These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in the Linux kernel's ntfs3 filesystem driver has been resolved. The `mi_enum_attr()` function did not properly validate the end virtual cluster number (evcn) for non-resident attributes, allowing for potential out-of-range values to pass unrejected. This could lead to issues when handling malformed on-disk attributes. The vulnerability has been resolved with a patch that rejects evcn valu [truncated]
A vulnerability in the Linux kernel's mailbox subsystem has been addressed. The riscv-sbi-mpxy mailbox implementation did not properly validate the lengths of RPMI notifications before copying them from shared memory. This could potentially lead to buffer overflow or data corruption. The vulnerability has been resolved by adding validation for the complete notification length before copying and iterating [truncated]
A vulnerability in the Linux kernel's bpf (Berkeley Packet Filter) subsystem has been addressed. The issue involves atomic RMW (Read-Modify-Write) verification, where the instruction pointer type was not consistently recorded for all paths. This could lead to incompatible uses of the same instruction. The fix records the actual destination type for all atomic RMW paths, ensuring a mismatch check rejects i [truncated]
A slab-out-of-bounds read vulnerability exists in the Linux kernel's ksmbd_alloc_user() function. The function copies a user-supplied hash size, which can be up to 65535 bytes, into a fixed-size buffer of KSMBD_REQ_MAX_HASH_SZ bytes, leading to a potential buffer overflow. This issue arises from the lack of proper bounds checking on the hash size supplied by the response. A malformed or malicious login re [truncated]
A use-after-free vulnerability was found in the Linux kernel's smbdirect implementation. When tearing down completion queues, the current code uses ib_destroy_cq(), which can lead to a use-after-free error if a completion is posted late. This issue can cause a slab-use-after-free error in ib_cq_poll_work(). The vulnerability affects Linux kernel-based systems, particularly those using the smbdirect implem [truncated]
A vulnerability in the Linux kernel's SMBDirect implementation has been resolved. The issue occurs when the rdma_accept_failed error path of smbdirect_accept_connect_request() is executed, leading to the destruction of memory pools before the QP (Queue Pair) is drained. This results in a slab cache object being outstanding at kmem_cache_destroy() time, causing a 'Slab cache still has objects' error and a [truncated]
A Use-After-Free and Double-Free vulnerability was found in the Linux kernel's ksmbd implementation. When processing SMB2_LOCK requests, mid-batch granted locks were published to connection-wide and file-wide lists prematurely, allowing a concurrent UNLOCK request to free the lock object before the granting thread could complete its rollback loop. This results in a Use-After-Free and Double-Free vulnerabi [truncated]
A vulnerability in the Linux kernel has been resolved, affecting the erofs filesystem. The vulnerability is related to interlaced ztailpacking pclusters, which can lead to an out-of-bounds read from a kmap'd page and copying irrelevant kernel memory into userspace-visible page cache. This issue can be triggered by crafted images containing invalid interlaced ztailpacking pclusters.
A vulnerability in the Linux kernel's ksmbd has been resolved, allowing for safer handling of unregistered deferred locks. This issue arises when vfs_lock_file() defers a lock and smb2_lock() places its ksmbd_lock on rollback_list before allocating and registering the asynchronous work. If either operation fails, rollback assumes that smb_lock->conn is initialized and dereferences NULL, and the deferred f [truncated]
A vulnerability in the Linux kernel's ksmbd module allows for an out-of-bounds ACE walk in the DACL, potentially leading to unauthorized access. The vulnerability has been resolved by bounding ACE walks by the DACL's declared size. This fix addresses the issue by ensuring that ACE walks are properly bounded, preventing potential security risks. Linux kernel developers and administrators should review and [truncated]
A local static-analysis checker discovered a publish-before-free lifetime bug in the Linux kernel's NFSv4 callback identifier handling. The bug occurs when nfs4_alloc_client() allocates an NFSv4.0 callback identifier before completing client setup, and a later initialization step fails, causing the error path to free the nfs_client directly with nfs_free_client(), bypassing nfs_put_client(). This can leav [truncated]
A vulnerability in the Linux kernel's NFSv4/flexfiles implementation can lead to a NULL pointer dereference when using NFSv4.0 data servers. This occurs because certain code paths assume the presence of a session, which is not available in NFSv4.0. As a result, I/O operations to a v4.0 flexfiles data server can cause a system crash. The vulnerability arises from the Linux kernel's handling of NFSv4.0 data [truncated]
A vulnerability in the Linux kernel has been resolved, involving the bpf and xdp components. The issue arises from the lack of checks in dev_xdp_attach() when a user swaps in an offloaded or device-bound program with BPF_LINK_UPDATE, potentially putting it on the software path. The checks have been moved to dev_xdp_install(), which is a common point for all three paths: 'ip link set xdp', BPF_LINK_CREATE, [truncated]
A vulnerability in the Linux kernel's hinic3 driver has been resolved, affecting Linux kernel deployments. The issue arises from a mismatch in skb linearization and incorrect handling of checksum offload for unsupported tunnel packets. This can lead to out-of-bounds DMA reads or IOMMU faults and transmission of corrupted packets with incomplete checksums. Linux kernel developers, maintainers, and users sh [truncated]
A vulnerability in the Linux kernel's kcm_parse_func_strparser() function has been resolved. The function calls bpf_prog_run_pin_on_cpu(), which prevents CPU migration but does not establish an RCU read-side critical section. This can trigger WARN_ON_ONCE(!bpf_rcu_lock_held()) when BPF map operations are called from the KCM strparser program. To fix this, the RCU read lock should be held while running the BPF parser.
