These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A Linux kernel vulnerability, CVE-2026-89717, was resolved, addressing potential BUG_ON() in zlib code and NULL-ptr dereference in zcomp by setting the default primary compressor in zram_destroy_comps(). This fix prevents unexpected system behavior or crashes. Linux system administrators and users should verify system patch levels and apply updates as needed. The issue was reported by sashiko and is consi [truncated]
A use-after-free vulnerability exists in the Linux kernel's nfsd when handling session teardown. This issue arises because the `cl_cb_session` pointer is not properly protected, allowing it to be accessed after the session has been freed. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition.
A vulnerability in the Linux kernel's nfsd has been resolved, where a CAP_NET_ADMIN caller can send a malformed request causing an out-of-bounds read. The vulnerability has been addressed by adding a validation helper and modifying the listener set logic. This change ensures that the nfsd configuration is properly validated, preventing potential out-of-bounds reads. Linux kernel and nfsd administrators an [truncated]
A vulnerability in the Linux kernel's nfsd has been resolved, where the nfsd_genl_rqstp structure's address fields were not properly sized for IPv6 connections, potentially leaking sensitive information. The issue arises from the structure's address fields being defined as 'struct sockaddr' (16 bytes), which is insufficient for IPv6 connections. When an IPv6 NFS client is connected, the code casts these f [truncated]
A use-after-free vulnerability in the Linux kernel's fanotify feature has been addressed. The vulnerability occurs when the event reader sets the event state to FAN_EVENT_REPORTED and then sleeps while preparing the file descriptor. If a signal interrupts the triggering task at that point, fanotify_get_response() changes the state to FAN_EVENT_CANCELED and returns, unwinding the file_range stack frame whi [truncated]
A vulnerability in the Linux kernel's fbdev: omapfb: panel-dsi-cm has been addressed. The issue involved the display being registered before the initialization of a mutex, potentially leading to callbacks accessing an uninitialized lock. This could result in lock-related issues if not properly handled. Defenders managing Linux kernel-based systems, especially those using omapfb: panel-dsi-cm, should verif [truncated]
A vulnerability was found in the Linux kernel's fbdev: uvesafb. During the initialization process, the v86d connector callback is registered before the platform driver. If the platform_driver_register() function fails, the error is returned directly, leaving the connector callback registered. This issue has been resolved by adding cleanup before the final return when platform-driver registration fails.
A vulnerability in the Linux kernel has been resolved, involving the initialization of the job domain before cleanup paths in the Rocket IOCTL submit job function. This vulnerability was found in the Rocket IOCTL submit job function, where the job domain was not initialized before cleanup paths, potentially leading to issues. Linux kernel developers and administrators should verify kernel versions and app [truncated]
A vulnerability in the Linux kernel's accel/rocket component has been addressed. The `rocket_job_run()` function had error path handling issues, including a dma_fence reference leak, unbalanced runtime PM usage counter, and returning an unsignaled fence to the DRM scheduler. These issues have been fixed by replacing `pm_runtime_get_sync()` with `pm_runtime_resume_and_get()` and properly releasing fence re [truncated]
A Linux kernel vulnerability has been resolved, involving the use of raw_spinlock_t for CXL CPER work locks to prevent deadlocks. The issue arises from the CXL CPER work registration and unregistration helpers acquiring locks with a spinlock guard, leaving local interrupts enabled, while the post paths execute in hard IRQ context and acquire the same locks with an irqsave guard. This can lead to a deadloc [truncated]
A Linux kernel vulnerability was resolved, affecting ACPI APEI GHES. The issue involves incorrect section length accounting for ARM headers, potentially allowing parsers to read past the CPER section. This vulnerability impacts Linux kernel-based systems, particularly those with ACPI APEI GHES enabled. Maintainers and administrators should verify Linux kernel versions, assess system configurations, and mo [truncated]
A stack buffer overflow vulnerability exists in the Linux kernel's ACPI: pfr_update query_capability() function. The function copies ACPI buffer objects returned by the firmware into fixed-size fields without validating the buffer lengths, potentially allowing a local attacker to execute arbitrary code. This vulnerability was confirmed using KASAN on Linux kernel version 7.2-rc6. The issue arises from the [truncated]
A double-free vulnerability was found in the Linux kernel's bnx2x_init_firmware() function. This vulnerability occurs when the function encounters an error and frees memory without setting pointers to NULL, leading to a potential double-free when bnx2x_release_firmware() is called. The vulnerability requires attention from Linux kernel developers, system administrators, and security teams due to its poten [truncated]
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) implementation for x86 architectures can cause incorrect register usage, leading to memory corruption and potential crashes. The issue arises from incorrect encoding of per-CPU addresses in certain BPF instructions, which can result in the use of wrong registers. This vulnerability may impact systems using the affected kernel versions, par [truncated]
A vulnerability in the Linux kernel's bpf subsystem allows for an out-of-bounds write when a preemptible BPF program is scheduled out between obtaining a per-CPU perf_callchain_entry buffer and consuming it. This can lead to a buffer overflow when copying the callchain entry into the caller's buffer. The issue arises from the preemptible nature of BPF programs, which can cause the program to be scheduled [truncated]
A vulnerability in the Linux kernel's bpf (Berkeley Packet Filter) subsystem has been addressed. The bloom filter implementation had issues with sizing and indexing on 32-bit kernels, potentially leading to under-allocation of memory and out-of-bounds access. This could be exploited for local privilege escalation on a 32-bit x86 kernel by a binary with CAP_BPF.
