These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A race condition vulnerability was found in the Linux kernel's debugobjects implementation. When debug objects are disabled due to an out-of-memory (OOM) situation, a concurrent access can lead to a use-after-free error. This can cause the timer callback function to be invoked with a stale object, resulting in a crash or unexpected behavior. The vulnerability was reported by syzbot and resolved by pluggin [truncated]
The Linux kernel has a vulnerability in the iio core that could potentially expose uninitialized data in debugfs. The issue arises when *ppos is non-zero, causing simple_write_to_buffer() to not initialize the start of buf[]. However, non-zero values for *ppos are not expected to work. The function now tests for non-zero *ppos at the start and returns -EINVAL in such cases.
A vulnerability in the Linux kernel has been resolved. The rndis_query_response() function did not perform a length check on the BufLength and BufOffset variables. This is a defensive concern for systems using the rndis gadget function. The vulnerability affects systems using the rndis gadget function. Linux kernel maintainers and users should review and apply the patch. The technical impact is related to [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-10T12:17:21.207Z and has not been modified since then. The vulnerability relates to data loss when collapsing file THPs in the Linux kernel. Affected systems may experience data loss under specific conditions. The issue arises from the interaction between khugepaged and writable-file openings, leadi [truncated]
The Linux kernel Bluetooth hci_uart module has a vulnerability related to HCI_UART_SENDING bit handling. The bit is not cleared when canceling write_work in hci_uart_close(), potentially blocking future writes when the device is reopened. To verify, defenders should review HCI_UART_SENDING bit handling in Bluetooth hci_uart module, check for HCI_UART_SENDING bit clearance in hci_uart_flush(), and review h [truncated]
A location monitor resource leak was found in the Linux kernel's tsi148 bridge. The tsi148_probe() function allocates a location monitor resource, which is not properly freed in the tsi148_remove() function. This leads to a resource leak on device unbind or module unload. The issue affects Linux kernel developers, administrators, and users who rely on the Linux kernel. The vulnerability has a medium defen [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-10T12:17:20.807Z and has not been modified since then. The Linux kernel ksmbd vulnerability CVE-2026-68083 allows authenticated clients to escape share restrictions via path resolution. The issue is resolved by rooting the create walk at the share like the lookup and rename paths. Vendor patches are [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T22:18:24.697Z and has not been modified since then. The Linux kernel vulnerability, CVE-2026-68480, relates to the Safe-RET mitigation and potential data leakage through speculative execution. An attacker injecting interrupts while the Safe-RET mitigation executes on machines affected by SRSO can [truncated]
A vulnerability has been resolved in the Linux kernel related to KVM (Kernel-based Virtual Machine) and VMX (Virtual Machine Extensions). The issue involves updating CR8 intercepts and grabbing vmcs12 when the vCPU is in guest mode. This change aims to prevent a lockdep assertion failure when updating CR8 intercepts during vCPU creation. The vulnerability was introduced due to improper handling of CR8 int [truncated]
The Linux kernel vulnerability CVE-2026-64603 was patched to prevent recursion in ACPI notify handler, which could lead to duplicate sysfs entry and NULL pointer dereference. This patch protects the ACPI notify handler against recursion, preventing duplicate sysfs entries and NULL pointer dereferences. Linux kernel users and administrators should review the Linux kernel patch notes and official advisories [truncated]
A race condition vulnerability was found in the Linux kernel's iio: adc: spear driver. The issue occurs when the interrupt handler is registered before the completion structure is initialized, leading to a potential kernel panic if an interrupt arrives before initialization. This vulnerability can be triggered by specific hardware interactions and requires careful handling to prevent system instability.
The Linux kernel's ALSA us144mkii module contains a vulnerability due to redundant calls to usb_anchor_urb() in the capture_urb_complete() function. This can lead to a use-after-free error when usb_kill_anchored_urbs() is called, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The vulnerability was published on 2026-08-06T08:16:35.797Z and has not been modified sin [truncated]
A use-after-free vulnerability was found in the Linux kernel's amlogic crypto driver. When meson_allocate_chanlist() fails after partial allocation, it unwinds the allocated chanlist state. However, meson_crypto_probe() then calls meson_free_chanlist() again, causing a double-free. This can lead to a slab-use-after-free error. The bug was first flagged by an experimental analysis tool and was reproduced i [truncated]
A vulnerability was found in the Linux kernel. The bug is in the smb/client and relates to error code handling in the smb2_aead_req_alloc() function. The incorrect casting of a u32 variable *num_sgs to an error pointer could lead to a crash when the invalid error pointer is dereferenced. The issue has been resolved by storing the return value in an int ret variable.
