These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in the Linux kernel's RPC/RDMA Read list decoder has been resolved. The decoder did not validate wire-supplied segment lengths, potentially leading to a large dynamic bvec allocation and resource leak. This issue has been addressed by rejecting oversized Read segments at decode time. The vulnerability was addressed by adding checks to ensure segment lengths are within valid limits, prevent [truncated]
A vulnerability in the Linux kernel's svcrdma has been resolved. The vulnerability occurs when a requester sends multiple Read segments whose cumulative length exceeds the rq_pages array budget, resulting in a NULL pointer dereference during DMA mapping. This issue can be mitigated by rejecting Read lists that exceed the page budget at decode time.
The Linux kernel vulnerability CVE-2026-89527 was resolved with a fix in svc_rdma_create(). This vulnerability was caused by a reference count imbalance in svc_rdma_create_listen_id() failure path, which could lead to improper cleanup and potential security issues. Linux kernel administrators and developers should assess exposure and apply patches if necessary to prevent potential reference count imbalanc [truncated]
A vulnerability in the Linux kernel's svcrdma has been resolved. The RPC/RDMA Read chunk position field is supplied by the remote client and stored verbatim in the parsed chunk list. This can lead to exposure of adjacent slab memory to the upper XDR decoder and copying past the receive buffer into request pages that are returned to the client through the Reply channel.
A vulnerability in the Linux kernel's UDF (Universal Disk Format) implementation has been addressed. The issue arises from the handling of VAT (Virtual Allocation Table) indexes in the `udf_get_pblock_virt15()` function. Specifically, the function previously only rejected indexes greater than `s_num_entries`, which represents the number of entries in the VAT array. However, this allows an attacker to craf [truncated]
A vulnerability in the Linux kernel's ath6kl module could allow disclosure of adjacent slab memory. The issue arises from insufficient bounds checking on association request and response lengths, leading to potential memory disclosure via nl80211. This vulnerability was found by 0sec using automated source analysis. The affected product is the Linux kernel, specifically the ath6kl module. The vulnerabilit [truncated]
A Linux kernel vulnerability has been resolved, involving core scheduling's pick_next_task() operating on all sibling runqueues under one acquisition of the shared core-wide lock. This issue could potentially lead to a use-after-free vulnerability. The CVE record was published on 2026-09-11T20:19:34.647Z and has not been modified since then. The vulnerability affects Linux kernel system administrators and [truncated]
A vulnerability was resolved in the Linux kernel related to sched_ext, replacing SCX_RQ_BAL_KEEP with a dispatch verdict return to fix core scheduling support. This change addresses a core scheduling support issue by ensuring that the decision to travel with the dispatch that made it, rather than relying on a flag that may be stale. Linux kernel maintainers and users should assess exposure and verify patc [truncated]
A Linux kernel vulnerability was resolved, addressing assumptions in dispatch kfuncs under core scheduling. The issue involved incorrect usage of this_rq() in several kfunc paths, potentially leading to deadlocks or incorrect behavior. The fix utilizes the rq tracked by scx_locked_rq() to ensure correct operation on the dispatched rq. This change impacts Linux kernel maintainers, users, and administrators [truncated]
A Linux kernel vulnerability has been resolved, which could lead to rq->core_pick corruption under core scheduling. This issue arises from the pick_next_task() function, which picks what to run on every SMT sibling of the core in a single pass under the shared core-wide rq lock. When selections on the same core interleave through the dropped lock, they corrupt each other's state, potentially leading to a [truncated]
A vulnerability in the Linux kernel's sched_ext component can cause a BUG_ON error when a Deferred Schedule Queue (DSQ) is destroyed before a deferred reenqueue (dru) task runs. The fix involves reading the DSQ ID once with READ_ONCE() to prevent a race condition. This issue affects Linux kernel maintainers, administrators, and users of systems relying on sched_ext, who should assess exposure and apply pa [truncated]
A Linux kernel vulnerability was discovered during fuzz testing, allowing an uninitialized memory access issue. The problem arises from uninitialized DMA padding bytes in the scsi_alloc_sgtables() function. This issue can lead to a KMSAN (Kernel Memory Sanitizer) report of an uninit-value in __dma_map_sg_attrs(). The vulnerability was reported by Linux Verification Center (linuxtesting.org) with Syzkaller [truncated]
A vulnerability in the Linux kernel's SCSI fnic driver has been addressed. The fnic_fcoe_process_vlan_resp() function allocated a VLAN descriptor with kzalloc_obj() using GFP_KERNEL while holding the vlans_lock spinlock. This could cause a sleeping-from-invalid-context warning or deadlock because GFP_KERNEL may sleep. The allocation has been updated to use GFP_ATOMIC, ensuring it is safe under the IRQ-safe spinlock.
A Linux kernel vulnerability allows a nested guest to trigger out-of-bounds reads and writes in the KVM PMU event info array. The issue arises from a 32-bit integer overflow when storing the shared-memory size, leading to an incorrect allocation size. This vulnerability has been resolved by storing the size in size_t and rejecting multiplication overflow.