A Linux kernel vulnerability has been resolved, involving dm-io reporting non-retryable errors separately. This patch fixes misbehavior when using unaligned bio vectors on dm-raid1. The vulnerability affects systems using dm-raid1, and defenders should verify patch application and assess exposure for systems with unaligned bio vectors. The patch changes the interface to dm-io, reporting two error bitmaps [truncated]
The Linux kernel has a vulnerability in the dm raid1 module where a buffer overflow can occur in the build_constructor_string() function due to insufficient space reserved for the NUL-terminator. This issue has been resolved. The buffer overflow vulnerability in the dm raid1 module of the Linux kernel can lead to potential security risks if not addressed. System administrators should verify their kernel v [truncated]
The Linux kernel has a vulnerability in the dm array component. A patch has been applied to validate array block headers on read. This change includes checks for a non-zero value_size, max_entries equal to calc_max_entries() for that value_size and block size, and nr_entries that fits within the block. These checks prevent potential out-of-bounds reads and ensure the integrity of the dm-array data structure.
The Linux kernel has a vulnerability that can be triggered by crafted metadata. The vulnerability is in the dm array, which rejects an array block whose value size is not the caller's. This can cause problems when reading blocks. The CVE record was published on 2026-09-11T20:19:41.390Z and has not been modified since then. Affected systems may experience issues with block reading, and defenders should ver [truncated]
A vulnerability in the Linux kernel's cpufreq Apple SOC driver has been addressed. The driver did not properly clean up OPP tables from firmware on some failure paths, which could lead to resource leaks. The issue has been resolved by using the correct cpumask OPP helper and pairing it with the matching remove helper on failure paths and in the exit function.
A vulnerability in the Linux kernel has been resolved, which could allow an attacker to send out-of-bounds bytes to a device and potentially cause a kernel oops. The issue arises from the fwctl_cmd_rpc() function, which copies user-controlled bytes into a buffer without properly checking the length. This could lead to a buffer overflow and potentially allow an attacker to execute arbitrary code.
A use-after-free vulnerability exists in the Linux kernel's Bluetooth RFCOMM implementation. The rfcomm_security_cfm function looks up a session on session_list and walks its DLC list without holding rfcomm_mutex, allowing for concurrent teardown and freeing of the session and DLCs by krfcommd. This can cause the callback to read a freed session list head and touch freed DLCs while updating their flags or timers.
A vulnerability in the Linux kernel's kho_preserved_memory_reserve() function can cause undefined behavior for preservations larger than 2 GiB. This issue arises from a 32-bit integer limitation when shifting bits. The function is used for memory reservation and can be triggered via kho_preserve_pages(), which is used by memblock reserve_mem. Reservations larger than 2 GiB are valid and can trigger this b [truncated]
Linux kernel vulnerability CVE-2026-89567 resolved: jbd2 bound shrinker scans by examined checkpoint buffers. The jbd2 shrinker currently only accounts for checkpoint buffers that it successfully releases against nr_to_scan. Busy buffers do not consume the scan budget. If a checkpoint transaction contains mostly busy buffers, the shrinker can scan its entire checkpoint list while holding journal->j_list_l [truncated]
A vulnerability in the Linux kernel has been resolved, which could cause long lock hold times and leave other CPUs spinning on j_list_lock, resulting in soft lockups or RCU stalls. The vulnerability affects the journal_shrink_one_cp_list function, which skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP. This can cause system instability and performance issues if not addressed. Linux ker [truncated]
A vulnerability in the Linux kernel's ipip tunnel driver can cause a skb leak in collect_md mode when metadata_dst allocation fails. This issue occurs when ipip_tunnel_rcv() returns 0 without freeing the skb, and tunnel4_rcv() and tunnelmpls4_rcv() do not free it either. The packet is leaked as other tunnel drivers dispose of it at this point. Linux kernel developers and administrators responsible for mai [truncated]
A vulnerability in the Linux kernel's IPv4 and IPv6 input handling has been addressed. The issue arises from the preservation of an skb->sk association installed by bpf_sk_assign() or prefetching a socket in UDP early demux, which can lead to a use-after-free error when a multicast packet is forwarded. This error occurs because the prefetched socket may be destroyed before the skb is freed, causing sock_p [truncated]
A vulnerability in the Linux kernel's ip6_tunnel implementation can cause a use-after-free condition when processing network packets. The ip6_tnl_xmit function was using skb_realloc_headroom, which can fail and lead to the original skb being freed while still being referenced. This has been resolved by replacing skb_realloc_headroom with skb_cow_head, which provides the required headroom and writability w [truncated]
A vulnerability in the Linux kernel's ip6_gre module has been resolved. The issue arises from incorrectly accumulating the lower device's hardware header length into dev->hard_header_len when header_ops is set, potentially affecting NBMA tunnels. Linux kernel administrators and developers should verify their configurations to ensure correct hardware header length settings. This vulnerability requires veri [truncated]