A use-after-free vulnerability was found in the Linux kernel's HID: hid-lenovo-go driver. The `hid_go_cfg_probe` function schedules a delayed work `go_cfg_setup` to run 2 ms later, which dereferences `drvdata.hdev`. However, the `hid_go_cfg_remove` function does not cancel this delayed work, leading to a potential use-after-free error if the device is unbound within the 2 ms scheduling delay.
A Linux kernel vulnerability was resolved, addressing an issue with the usb gadget f_fs where reset_work was not initialized before being used, potentially leading to a warning in __flush_work(). The vulnerability involves the usb gadget f_fs where reset_work is not initialized before being used. This could potentially lead to a warning in __flush_work(). The issue was resolved by initializing reset_work [truncated]
The Linux kernel vulnerability in the btrfs filesystem implementation allows for a NULL pointer dereference when attempting to trim a device that is not writable. This can be exploited by a local attacker to crash the system or potentially execute arbitrary code. The bug was introduced due to a desynchronization between the BTRFS_DEV_STATE_MISSING flag and the device->bdev pointer. A missing device can be [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T08:16:34.497Z and has not been modified since then. The Linux kernel vulnerability was resolved by updating the SVA unbind path in the Intel IOMMU driver. Evidence is based on official CVE and source records. The fix addresses an imbalance in IOPF enablement and disablement for devices without PR [truncated]
A PatchSiren debrief based on the supplied source corpus. The Linux kernel has a vulnerability that triggers a spurious warning when importing a udmabuf into a DRM driver with CONFIG_DMA_API_DEBUG_SG enabled. The warning is caused by overlapping cacheline mappings. The DMA_ATTR_SKIP_CPU_SYNC flag can suppress this check and skip redundant CPU sync.
A vulnerability has been identified in the Linux kernel, specifically in the i2c core. If adapter registration fails, a NULL-pointer dereference occurs due to an uninitialized completion struct. This issue has been resolved. The CVE record was published on 2026-08-06T08:16:34.240Z and has not been modified since then. The vulnerability affects Linux kernel systems, and users should be aware of this issue [truncated]
The CVE-2026-64588 vulnerability is a data race issue in the Linux kernel's fuse-uring subsystem. This problem occurs when the store to fiq->ops is reordered past the store to ring->ready on weakly-ordered architectures, potentially allowing a CPU to see ring->ready as true and dispatch requests through a stale fiq->ops pointer. The fix involves upgrading the store to smp_store_release() and the load in f [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T08:16:33.970Z and has not been modified since then. The Linux kernel vulnerability allows for potential interrupt delivery issues during probe teardown. To address this, the device should be put into a quiescent state before requesting the IRQ. This change keeps the hardware-focused and minimal, [truncated]
A vulnerability was found in the Linux kernel's CAN subsystem, specifically in the esd_usb driver. The issue occurs during device disconnection, where the driver frees the CAN netdevs before killing the anchored URBs. This can lead to a use-after-free vulnerability, as the driver attempts to access the freed memory. To fix this, the teardown process has been reordered to kill the anchored URBs before free [truncated]
A use-after-free vulnerability was found in the Linux kernel's f_midi driver. The vulnerability occurs when the f_midi driver fails to cancel a pending work item before freeing the midi object, allowing the work item to dereference the freed object. This issue can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition. The f_midi driver embeds a work item whose hand [truncated]
The Broadcom BDC UDC driver in the Linux kernel had a vulnerability where the IRQ handler remained deliverable after bdc_remove() returned, causing potential NULL-deref or use-after-free. This issue was resolved by replacing devm_request_irq() with request_irq() and adding an explicit free_irq() in bdc_remove(). Users of the Linux kernel, particularly those using the Broadcom BDC UDC driver, should be awa [truncated]
A use-after-free vulnerability was found in the Linux kernel's RDMA/rxe subsystem. The issue occurs in the `rxe_mmap` function, where a `rxe_mmap_info` struct is removed from the `pending_mmaps` list and its `pending_lock` is released while its `kref` is still at 1. This can lead to a concurrent `DESTROY_CQ` ioctl call freeing the `rxe_mmap_info` struct, causing a use-after-free condition. The vulnerabili [truncated]
A use-after-free vulnerability was found in the Linux kernel's xfrm_user_policy function. The issue arises from a race condition between the transmit fast path and a per-socket policy change, leading to a double-free of the socket's dst cache. This occurs due to a lack of atomicity in the sk_dst_reset() function. The vulnerability is reachable by an unprivileged user via a user+network namespace. The issu [truncated]
The Linux kernel's xfrm6_fill_dst function has a vulnerability that can lead to a double netdev_put issue. This occurs when the in6_dev_get(dev) function returns NULL, causing xfrm6_fill_dst() to release the device reference with netdev_put() but leave xdst->u.dst.dev set. Later, dst_destroy() calls netdev_put(dst->dev) again, resulting in the same net_device reference being released twice and underflowin [truncated]
A general protection fault occurs in the Linux kernel due to a vulnerability in the xfrm_hash_rebuild function. The function preallocates bins/chains for reinsertion, but its guard is inverted, causing it to skip policies with prefixlen < threshold and preallocate for the rest. This leads to a poisoned bydst node and a GPF on the next rebuild's hlist_del_rcu.