A high-severity vulnerability has been resolved in the Linux kernel, affecting the ipvs (IP Virtual Server) component. The vulnerability, tracked as CVE-2026-90141, is caused by an integer overflow in the FTP helper port and address parsing. This could allow an attacker to manipulate the data connection configuration, potentially leading to security issues.
A vulnerability in the Linux kernel's platform/x86: hp-bioscfg component allows for out-of-bounds reads when parsing ACPI packages. This issue arises from insufficient bounds checking on the password_obj array, which can lead to reading past the array and passing invalid string pointers to hp_convert_hexstr_to_str(). The vulnerability has a CVSS score of 7.7 and is considered HIGH severity. Linux kernel m [truncated]
A heap out-of-bounds write vulnerability was found in the Linux kernel's ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib(). This issue occurs when ntfs_ir_to_ib() copies entries from index_root into a buffer without verifying they fit within the available space, potentially causing OOB writes. The vulnerability arises from a lack of bounds checking, allowing a crafted filesystem image to trigger the [truncated]
The Linux kernel has a vulnerability, tracked as CVE-2026-90132, that allows unprivileged writes to reserved $LX* xattrs. This vulnerability has been resolved by rejecting setxattr of the reserved $LXUID, $LXGID, $LXMOD, and $LXDEV names from userspace unless the caller has CAP_SYS_ADMIN. The vulnerability affects Linux kernel systems, particularly those with unprivileged user access, and defenders should [truncated]
A race condition vulnerability in the Linux kernel's NTFS implementation can lead to data corruption or crashes when handling resident I/O operations. The vulnerability arises from the lack of proper synchronization between the `ntfs_read_iomap_begin_resident` function and the `ntfs_attr_record_resize` function, allowing a writer to modify the MFT record while a reader is accessing it. This issue has been [truncated]
A vulnerability in the Linux kernel's irqchip/gic-v5 component has been addressed. The issue arises from the improper handling of MADT GICC entries that do not correspond to logical CPUs recognized by the kernel, potentially leading to out-of-bounds memory corruption. This problem is resolved by adding a check for the return value of get_logical_index().
A use-after-free vulnerability exists in the Linux kernel's IPv6 multicast routing (ip6mr) functionality. When an ingress multicast packet misses the MFC (Multicast Forwarding Cache) lookup, it is placed on the unresolved queue. If the underlying route is deleted and freed, and the MFC queue is later resolved with a wrong parent interface, a slab use-after-free occurs. This issue is resolved by removing d [truncated]
A critical vulnerability in the Linux kernel's inetpeer rate limiting system allows off-path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports. The vulnerability is mitigated by randomizing the RB-tree node comparison logic using SipHash with a secret key. This change ensures that the tree layout and lookup traversal paths are unpredictable to off-path adversaries, breaking the determ [truncated]
A critical vulnerability in the Linux kernel's NFSv4.1 implementation could allow remote attackers to execute arbitrary code. The vulnerability exists in the decode_cb_sequence_args() function, which does not properly initialize the referring call lists. This can cause the nfs4_callback_sequence() function to pass stale slab contents to kfree(), potentially leading to a denial-of-service (DoS) or code execution.
A vulnerability in the Linux kernel's NFSv4.2 implementation can lead to a denial of service due to a buffer exhaustion issue. The vulnerability is caused by an incorrect budget for the layoutupdate4 body, which can exceed the reserved buffer size. This can lead to a permanent lock hold and potential system crash. The affected product is the Linux kernel, and the vulnerability class is related to buffer e [truncated]
A vulnerability in the Linux kernel's NFSv4/pnfs implementation could allow an attacker to cause a denial of service. The issue arises from the data server cache being keyed on the multipath address set alone, without considering the NFS version. This can lead to a mismatch in sequence-slot handling, resulting in a NULL pointer dereference. The vulnerability is resolved by adding the version to the cache [truncated]
A vulnerability in the Linux kernel's Bluetooth L2CAP has been resolved. The issue arises from accessing `chan->conn` safely in get/setsockopt. After a specific commit, `l2cap_chan::conn` holds a reference and remains non-NULL even after the corresponding `hci_conn` is deleted. However, accessing fields like `hci_conn::hdev` in this state is invalid, leading to a KASAN crash in `l2cap_sock_setsockopt()`. [truncated]
A vulnerability in the Linux kernel's Bluetooth L2CAP implementation can lead to a use-after-free (UAF) condition. This occurs when a new socket is added to the parent socket's accept queue after the parent socket has been closed, resulting in a dangling reference. The issue arises from a race condition between l2cap_sock_new_connection_cb() and l2cap_sock_teardown_cb().
A race condition vulnerability in the Linux kernel's Bluetooth L2CAP subsystem can lead to a null-pointer dereference. The vulnerability is caused by a lockless read in the l2cap_sock_cleanup_listen() function, which can race against concurrent l2cap_sock_kill() and l2cap_sock_put_chan() calls. This can result in a null-pointer dereference when accessing the l2cap_pi(sk)->chan field.
A vulnerability in the Linux kernel's Bluetooth btnxpuart driver has been resolved. The nxp_process_fw_dump() function did not validate the FW dump header length, potentially leading to reads beyond the received data. This could result in a truncated frame ending a dump early. The issue has been addressed by using skb_pull_data() to validate and pull the FW dump header before accessing its fields.