These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A Linux kernel vulnerability was addressed in the hp-bioscfg component. The vulnerability involves the incorrect passing of element counts to package parsers, potentially leading to out-of-bounds heap reads when shorter packages are accepted. This issue requires verification of affected versions and remediation from official sources. The vulnerability was addressed through a patch that corrects the elemen [truncated]
A Linux kernel vulnerability has been resolved, involving io_uring/waitid task_work cancellation. The io_waitid_cb() function was not honoring task_work cancellation, which could lead to incorrect behavior when the callback ran from a fallback kworker. This has been fixed by checking for cancellation before entering __do_wait(). The fix ensures that the io_uring/waitid task_work cancellation is properly h [truncated]
A vulnerability in the Linux kernel's io_uring/query functionality allows users to request excessive zeroing of memory, potentially leading to a denial-of-service. The issue is reachable without a ring via IORING_REGISTER_QUERY. The CVE record was published on 2026-09-11T20:19:09.687Z and has not been modified since then. This vulnerability can cause a denial-of-service condition due to excessive memory z [truncated]
A use-after-free vulnerability was found in the Linux kernel's interconnect subsystem. When the dynamic allocation for path->name fails, the error handling path directly calls kfree(path) to free the path object, but prior to this point, path_find() calls path_init(), which links the path's requests into the req_list of the respective interconnect nodes. This leaves dangling pointers in the hlist, causing [truncated]
A vulnerability in the Linux kernel's IPMB (IPMI Message Buffer) implementation can allow reading of uninitialized stack bytes. The issue arises from the `ipmb_write` function reading message fields before validating the length byte. This can lead to information disclosure if a zero or short write is made. The vulnerability has been resolved by requiring a non-empty buffer and the minimum IPMB request length.
A vulnerability in the Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem has been addressed. The issue arises from the creation of sysfs files during the registration process of IPMI interfaces. Specifically, when the creation of the 'maintenance_mode' file fails, the error path does not properly clean up the previously created 'nr_users' and 'nr_msgs' files. This oversight can lea [truncated]
A NULL pointer dereference vulnerability in the Linux kernel's IPMI message handler has been resolved. The vulnerability occurs when the BMC device returns a nonzero completion code to the Get Device ID command, causing the ipmi_add_smi() function to log an error and invoke the lower driver's shutdown callback. However, the intf->in_shutdown flag is not set on this failed-registration rollback path, allow [truncated]
A vulnerability in the Linux kernel's IPMI interface has been resolved. If an error occurs during startup, scheduled work must be canceled before the interface can be freed. This issue may impact Linux kernel users, particularly those with IPMI interface usage. The vulnerability class involves improper handling of work scheduling during error conditions. The source confidence is high based on the CVE reco [truncated]
A vulnerability in the Linux kernel's net/iucv module allows for frame delivery to AF_IUCV sockets without proper ingress device checks, potentially leading to DoS, data injection, and fabric noise. The issue arises from afiucv_hs_rcv() selecting sockets based solely on transport header name fields, not considering the net_device the frame arrived on. This can cause issues such as accept-queue exhaustion, [truncated]
A vulnerability in the Linux kernel's XDP (eXpress Data Path) has been resolved. The issue arises from the incorrect handling of zero-copy frames in the `xdp_convert_zc_to_xdp_frame` function, which can lead to out-of-bounds access and potential kernel panic. This vulnerability affects Linux kernel developers and maintainers who need to review and apply patches promptly. The issue is related to the handli [truncated]
A use-after-free vulnerability exists in the Linux kernel's slip (Serial Line IP) implementation. The vulnerability occurs due to the slip_devs array storing bare net_device pointers without taking a reference on them. This can lead to a use-after-free condition when the device is freed while still being accessed through the slip_devs array. The issue arises because the priv_destructor is called from netd [truncated]
A vulnerability in the Linux kernel's network TUN driver can cause a denial of service when handling packets with large headroom requests. The TUN driver does not properly validate headroom requests, allowing an attacker to trigger an underflow and potentially execute arbitrary code. However, there is no evidence of exploitation or impact. This issue affects Linux kernel developers and maintainers, networ [truncated]
This PatchSiren debrief is based on the supplied CVE record and source corpus. The Linux kernel vulnerability (CVE-2026-80999) relates to the use of gpiod_set_value_cansleep for reset GPIO in the Realtek DSA driver. The vulnerability has been resolved by switching to gpiod_set_value_cansleep() to prevent warnings when the reset GPIO is provided by a sleeping controller.
