These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A use-after-free vulnerability exists in the Linux kernel's sch_teql (Equal Queue Length) network scheduler. When a slave device's transmit function fails, the skb->dev pointer is not restored, leading to a potential use-after-free error when the skb is later processed. This issue can cause a denial-of-service (DoS) or potentially allow for code execution.
A vulnerability in the Linux kernel's crypto: acomp component has been resolved. The vulnerability is related to the allocation of async request context when cloning. The existing fallback-on-allocation-failure behavior is preserved. This vulnerability could potentially allow attackers to cause slab OOB write errors. Defenders should prioritize verifying and applying patches for Linux kernel versions affe [truncated]
A vulnerability in the Linux kernel's Ceph messenger v2 protocol implementation can cause a 0-length socket read when a client sends a banner with an invalid payload length, triggering a warning and potentially leading to a protocol error. The issue has been resolved by adding a check to reject payload lengths smaller than 16 bytes. This vulnerability affects Linux kernel versions and could lead to protoc [truncated]
A vulnerability in the Linux kernel's netfilter component has been addressed. The issue involves the nf_tables module, where the hardware offload step was moved after building the chain blob to reduce inconsistencies between offloaded and software rulesets. This change aims to ensure that the offloaded ruleset in the network interface card (NIC) and the software ruleset are consistent, thereby preventing [truncated]
A vulnerability in the Linux kernel's stmmac network driver can cause a kernel panic on certain architectures when receiving an ICMP echo request due to IP header misalignment. The issue arises from the RX DMA offset not accounting for NET_IP_ALIGN after the conversion to zero-copy RX path. This misalignment can lead to an unhandled fault and subsequently a fatal exception in interrupt.
A use-after-free vulnerability in the Linux kernel's slip component has been addressed. The vulnerability occurs when the `slip_hangup` function is called concurrently with reader functions, leading to a potential crash or code execution. This issue was reported by Jaeyoung Chung and Eulgyu Kim. The vulnerability has been resolved by removing `slip_hangup` to ensure teardown is serialized cleanly by `slip [truncated]
A buffer overflow vulnerability was found in the Linux kernel's dm-integrity module. This issue occurs when computing checksums for discarded blocks, potentially leading to a buffer overflow if the tag size is smaller than the digest size. The vulnerability arises from the integrity_metadata computing a checksum for every discarded block into the 'checksums' buffer. Specifically, integrity_sector_checksum [truncated]
The Linux kernel has a vulnerability that could allow for high impact attacks. A patch has been applied to reject non-zerocopy devmem tx. This change ensures that devmem tcp tx doesn't work without zero-copy, addressing potential security concerns related to high impact attacks on Linux kernel systems. The patch was applied to prevent potential security breaches and ensure the integrity of Linux kernel sy [truncated]
A use-after-free vulnerability exists in the Linux kernel's USB gadget function ffs. The io_data stores a pointer to the submitting task's mm_struct without holding a reference to it while async requests are pending. This can result in a use-after-free if the task exits before completion handling finishes. The vulnerability can lead to a crash or potential code execution if exploited. Linux kernel develop [truncated]
A Use-After-Free vulnerability in the Linux kernel's USB gadget function f_fs can lead to a race condition in AIO error paths. This issue arises when ffs_epfile_io() fails with an error other than -EIOCBQUEUED, causing the io_data structure to be freed. However, if a concurrent cancel operation executes after ffs_epfile_io() fails but before the function frees the io_data, a Use-After-Free can occur when [truncated]
A critical vulnerability was resolved in the Linux kernel, specifically in the ceph filesystem, where filenames in vmalloc() buffers were not properly decrypted, leading to potential system crashes, particularly on non-x86 platforms. This issue arises from the fscrypt subsystem's requirement that buffers must be in the linear mapping region, but the messenger client uses kvmalloc() to create buffers that [truncated]
A vulnerability in the Linux kernel's HID: sony driver can cause a use-after-free condition when input device registration fails during probe. This issue allows for potential privilege escalation. The CVE record was published on 2026-09-16T11:17:17.350Z and has not been modified since then. The vulnerability was found by 0sec using automated source analysis and verified against HID input registration and [truncated]
A local administrator with CAP_SYS_ADMIN can crash the Linux kernel by writing to /proc/fs/nfsd/unlock_filesystem, sending the NFSD_CMD_UNLOCK_FILESYSTEM or NFSD_CMD_UNLOCK_EXPORT netlink command, due to a NULL pointer dereference in the NFSv4 client hash tables. This issue is resolved by gating the admin state-revocation walks with NFSD_NET_UP. The vulnerability allows a local administrator to crash the [truncated]
A use-after-free vulnerability in the Linux kernel's NFSD allows a client to access freed memory, potentially leading to a crash or other unexpected behavior. The vulnerability is caused by a race condition between the laundromat reaping timed-out entries and a concurrent force_expire_client() call, which can free the client. To address this issue, it is recommended to pin the client with cl_rpc_users bef [truncated]
A vulnerability in the Linux kernel's NFSD (Network File System Daemon) has been addressed, which could lead to a use-after-free condition when handling blocked locks. This issue arises because a lock owner, with its sole remaining reference being a blocked lock on nn->blocked_locks_lru, holds a raw pointer to its nfs4_client. However, this reference does not keep the client alive. When the per-net laundr [truncated]
A Linux kernel vulnerability has been resolved with the addition of a timeout during stop_streaming to prevent an infinite loop. The change introduces a bounded poll of the queue status, sleeping briefly between polls, and bailing out once VPU_DEC_STOP_TIMEOUT elapses. This patch aims to address potential denial-of-service issues in systems utilizing the chips-media wave5 functionality. Defenders should a [truncated]
A Linux kernel vulnerability allows for information leaks due to uninitialized data in the qla2xxx SCSI driver. This issue arises from the qla2x00_do_dport_diagnostics function allocating memory with kmalloc_obj, which does not zero the memory. As a result, when the function copies data back to user space, uninitialized portions of the memory are exposed, potentially leaking sensitive kernel heap information.