A slab-out-of-bounds read vulnerability was found in the Linux kernel's ksmbd module. The issue occurs when validating a compound SMB2 request, where the code reads the StructureSize2 field without checking if the compound element is large enough to contain it. This can lead to a remote client crafting a malicious request that extends one byte past the receive buffer.
The Linux kernel vulnerability, CVE-2026-64576, exists in the nexthop component. An uninitialized netlink_ext_ack is passed to call_nexthop_res_bucket_notifiers(), potentially leading to a general protection fault. This issue has been resolved, and administrators should update their systems with the latest kernel patches. The vulnerability allows for potential exploitation, resulting in a denial-of-servic [truncated]
A use-after-free vulnerability was found in the Linux kernel's mac80211 subsystem. When adding new links to a virtual interface, if an error occurs during the drv_change_vif_links() call, the newly added links are not properly torn down, leading to a use-after-free condition when reading from the debugfs entries of the freed links. The vulnerability occurs due to a missing teardown of newly added links in [truncated]
The Linux kernel has a vulnerability in the Bluetooth qca module, specifically in the TLV parser for NVM tags. The issue arises from an underflow in the tag length calculation, which can lead to reading past the end of a firmware buffer. This vulnerability has been resolved with a patch that corrects the loop bound check. The affected product is the Linux kernel, and the vulnerability class is related to [truncated]
A use-after-free vulnerability was found in the Linux kernel's IPv4 FIB (Forwarding Information Base) code. When a FIB notifier fails during the insertion of a new FIB alias, the error path incorrectly frees the new alias with kmem_cache_free(). This can lead to a use-after-free condition if a concurrent lookup has already accessed the new alias. The vulnerability requires CAP_NET_ADMIN and a registered F [truncated]
The Linux kernel has a vulnerability in the p54_rx_eeprom_readback() function, which does not validate the RX frame length. This can cause a buffer overflow when a malicious USB device sends a short frame with a truncated payload. The vulnerability affects Linux kernel deployments and requires immediate attention. Affected product or component is the Linux kernel, specifically the p54_rx_eeprom_readback() [truncated]
A double-free vulnerability was found in the Linux kernel's mac80211 subsystem. The vulnerability occurs in the ieee80211_set_fils_discovery() function, where it calls kfree_rcu() on the old template before allocating a replacement. If the allocation fails, it returns -ENOMEM while the link->u.ap.fils_discovery still points to the object already queued for freeing. This can cause a double-free error when [truncated]
The Linux kernel vulnerability, CVE-2026-64569, exists in the mpls_valid_fib_dump_req() function when CONFIG_INET is not set. An unprivileged user can trigger a NULL dereference through an RTM_GETROUTE dump for AF_MPLS with strict checking and no RTA_OIF, potentially leading to a denial of service. Linux kernel developers and administrators should verify and apply patches, restrict access to RTM_GETROUTE, [truncated]
A double-free vulnerability was found in the Linux kernel's mac80211 subsystem, specifically in the ieee80211_set_unsol_bcast_probe_resp function. This issue occurs when the function attempts to allocate a new template but fails, leading to a double-free of the old template. The vulnerability can cause a denial-of-service (DoS) attack or potentially allow an attacker to execute arbitrary code. The affecte [truncated]
A flaw was found in the Linux kernel's btrfs free space cache loading logic. When loading a v1 free space cache, the code does not validate the number of entries and bitmaps read from disk, leading to a potential out-of-bounds read. This could cause a denial of service or potentially execute arbitrary code with elevated privileges. The affected product is the Linux kernel, and the vulnerability class is r [truncated]
A vulnerability in the Linux kernel has been resolved, which could cause memory corruption and potentially trigger a panic. The issue arises from the iptfs_skb_add_frags() function not propagating the SKBFL_SHARED_FRAG flag when copying frag references from the source frag walk into a new SKB. This oversight can lead to memory corruption when a nested transport-mode SA decrypts in place, as the new inner [truncated]
A vulnerability in the Linux kernel's SCTP implementation has been addressed. The issue arises from the improper handling of ASCONF chunks, specifically when processing DEL-IP operations. This can lead to a use-after-free vulnerability, allowing for potential crashes or code execution. The fix involves rejecting DEL-IP operations that target the transport the ASCONF is being processed against.