A vulnerability in the Linux kernel's bnxt network driver has been addressed. The driver could stall the TX queue under certain conditions when handling bursts of packets and USO (UDP Segmentation Offload) operations. This issue could occur when the bnxt_sw_udp_gso_xmit function returns early with a NETDEV_TX_BUSY status, potentially leaving the doorbell not rung and thus preventing the device from proces [truncated]
A vulnerability in the Linux kernel's net: ipa component can cause a stalled modem TX queue after runtime resume, potentially leading to permanent transmit stalls and impacting network connectivity. This issue arises from the ipa_start_xmit() function unconditionally stopping the TX queue before calling pm_runtime_get(), relying on the wake scheduled by runtime resume (ipa_modem_wake_queue_work()) to rest [truncated]
A vulnerability in the Linux kernel's net: l2tp module has been addressed. The issue involves not propagating multicast notification errors for tunnel create, modify, session create, and session modify netlink handlers. This change ensures that best-effort notification errors do not report failure for operations that have already committed, which could cause callers to retry and accumulate live objects. N [truncated]
A use-after-free vulnerability exists in the Linux kernel's net: mctp module. The issue arises from mctp_route_lookup() using rt->dev without holding a reference to it, allowing the route's device to be torn down concurrently by an unprivileged local AF_MCTP user on the receive/forwarding path, potentially leading to system instability or crashes. This vulnerability requires immediate attention from Linux [truncated]
A use-after-free vulnerability exists in the Linux kernel's Open vSwitch implementation. When processing the `CMD_DEL` command, the `ovs_flow_cmd_fill_info` function may access the `flow->mask` pointer after it has been freed, potentially leading to a crash. The vulnerability was reported by Trend Micro's Zero Day Initiative as ZDI-CAN-32042. The issue arises from the `ovs_flow_cmd_fill_info` function usi [truncated]
A vulnerability in the Linux kernel's phylink_inband_caps function can cause a kernel panic due to improper validation of returned PCS values. This issue arises when the function fails to properly check for error pointers returned by mac_select_pcs, leading to potential dereferences of invalid PCS ops. The fix involves using the IS_ERR_OR_NULL macro to handle both NULL and error pointer cases, preventing [truncated]
A vulnerability in the Linux kernel's network component has been addressed. The issue involves the ravb driver, which could potentially dereference an invalid PTP clock, leading to a NULL pointer dereference. This could occur before the first open of the PTP clock or if registration fails, leaving an error pointer. The vulnerability has been resolved by caching the PHC index separately and reporting -1 wh [truncated]
A use-after-free vulnerability in the Linux kernel's ravb network driver has been addressed. The issue arises from a race condition between ravb_ptp_interrupt() and ravb_ptp_stop(), which can lead to a use-after-free error when accessing the PTP clock. To mitigate this, the patch utilizes READ_ONCE() and WRITE_ONCE() for lockless access to the clock pointer, atomically detaches it with xchg() before disab [truncated]
A vulnerability in the Linux kernel's Thunderbolt network implementation could allow an attacker to cause a resource leak. The issue arises from the handling of Rx HopIDs in the `tb_xdomain_alloc_in_hopid` function, which can lead to a reference count mismatch and prevent the release of allocated HopIDs. This vulnerability has been resolved in the Linux kernel.
A vulnerability in the Linux kernel's NTB (Non-Transparent Bridging) subsystem can cause a denial of service when the QP (Queue Pair) link is down. The vulnerability occurs because the ntb_transport_tx_enqueue() function returns 0 instead of -ENOLINK when the QP link is down, causing the skb (socket buffer) to leak. This issue has been resolved by returning -ENOLINK instead, which restores the contract th [truncated]
A vulnerability in the Linux kernel's NTB (Non-Transparent Bridging) subsystem can cause a memory leak when handling oversized TX buffers. The vulnerability is resolved by rejecting oversized buffers in the ntb_transport_tx_enqueue() function. This fix prevents potential resource exhaustion and denial-of-service (DoS) attacks. Linux kernel developers and maintainers should review and apply patches as need [truncated]
A Linux kernel vulnerability was resolved, involving net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages. The vulnerability causes a slab-out-of-bounds read due to accessing memory past the end of an allocated buffer when handling SMC-Rv2 LLC messages. This issue arises from the incorrect handling of the v2 extension in LLC messages, leading to out-of-bounds memory access. Linux kernel developers, [truncated]
A vulnerability in the Linux kernel's net/smc has been addressed. The SMC-Rv2 LLC messages were not properly handled, allowing oversized messages to be carried in the queue entry. This could lead to deletion of registered rtokens and installation of new rtokens. The issue has been resolved by copying the tail into the queue entry and declaring rkeys that fit inline as a member of the union.
A vulnerability in the Linux kernel's net/smc module could allow a local attacker to cause a NULL pointer dereference on the SMC-D teardown path, potentially leading to a system crash. The vulnerability was resolved by sampling the pointer once in the helper and reporting nothing prepared while it is unset. Linux kernel developers and administrators should review the Linux kernel patch notes and apply the [truncated]
A Linux kernel vulnerability has been identified in the net/smc implementation, which could lead to a socket reference count leak. This issue arises from the smc_switch_conns function not properly releasing a reference to the SMC socket in certain error scenarios, potentially resulting in the socket remaining alive indefinitely. This could prevent the network namespace from being torn down and lead to resource leaks.
A use-after-free vulnerability was found in the Linux kernel's net/smc component. The smc_rx_pipe_buf_release function did not properly handle socket state changes, leading to potential use-after-free issues. This vulnerability has been resolved by taking the socket lock first and testing conn->freed instead. The vulnerability affects Linux kernel developers and maintainers, as well as system administrato [truncated]
A use-after-free vulnerability was found in the Linux kernel's net/smc component. The smc_llc_srv_add_link function improperly accesses memory after it has been freed, potentially leading to unexpected behavior or crashes. This issue has been resolved in the kernel. The vulnerability can be triggered when a link without a shared v2 receive buffer is used. The smc_llc_srv_add_link function keeps add_llc po [truncated]