These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A Linux kernel vulnerability allows a node in a DLM domain to corrupt or panic other nodes with a malformed message due to unbounded length and count fields from the wire. This issue, resolved in a patch series, affects the o2dlm receive handlers. Any node that has joined the domain, including a compromised or malicious member, can send these messages. There is no local trigger.
A vulnerability in the Linux kernel's ocfs2 has been resolved, involving the validation of lengths in dlm_mig_lockres_handler. A node receiving a DLM_MIG_LOCKRES message trusts several fields of the peer-supplied dlm_migratable_lockres without validation, leading to potential out-of-bounds read and write vulnerabilities. This issue can result in system instability and potential security breaches if exploi [truncated]
A vulnerability in the Linux kernel's ocfs2 file system has been addressed. The ocfs2_validate_refcount_block function did not validate the rl_used and rl_count fields of the refcount block, allowing for an out-of-bounds read and potential denial of service. A local attacker with CAP_SYS_ADMIN privileges could exploit this by mounting a crafted or corrupted ocfs2 image.
A vulnerability in the Linux kernel's ocfs2 filesystem implementation allows for an out-of-bounds read when handling directory-index entries. This can be triggered by a crafted on-disk image, potentially leading to a denial of service or information disclosure when the image is mounted. The vulnerability was found by 0sec automated security-research tooling and affects Linux kernel developers and maintain [truncated]
A Linux kernel vulnerability allows directory position truncation on 32-bit kernels, causing readdir() to reset and re-enumerate already-returned directory entries indefinitely when crossing the 4 GiB boundary. This issue arises in ocfs2_dir_foreach_blk_el(), where the directory cookie position is rebuilt. On 32-bit kernels, the mask used to rebuild the position is computed as a 32-bit unsigned value, lea [truncated]
The Linux kernel was vulnerable to arbitrary kernel memory access via the or1k_atomic syscall, allowing unprivileged processes to read and write kernel memory, potentially leading to code execution in kernel context. The vulnerability has been resolved by adding checks for user pointers and exception table entries. This vulnerability affects Linux kernel deployments and requires immediate attention from L [truncated]
A use-after-free vulnerability in the Linux kernel's Open vSwitch (OVS) module allows an unprivileged user to cause a slab-use-after-free in ovs_ct_execute() when a network namespace is torn down. The vulnerability is due to the CT limit pointer not being removed from readers or protected by a grace period, allowing packet processing to dereference the freed state.
A Linux kernel vulnerability was resolved, involving openvswitch and packet handling. The issue arose from incorrect handling of skb_tx_error in the error path of queue_userspace_packet, potentially leading to unintended page-cache writes. This vulnerability requires assessment and patch application to prevent potential exploitation. The affected product is the Linux kernel, and the vulnerability class is [truncated]
A use-after-free vulnerability was found in the Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem. The vulnerability occurs in the _ipmi_destroy_user() function, where a command receiver (cmd_rcvr) is freed without a proper synchronization, leading to a potential use-after-free error. This vulnerability was resolved by restoring a synchronize_rcu() call before freeing the receivers.
A vulnerability in the Linux kernel has been resolved, where the lockd: pin next file across nlm_inspect_file lock-drop. This vulnerability could potentially allow an attacker to cause a denial of service or other unspecified impacts. The issue has been resolved by pinning both current and next files before the lock-drop and advancing by swapping the pinned cursors at the end of each iteration. Defenders [truncated]
A NULL dereference vulnerability in the Linux kernel's lockd subsystem can cause a crash when lockowner allocation fails. The issue arises when nlmclnt_locks_init_private() installs NLM file lock operations even if nlmclnt_find_lockowner() fails to allocate a lockowner. Subsequently, nlmclnt_proc() returns -ENOMEM, but the VFS still attempts to tear down the partially initialized file_lock, leading to a c [truncated]
A Linux kernel vulnerability allows uninitialized data exposure when a discard operation fails and the fallback page is used. The issue arises from the discard_page being allocated with alloc_page(GFP_KERNEL) without being zeroed. This can lead to sensitive data being exposed to the controller. The vulnerability is difficult to trigger, requiring memory pressure and a specific sequence of events.
A vulnerability in the Linux kernel has been resolved, affecting the nvme-tcp module. The issue arises from the improper handling of C2HData based solely on blk_rq_payload_bytes(), potentially leading to wild memory access. This debrief provides an overview of the vulnerability, its implications, and recommended actions for defenders. The vulnerability was discovered in the Linux kernel's nvme-tcp module, [truncated]
A vulnerability in the Linux kernel's nvme-tcp implementation could allow a malicious controller to disclose host memory contents. The issue arises from the handling of R2T (Ready to Transfer) packets for read commands, where the host may inadvertently send data meant for a read operation back to the controller, potentially exposing sensitive kernel data.
A vulnerability in the Linux kernel's nvme-tcp module can cause a read operation to return more data than requested, potentially leaking sensitive information. The issue arises because the current implementation completes a read request once the current C2HData PDU has been consumed, without comparing the total bytes received against the length requested by the command.