A use-after-free vulnerability was found in the Linux kernel's rhashtable implementation. The rhashtable_walk_next function can dereference a stale pointer, leading to a potential crash or code execution. This vulnerability affects Linux kernel developers and users, network administrators, and security teams responsible for managing Linux-based systems. They should review the affected scope, assess potent [truncated]
A vulnerability in the Linux kernel's IPv6 implementation has been addressed. The issue, located in the `accept_untracked_na()` function, could lead to a NULL pointer dereference under certain conditions. This occurred when the function re-fetched the `inet6_dev` without a NULL check, even though its caller had already fetched and checked the device. A concurrent `addrconf_ifdown()` could clear `dev->ip6_ [truncated]
A vulnerability was found in the Linux kernel's rtl8723bs module. The loop in is_ap_in_tkip() iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload, leading to OOB reads. This issue affects Linux kernel developers and maintainers, users of Linux distributions that include the rtl8723bs module. The vulnerability has been resolved with the provided ke [truncated]
A vulnerability was found in the Linux kernel, specifically in the nvmet-tcp module. When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler calls nvmet_req_uninit() but does not mark the command as completed. This can lead to a double percpu_ref_put against a single percpu_ref_get when the s [truncated]
A vulnerability in the Linux kernel's nvmet-tcp has been resolved. The issue involves a data digest mismatch detection in nvmet_tcp_try_recv_ddgst(), leading to an unconditional call to nvmet_req_uninit(). This causes a refcount underflow if the command arrived via nvmet_tcp_handle_req_failure() path and nvmet_req_init() returned false. The vulnerability has a high impact on Linux kernel users and adminis [truncated]
The Linux kernel has a vulnerability in the fs/ntfs3: validate lcns_follow in log_replay conversion. This vulnerability has been resolved. The vulnerability affects users of the Linux kernel who use the ntfs3 filesystem. The vulnerability allows an attacker to access memory beyond the bounds of the allocated restart table buffer, potentially leading to a denial-of-service or code execution. The vulnerabil [truncated]
A vulnerability was found in the Linux kernel's ntfs3 filesystem implementation. The vulnerability is related to the handling of NTFS_DE view.data_off in the UpdateRecordData{Root,Allocation} functions. The memmove destination is calculated using e->view.data_off, which comes from an on-disk NTFS_DE inside an INDEX_ROOT or INDEX_BUFFER. However, the existing checks do not validate view.data_off + dlen aga [truncated]
A vulnerability in the Linux kernel has been resolved. The net: openvswitch module rejects oversized nested action attributes. This change prevents potential issues with structurally different streams being walked during validation and teardown. Users of the Linux kernel, particularly those using Open vSwitch, should review the provided patches and ensure their systems are updated.
A vulnerability in the Linux kernel's net/sched: cls_api has been resolved. The tcf_qevent_handle function did not handle TC_ACT_CONSUMED, leading to a use-after-free (UAF) vulnerability. This issue occurs when the skb is held by the defragmentation engine and tcf_classify returns TC_ACT_CONSUMED. The vulnerability has been addressed, but Linux kernel users and administrators, network operators, and secur [truncated]