in subsequent kernel versions; users should update promptly.
  • The batch highlights the ongoing security challenges in maintaining a complex operating system kernel.

On October 18, 2026, a batch of 25 vulnerabilities was disclosed in the Linux kernel, spanning various subsystems including storage, scheduling, networking, and more. These vulnerabilities, all disclosed on the same day, highlight potential weaknesses in how the kernel handles memory management, race conditions, and data integrity across different modules. The sheer number and diversity of these issues underscore the complexity of maintaining a secure and robust operating system kernel.

Several vulnerabilities were identified in the dm-pcache and dm-crypt components, related to persistent memory cache handling. CVE-2026-98868 addresses an issue where a forged key number could cause a segment overrun by allowing the writeback and GC workers to read beyond the allocated segment size. Similarly, CVE-2026-98867 corrects a bounds check in cache_key_decode() that could lead to an out-of-bounds subtree pointer when indexing req_key_tree->subtrees[].

The scheduler subsystem is affected by multiple issues. CVE-2026-98866 introduces a sched_cache_grp pointer to task_struct to fix a use-after-free bug in the sched/cache component. CVE-2026-98865 prevents the ops.dequeue() function from running while a DSQ lock is held in sched_ext, addressing a potential race condition when moving tasks between dispatch queues. CVE-2026-98864 adds a check for SCX_OPSS_DISPATCHING before re-enqueuing a task in sched_ext, preventing issues that could arise from incorrect state updates.

Networking components also saw several disclosures. CVE-2026-98856 and CVE-2026-98855 relate to the of/overlay subsystem, concerning the handling of property additions and changeset registration, respectively. CVE-2026-98853 and CVE-2026-98852 address issues in GSO (Generic Segmentation Offload), with one limiting recursive IP-in-IP segmentation to prevent stack exhaustion and the other extending tunnelled packet detection for IPv6. CVE-2026-98857 bounds the growth of LBLCR and LBLC caches in ipvs, preventing excessive memory consumption. CVE-2026-98850 prevents a byte count overflow in the net/packet TX ring. CVE-2026-98849 fixes a socket lifetime issue on netdevice registration failure in pfcp. CVE-2026-98851 ensures that a flowtable reference is dropped on an init error path in netfilter: nft_flow_offload.

Other notable vulnerabilities include:

  • audit: CVE-2026-98862 fixes a use-after-free in kill_rules() when pruning audit trees.
  • HID: CVE-2026-98860 casts a size to ssize_t when checking the hid_bpf_hw_request to correctly handle negative error codes. CVE-2026-98859 prevents the release timer from being re-armed on remove in the HID: multitouch driver.
  • io_uring: CVE-2026-98858 addresses a use-after-free with SQPOLL in the io_uring subsystem.
  • kprobes: CVE-2026-98855 skips disarmed probes when checking for optkprobe overlap.
  • RTC: CVE-2026-98848 assigns .num before accessing .hws in rtc: ac100, and CVE-2026-98847 ensures the IRQ state is initialized before requesting the alarm IRQ in rtc: spear.
  • sctp: CVE-2026-98846 checks for RCV_SHUTDOWN after the sendmsg connect wait to prevent race conditions with ABORT messages.
  • tpm: CVE-2026-98845 disables the TPM on a null key name mismatch to protect against reset attacks.
  • netfs: CVE-2026-98844 clears the post-EOF pagecache when extending a file via write.

These vulnerabilities were patched in subsequent kernel releases. Users are advised to update to the latest stable kernel version to mitigate these risks. The coordinated disclosure of these 25 CVEs on a single day highlights the ongoing efforts to identify and address security flaws within the Linux kernel.

This batch of vulnerabilities was disclosed on October 18, 2026. No specific threat actor or exploitation in the wild was mentioned in the provided details.

The Linux kernel is a foundational component of many operating systems, and vulnerabilities within it can have widespread implications. Prompt patching and staying updated with kernel releases are crucial for maintaining system security. The diverse nature of these flaws suggests a need for continuous vigilance and rigorous testing across all kernel subsystems.

Synthesized by Vypr AI