A use-after-free vulnerability was found in the Linux kernel's SCTP implementation. When processing a packet, the association is looked up and cached without taking a reference. If the association is deleted, the packet can still access the freed association, leading to a use-after-free error. The vulnerability was resolved by marking the packet for discard in the command interpreter before deleting the a [truncated]
A Linux kernel vulnerability was resolved, involving sctp: dropping a chunk if its transport was removed. An authenticated ASCONF DEL-IP can remove it in the meantime. The DATA chunk in that packet puts the removed transport back into asoc->peer.last_data_from. Linux kernel administrators and developers should verify kernel versions and assess exposure to SCTP traffic to prevent potential issues. Verify L [truncated]
A null pointer dereference vulnerability exists in the Linux kernel's SCTP (Stream Control Transmission Protocol) implementation. The vulnerability occurs when a stream reconfiguration request is completed on an untransmitted chunk, leading to a null pointer dereference. This vulnerability can be triggered by an unprivileged process that removes an address and then requests a stream reset, causing the ker [truncated]
A vulnerability in the Linux kernel's SCTP implementation could allow an attacker to cause an underflow in the stream->outcnt variable, potentially leading to a denial of service. The vulnerability is caused by a cached RECONF chunk containing more than one request parameter, allowing a duplicate response to process the same ADD_OUT request again while another parameter is still outstanding, rolling back [truncated]
A use-after-free vulnerability was found in the Linux kernel's power: supply: bq24257 module. The issue arises from the STAT-pin interrupt remaining armed after the remove() function is called, allowing a threaded handler to fire and reschedule work against freed memory. This vulnerability requires attention from Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based [truncated]
A Linux kernel vulnerability has been resolved, involving the power supply bq256xx charger. The issue arises from the USB-PHY notifier queuing usb_work, which can dereference the charger after it has been freed. To address this, the reset devm action should be registered after the power supplies, ensuring that the notifiers are unregistered and usb_work is drained before the supplies are released.
A vulnerability in the Linux kernel's power supply driver bq25890 has been addressed. The driver did not properly release a reference to a secondary charger in certain probe failure scenarios or during driver detach, potentially leading to reference leaks. This issue was identified through code review, highlighting the importance of thorough examination of driver code to prevent such vulnerabilities. Linu [truncated]
A use-after-free vulnerability exists in the Linux kernel's charger-manager, which can lead to a crash or potentially allow attackers to execute arbitrary code if they can trigger the vulnerability. The vulnerability arises from the charger-manager's improper handling of regulator and power supply registration and deregistration. Specifically, the charger-manager registers regulators after exposing sysfs [truncated]
The Linux kernel vulnerability, CVE-2026-89471, is caused by insufficient validation of EC-reported port counts in the cros_usbpd-charger driver, potentially leading to a slab out-of-bounds write. This issue affects Linux kernel versions and can be mitigated by applying the provided patches. A malfunctioning, malicious, or compromised EC reporting port counts larger than the array size can cause this vuln [truncated]
A vulnerability in the Linux kernel's cros_usbpd-charger driver could allow a malicious embedded controller to return an inaccurate port count, potentially resulting in an out of bounds write and subsequent memory corruption. This issue arises from the driver's failure to properly validate port counts returned by the embedded controller, which could lead to memory corruption and potential denial of servic [truncated]
A use-after-free vulnerability was found in the Linux kernel's power: supply: lp8727 driver. The lp8727_release_irq() function did not properly synchronize the freeing of the IRQ and the cancellation of the delayed work, potentially leading to a use-after-free condition when the threaded IRQ handler lp8727_isr_func() is called after the IRQ has been freed.
A use-after-free vulnerability was found in the Linux kernel's qcom_battmgr module. The qcom_battmgr_pdr_notify() function queues enable_work when the PMIC GLINK service comes up, and the worker recovers battmgr through container_of() to issue firmware requests. However, the PMIC GLINK client stays on the client list until its devres release action runs, allowing a PDR notification to keep queueing the wo [truncated]
A Linux kernel vulnerability has been resolved in the power: supply: qcom_battmgr. The qcom_battmgr_sc8280xp_strcpy() function did not properly terminate strings from firmware, potentially allowing a firmware string that fills the whole field to cause a buffer overflow when read in user space. This issue could lead to unexpected behavior or crashes in affected Linux-based systems. Linux system administrat [truncated]
A use-after-free vulnerability exists in the Linux kernel's rt9455 power supply driver. The driver's threaded IRQ handler can queue delayed work, which can lead to a use-after-free condition when the driver is removed or encounters an error during initialization. This issue can cause system instability or potential exploitation. Linux kernel developers and maintainers, Linux distribution maintainers, and [truncated]
A use-after-free vulnerability exists in the Linux kernel's power: supply: ucs1002 driver. The vulnerability occurs because the health_poll delayed work is not properly cancelled when the driver is removed, allowing it to access freed memory. This issue was found by an in-house static analysis tool. The CVE record and NVD entry provide details on the vulnerability, but do not provide information on exploi [truncated]