These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A null pointer dereference vulnerability was found in the Linux kernel's IPv6 implementation. The vulnerability occurs when the device's MTU drops below IPV6_MIN_MTU, causing addrconf_ifdown() to clear dev->ip6_ptr through RCU_INIT_POINTER(). A packet that passed the idev check in ip6_rcv_core() can then reach ipv6_rpl_srh_rcv() with dev->ip6_ptr already NULL.
A Linux kernel vulnerability, CVE-2026-89560, has been addressed with a commit requiring LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation in OverlayFS. This change guards whiteout creation via mknod(2) and renameat2(2) with RENAME_WHITEOUT, introducing a Landlock erratum for mknod(2) cases and fixing a bug in renameat2(2) handling. The update impacts Linux kernel administrators, security teams, and devel [truncated]
A Linux kernel vulnerability allows for an out-of-bounds write due to an integer overflow in the __nd_label_validate() function. This issue arises from a u32 on-media namespace index field being multiplied by an unsigned label size, causing a 32-bit wrap before bounds checking. A crafted namespace index can lead to a memset() operation walking off the end of a buffer.
A PatchSiren debrief of CVE-2026-89558 based on the supplied source corpus. The CVE record was published on 2026-09-11T20:19:39.540Z and has not been modified since then. This vulnerability in the Linux kernel's md/raid10 implementation could lead to silent corruption. Defenders should assess exposure, verify Linux kernel versions and patch levels, and monitor for potential issues. The issue has been reso [truncated]
A Linux kernel vulnerability was resolved, involving an overflow check for sb->bblog_shift in super_1_load(). This issue could lead to an overflow when calling badblocks_set(). The vulnerability is related to the Linux kernel's handling of bad blocks, and it requires verification and potential patching to prevent overflows. The CVE record and Linux kernel source code indicate a potential overflow issue in [truncated]
A vulnerability in the Linux kernel has been resolved, involving validation of string table section types in the elf_validity_cache_sechdrs function. The vulnerability exists because section sizes and offsets are validated unless the section type is SHT_NULL or SHT_NOBITS. Later, elf_validity_cache_secstrings and elf_validity_cache_index_str access the section name table (.shstrtab) and symbol string tabl [truncated]
A use-after-free vulnerability exists in the Linux kernel's MPLS (Multiprotocol Label Switching) implementation. When an MPLS route has multiple nexthops, the `mpls_select_multipath` function calls `mpls_multipath_hash` to choose a nexthop. While walking the MPLS label stack, the hash routine caches the header for the current label. However, after finding the bottom-of-stack label, it calls `pskb_may_pull [truncated]
A vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation can allow an off-path attacker to corrupt the path manager's id-based subflow bookkeeping for a connection. The issue arises from the improper restoration of the local_id field in the syncookie MP_JOIN reconstruction process. This can lead to potential disruptions in MPTCP connections.
A use-after-free vulnerability was found in the Linux kernel's nouveau/gem component. The vulnerability occurs in the non-uvmm path, where a race condition can lead to a use-after-free when the info lookup finds the vma and the gem close path closes the vma. This issue can cause significant impact on system stability and security, potentially allowing attackers to execute arbitrary code or cause a denial [truncated]
A NULL pointer dereference vulnerability exists in the Linux kernel when updating the zswap compressor. This issue arises from the improper handling of memory allocation failures during the update process. The vulnerability can be triggered when the `zswap_enabled_param_set` function is called before zswap is initialized, leading to a kernel NULL pointer dereference.
A vulnerability in the Linux kernel's SUNRPC xdr_buf_trim function could lead to an underflow condition. This occurs when the function trims bytes from the tail of an xdr_buf, potentially causing buf->len to wrap around to near UINT_MAX. The issue arises when the caller sets buf->len to a value smaller than the sum of the iov_lens. The vulnerability has been resolved by clamping the decrement so buf->len [truncated]
A vulnerability in the Linux kernel's SUNRPC svcauth_gss component can cause a division by zero error when handling a specially crafted krb5 token. This occurs because the code fails to enforce a minimum length for the token, allowing a header-only token or a token with a sub-header length to pass validation and reach the krb5 unwrap core. There, the rotate_left function can divide by zero when the token [truncated]
A Linux kernel vulnerability has been resolved, affecting the svc_pool_for_cpu() function. The vulnerability occurs when a service runs fewer threads than it has pools, causing trailing pools to be left with no threads. This results in transports being enqueued on sp_xprts and never picked up, leading to a connection hang indefinitely. The svc_pool_for_cpu() function has been updated to skip pools with no [truncated]
A use-after-free vulnerability exists in the Linux kernel's SUNRPC cache management. The `sunrpc_destroy_cache_detail` function does not properly cancel the `cache_cleaner` delayed work when the `cache_list` is not empty, leading to a potential use-after-free error when the `cache_detail` is freed while `cache_clean` still holds a reference to it. This vulnerability affects Linux kernel deployments that u [truncated]
A vulnerability in the Linux kernel's SUNRPC service can cause a NULL pointer dereference and data corruption when percpu_counter_init() fails during RPC server startup. This issue requires local administrator privileges to exploit under memory pressure or fault injection. The vulnerability stems from the service not checking the return value of percpu_counter_init(), leading to potential NULL pointer der [truncated]