A vulnerability in the Linux kernel has been resolved, related to a device reference leak in the remoteproc SCP driver. The issue occurs when attempting to look up driver data before the driver has been bound. This vulnerability may impact Linux kernel developers and maintainers, as well as users of affected Linux distributions. The consequences of this vulnerability are not explicitly stated, but it coul [truncated]
A NULL pointer dereference vulnerability in the Linux kernel's qede driver can cause a kernel panic under memory pressure when processing TPA continuation fragments. The issue arises from a dropped assignment of tpa_info->buffer.data in qede_tpa_start(), leading to a 'ghost' BD being pushed into the active Rx ring. This can be fixed by restoring the tpa_info->buffer.data assignment in qede_tpa_start().
A vulnerability in the Linux kernel's RDMA/cxgb4 has been addressed. The issue arises from the c4iw_uld_state_change() function queuing reg_work to register the RDMA device, which can lead to c4iw_register_device() accessing the freed device if c4iw_remove() is called while the work is pending or running. To fix this, reg_work should be canceled before removing the device. Additionally, if registration fa [truncated]
A vulnerability in the Linux kernel's RDMA/ionic module has been resolved. The ionic driver was not properly adapted to changes in the RDMA/core, causing a NULL pointer dereference in alloc_and_bind(). This issue was addressed by embedding struct rdma_counter in a driver-specific struct and adding required counter_init and INIT_RDMA_OBJ_SIZE declarations. Linux kernel maintainers and users should assess e [truncated]
A use-after-free vulnerability exists in the Linux kernel's RDMA/ucma subsystem. The ucma_set_ib_path function calls ucma_event_handler without holding the handler lock, which can lead to a use-after-free condition when ucma_migrate_id reassigns ctx->file concurrently. This vulnerability requires an RDMA device to be present and a bound and address-resolved cm_id to be triggered. The use-after-free condit [truncated]
A Linux kernel vulnerability allows unprivileged users to cause a denial of service by triggering a list corruption in the RDMA/ucma subsystem, leading to a deadlock and event stranding. The vulnerability is caused by a missing lock in the ucma_write_cm_event() function, which can be exploited to crash the system or potentially escalate privileges. Linux kernel administrators, security teams, and develope [truncated]
A vulnerability in the Linux kernel has been resolved, which could potentially trigger a NULL pointer dereference in certain drivers (mthca, irdma, siw) when handling reg_mr operations with invalid user data. The original commit missed that three drivers have UHW data associated with reg_mr that cannot be passed through the ioctl. They also assume that the udata cannot be NULL, so failing to pass a valid [truncated]
A vulnerability in the Linux kernel's RDMA/uverbs subsystem has been addressed. The legacy write() path did not properly initialize the method_elm pointer in uverbs_attr_bundle, which could lead to a NULL pointer dereference if malformed provider input caused an error message to be emitted. This issue has been resolved by explicitly initializing method_elm for legacy bundles and modifying uverbs_get_handl [truncated]
A vulnerability in the Linux kernel has been resolved, where the regulator: as3722_get_regulator_dt_data function could potentially leave a dangling of_node pointer. This occurs because of_get_child_by_name() acquires a reference on np, which is then assigned to pdev->dev.of_node, but the function immediately calls of_node_put(np), releasing the reference.
A race condition vulnerability was found in the Linux kernel's ring-buffer subsystem. The issue occurs when `ring_buffer_alloc_read_page()` is called concurrently with `ring_buffer_subbuf_order_set()`, potentially leading to a mismatch between the allocated reader page's order and the actual memory allocated. This could cause issues with the ring buffer's functionality.
A vulnerability in the Linux kernel has been resolved, related to the ring-buffer and cpu_buffer->free_page allocation with subbuf_order. The CVE record was published on 2026-09-11T20:19:32.423Z and has not been modified since then. This vulnerability affects Linux kernel developers, administrators, and users who need to verify and apply patches. The vulnerability has been resolved, but users should verif [truncated]
A vulnerability in the Linux kernel has been addressed, involving the ring-buffer subsystem. The issue arises from a race condition that can occur when resizing a sub-buffer, potentially leading to data inconsistencies. This vulnerability is considered significant for Linux kernel developers and maintainers, as well as users who rely on the Linux kernel in their systems.
A Linux kernel vulnerability was resolved, involving the ring-buffer and potential crashes or memory leaks due to a mismatch in page order during concurrent ring buffer resize and cached reader page discard. The fix ensures the correct page order is used, addressing potential system instability and memory corruption. Linux kernel maintainers, administrators, and users of Linux-based systems should assess [truncated]
A Linux kernel vulnerability was resolved, involving the ring-buffer and remote reader updates. The issue arises when the remote swap_reader_page callback returns -EBUSY during an event storm on a small buffer. This situation can lead to the same page being spliced as both the previous and new reader, potentially causing log flooding under contention.
A vulnerability in the Linux kernel's orangefs module can lead to a buffer overflow when parsing client debug masks. The orangefs_prepare_cdm_array() function incorrectly sizes the client debug keyword buffer, allowing a potential write past the end of the allocated buffer. This issue arises from the function's use of strcspn(cds_head, ' ') to determine the buffer size, followed by parsing the keyword wit [truncated]
A memory leak vulnerability was found in the Linux kernel's ocfs2 filesystem. The vulnerability occurs when using the 'copy_file_range' function within the same filesystem, leading to unreferenced objects and potential memory leaks. The issue has been resolved by ensuring that deallocations are always run on copy-on-write completion. This vulnerability affects Linux kernel developers and maintainers, user [truncated]