A vulnerability in the Linux kernel's f2fs filesystem implementation allows for an out-of-bounds write when handling the MOVE_RANGE ioctl. This occurs because the destination size is not validated before updating the inode size. An attacker can exploit this by causing a hole in the source range, which can lead to unintended inode size extensions. The vulnerability affects Linux kernel-based systems, poten [truncated]
The Linux kernel vulnerability in f2fs recovery filename logging allows for potential information disclosure. The vulnerability has been resolved by limiting recovery filename logging to stored length. Linux kernel users and administrators should assess their configurations and f2fs usage, review and apply patches. This vulnerability has a CVSS score of 7.1 and is considered HIGH severity. The vulnerabili [truncated]
A vulnerability in the Linux kernel has been resolved, affecting the drm/amdgpu component. The issue involves uninitialized UVD rings in SR-IOV VF, which could lead to problems when restoring fence sequences. This debrief provides an overview of the vulnerability, its potential impact, and recommended actions for defenders. The vulnerability was addressed by skipping fence completion when the fence driver [truncated]
A vulnerability in the Linux kernel has been resolved, where the drm/ttm module does not properly drop the tt->restore flag after a successful restore process. This can lead to subsequent backup and restore flows observing a completed restore while shmem handles are still installed in tt->pages, causing a stack trace. The issue arises from the failure to free and drop tt->restore in ttm_pool_restore_and_a [truncated]
A high-severity vulnerability has been resolved in the Linux kernel, affecting the bpf_get_stackid function. The vulnerability has a CVSS score of 7.8 and requires local access to be exploited. This issue was resolved by disabling preemption in the bpf_get_stackid function. Linux kernel maintainers, system administrators, and security teams should assess exposure and apply patches or updates. The vulnerab [truncated]
A race condition vulnerability in the Linux kernel's rpcrdma module allows for a NULL pointer dereference. The vulnerability is caused by the rpcrdma_rn_register() function inserting a notification object into the rd_xa xarray before storing the caller's callback in rn->rn_done. This can lead to a device removal racing a fresh registration, resulting in a NULL pointer dereference.
A vulnerability in the Linux kernel's DAMON (Data Access Monitoring) feature can cause an infinite loop in the kdamond_merge_regions() function. This issue is unlikely to occur in real-world scenarios, as it requires an unrealistically large number of uncontiguous regions setup and large aggregation intervals compared to the sampling interval. However, the consequence is severe, and the fix is simple.
A vulnerability in the Linux kernel's ksmbd module allows for out-of-bounds reads in share config responses. This issue has been resolved by validating IPC share configuration payload sizes before consuming variable-length fields. The vulnerability was identified in the ksmbd module of the Linux kernel, which is responsible for handling SMB/CIFS requests. The out-of-bounds reads could potentially allow an [truncated]
A use-after-free vulnerability was found in the Linux kernel's trusted key type implementation. The vulnerability occurs when the trusted key type is being unregistered while other CPU cores are still performing key operations, leading to a potential crash or code execution. This issue arises from the trusted_tpm_exit() function dropping the TPM chip reference and freeing the digest array before unregiste [truncated]
A Linux kernel vulnerability, CVE-2026-89755, has been resolved, which could lead to a folio reference count BUG. The issue arises from __migrate_device_pages() reading the folio mapping before calling folio_free_swap(), resulting in a stale mapping being passed to folio_migrate_mapping(). This vulnerability affects Linux kernel configurations and versions, requiring verification and potential updates to [truncated]
A vulnerability in the Linux kernel's cxl/ras component has been addressed. The function cxl_rch_get_aer_info() was reading past the mapped AER register block, potentially causing out-of-bounds reads. This issue arose due to a mismatch between the software layout of struct aer_capability_regs and the physical AER capability. The fix bounds the read to the physical AER registers and zeros software-only fie [truncated]
A vulnerability in the Linux kernel's zram module has been addressed. The read_block_state() function did not properly handle device reinitialization with a smaller disk size, potentially leading to out-of-bounds access. This issue could allow an attacker to access memory outside the intended bounds, potentially causing system instability or privilege escalation. Linux kernel developers and maintainers sh [truncated]
A Linux kernel vulnerability, CVE-2026-89718, allows for out-of-bounds access in writeback_store() due to inconsistent table scan bounds after device reinitialization. This issue has been resolved through a patch series that ensures bounds are calculated under dev_lock, maintaining consistency with the table throughout its scan. Linux kernel maintainers, system administrators, and users of Linux-based sys [truncated]