A vulnerability in the Linux kernel's SUNRPC backchannel has been resolved. The backchannel receive can complete a request while the NFS callback service is being torn down, potentially causing a request to be leaked or enqueued onto a service that is about to be freed. This issue arises when the backchannel receive completes a request while the NFS callback service is being torn down. The vulnerability c [truncated]
A use-after-free vulnerability was found in the Linux kernel's sunrpc module. When svc_rqst_free() is called, it frees rqstp->rq_argp and rqstp->rq_resp synchronously, but defers the rqstp struct free via kfree_rcu(). This creates a window where RCU readers can still traverse the thread list and find the rqstp, leading to a potential use-after-free. The fix moves the kfree of rq_argp and rq_resp into an e [truncated]
A vulnerability in the Linux kernel's SUNRPC gssx XDR option-array decoder has been resolved. Four defects made error paths unsafe: a NULL dereference in the caller, a refcount leak on the decoded group_info, and a latent use-after-free that the leak fix would otherwise expose. The fixes adjust the option array count and data allocation, modify the free logic for service credentials, and correct group inf [truncated]
A use-after-free vulnerability was found in the Linux kernel's sunrpc module. This issue occurs due to improper handling of the clnt->pipefs_sb field during mount and unmount events, potentially leading to a use-after-free during subsequent rpc_info_open() or rpc_show_info() calls. The vulnerability arises from the sunrpc module's failure to update the clnt->pipefs_sb field during late pipefs mounts or re [truncated]
A vulnerability in the Linux kernel's SUNRPC has been addressed. The gss_krb5_unwrap_v2 function did not properly validate token lengths, leading to potential out-of-bounds reads and arithmetic issues. This has been resolved with several defense-in-depth guards. The vulnerability was addressed by adding four defense-in-depth guards inside the unwrap core so it is safe regardless of what its callers valida [truncated]
A vulnerability in the Linux kernel's SUNRPC has been resolved. The gss_unwrap_resp_priv function did not properly validate the RPCSEC_GSS opaque length, allowing a crafted reply from a krb5p NFS server to cause out-of-bounds reads. This issue can impact Linux kernel maintainers, system administrators, and security teams responsible for Linux-based systems, especially those using krb5p NFS servers. The fi [truncated]
A vulnerability in the Linux kernel's SUNRPC implementation allows for a potential denial of service (DoS) attack due to a memory leak when duplicate CREDS_VALUE options are present in a reply. The issue arises from the gssx_dec_option_array function not properly handling duplicate options, leading to a memory leak. This vulnerability requires verification of affected versions and potential exploitation.
A vulnerability in the Linux kernel's SUNRPC has been resolved. The vulnerability involves rejecting krb5 v2 wrap tokens with oversized ec fields to prevent potential buffer manipulation. This fix ensures the integrity of the buffer by rejecting structurally malformed tokens, thus preventing potential attacks. Linux kernel maintainers and administrators should verify and apply patches, and monitor system [truncated]
A vulnerability in the Linux kernel's SUNRPC implementation allows for the verification of short RFC 4121 MIC tokens, potentially leading to out-of-bounds reads. This issue has been resolved by adding a length guard in the gss_krb5_verify_mic_v2 function. The fix prevents the kernel from accessing memory beyond the bounds of the token, thus mitigating the vulnerability. Linux kernel developers and adminis [truncated]
A Linux kernel vulnerability was resolved, addressing a SUNRPC issue where in-flight client TLS handshake callbacks were not properly waited for. This could potentially lead to reference count issues and lower transport crashes if not properly handled. Linux system administrators and security teams should assess exposure and prioritize patching to prevent potential system crashes and ensure the stability [truncated]
A use-after-free vulnerability was resolved in the Linux kernel's svcrdma module. When handling RDMA_CM_EVENT_ADDR_CHANGE, a replacement listener cm_id is created, and the old one is destroyed. However, if the replacement allocation fails, the old cm_id is not properly cleared, leading to a potential use-after-free error. This vulnerability can cause system instability and potential crashes. Linux kernel [truncated]
A vulnerability in the Linux kernel's svc_rdma_read_chunk_range function can cause incorrect DMA lengths and a u32 underflow when processing Read chunks. This may lead to a multi-MiB kmalloc_array_node() allocation. The vulnerability is caused by two arithmetic defects in the per-segment loop that produce wrong DMA lengths and a u32 underflow. The defects are in the skip predicate and the length formula. [truncated]
A vulnerability in the Linux kernel's svcrdma has been resolved. The pcl_for_each_segment macro has been fixed to prevent it from computing an incorrect inclusive upper bound when a parsed chunk list contains a chunk with zero segments, which could lead to a general protection fault. This fix addresses the issue by switching the macro to a half-open upper bound that uses ch_segcount directly, ensuring the [truncated]
A vulnerability in the Linux kernel's svcrdma has been resolved. The handle_connect_req() function did not handle transport allocation failures properly, potentially leading to resource leaks under memory pressure. This issue could allow remote attackers to cause denial-of-service conditions by repeatedly attempting connections, which could lead to resource exhaustion if not properly mitigated. Linux kern [truncated]
A vulnerability in the Linux kernel's svcrdma has been resolved. An RPC-over-RDMA client can request a reply without providing a Write list or a Reply chunk to carry it, potentially causing svc_rdma_xb_linearize() to copy past the end of the buffer and corrupt adjacent slab memory. The issue arises when svc_rdma_pull_up_needed() selects pull-up and svc_rdma_pull_up_reply_msg() linearizes the whole reply i [truncated]