These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in the Linux kernel's i3c subsystem allows for an unlocked dereference of dev->desc in the i3c_device_get_supported_xfer_mode() function. This could potentially lead to a crash or other undefined behavior. The issue arises from the function's failure to hold the bus->lock when accessing dev->desc, which is necessary for safe dereferencing. This vulnerability impacts the stability and secur [truncated]
A Linux kernel vulnerability has been patched, affecting the i3c master device unregister path. This vulnerability could potentially lead to information leaks and use-after-free issues. The patch ensures that the device descriptor remains valid until device_unregister() has completed, preventing these issues. Linux kernel developers and maintainers should review and apply the patch to prevent potential in [truncated]
A Linux kernel vulnerability allows for an out-of-bounds write in the Inter-Integrated Circuit (I3C) subsystem. The `svc_i3c_master_handle_ibi` function does not properly bound the IBI payload to the requested `max_payload_len`, leading to a potential buffer overflow. This issue can be triggered when a device sends more bytes than the slot holds, causing an out-of-bounds write into the IBI pool. Linux ker [truncated]
A use-after-free vulnerability exists in the Renesas I3C driver of the Linux kernel. The driver uses an asynchronous model for data transfer, which can lead to a situation where the interrupt handler accesses freed memory if the transfer times out. This issue can cause system crashes and potential data corruption. Linux kernel developers, maintainers, and users of affected systems should prioritize patchi [truncated]
A memory leak vulnerability has been identified in the Linux kernel's brcmfmac component. The vulnerability occurs in the brcmf_sdio_read_control() function, where memory allocated for 'buf' is not freed in some error paths. This issue has been resolved by adding vfree() calls in the affected error paths. The brcmfmac component is used in various Linux kernel deployments, and users who rely on this compon [truncated]
A memory leak vulnerability was found in the Linux kernel's iwlwifi dvm module. The bug occurs in the iwl_op_mode_dvm_start() function, where an error path can cause a memory leak of priv->eeprom_blob. This issue was resolved by reordering the error handling labels. The vulnerability was identified in the Linux kernel and could potentially lead to denial-of-service attacks if exploited. Linux kernel maint [truncated]
A Linux kernel vulnerability allows for a kernel memory exposure attempt detected from SLUB object 'fuse_request'. This issue arises from the fuse-io-uring transport, which copies request headers directly to and from userspace, bypassing the CONFIG_HARDENED_USERCOPY protection. The vulnerability can lead to a system crash and potential kernel memory exposure. Linux kernel administrators and security teams [truncated]
A vulnerability in the Linux kernel's crypto: iaa component has been resolved. On a hardware analytics error, decompress retries through the software fallback, which writes req->dst with the CPU while it is still mapped DMA_FROM_DEVICE. With SWIOTLB active, the later dma_unmap_sg() copies the stale bounce buffer over req->dst, corrupting the result. Unmap before the fallback runs.
A vulnerability in the Linux kernel's mwifiex driver can lead to stack corruption when a synchronous command's wait is interrupted, allowing a late firmware response to write to a stale stack address. This occurs because the driver keeps the caller-provided data buffer in cmd_node->data_buf, and several callers pass stack-allocated objects there. If wait_event_interruptible_timeout() is interrupted, the c [truncated]
The Linux kernel has a vulnerability in the rtlwifi driver, specifically in the rtl92du_tx_fill_desc() function, which does not properly check the QoS TID before indexing into the sta_entry->tids[] array. This can lead to an out-of-bounds access. The issue was detected by a static analysis tool and confirmed by manual audit. The vulnerability allows for potential out-of-bounds access attacks, which can le [truncated]
A memory leak vulnerability was found in the Linux kernel's rtw88 wifi driver, specifically in the rtw_txq_push_skb() function. The function does not free the skb when it fails, which can lead to a memory leak. This vulnerability requires patching to prevent potential denial-of-service. Linux kernel maintainers, Linux distribution vendors, and users of the affected rtw88 wifi driver should assess exposure [truncated]
A resource leak vulnerability was found in the Linux kernel's rtw88 PCI driver. When NAPI setup fails, the driver does not properly clean up allocated PCI resources, leading to a resource leak. This issue can cause system instability and decreased performance. The vulnerability was introduced due to inadequate cleanup in the rtw_pci_probe() function, specifically when rtw_pci_napi_init() fails. An experim [truncated]
A Linux kernel vulnerability was resolved by adding a .shutdown callback to the rtw89 PCI driver to prevent asynchronous SError Interrupts during warm reboot. The vulnerability was caused by hardware rfkill polling, which was not stopped during shutdown, leading to a kernel panic. The fix involves setting a new RTW89_FLAG_SHUTDOWN flag to stop rfkill polling work when the platform is tearing down the PCIe [truncated]
A deadlock vulnerability was found in the Linux kernel's mt76 module, specifically in the mt7615_suspend function. This issue arises when the function attempts to acquire the mt76 mutex while waiting for the mac_work to complete, which in turn is blocked on the same mutex. To address this, the patch flushes scan_work and mac_work before taking the mutex, ensuring consistency with other suspend paths in mt [truncated]
A vulnerability in the Linux kernel's mt76 driver has been addressed. The mt7915_mcu_get_eeprom function did not properly validate the device EEPROM address before copying data, allowing for a 16-byte out-of-bounds write. This issue can be triggered by a malicious or malfunctioning device reporting an arbitrary address. The vulnerability has been resolved by adding bounds checking for the EEPROM address, [truncated]
A use-after-free vulnerability was found in the Linux kernel's mt76 driver, specifically in the mt7925 module. The mlo_pm_work workqueue is not canceled on the stop path, leading to a potential crash when the device is torn down. This issue has been resolved by adding a stop callback for mt7925 that cancels the work before calling mt792x_stop(). The vulnerability could lead to system crashes or errors if [truncated]
The Linux kernel has a vulnerability in the mt76 driver, specifically in the mt7996_mcu_get_eeprom function. This function does not properly validate the destination address of the EFUSE/EXT block copy, which can lead to an out-of-bounds write. A malicious or malfunctioning device can report an arbitrary address, potentially causing a buffer overflow.
A PatchSiren debrief of CVE-2026-80934, a vulnerability in the Linux kernel's wifi mt76 driver. The vulnerability causes a TX DMA mapping leak for AddBA req frames, which can lead to DMA mapping exhaustion and failures for other on-SoC consumers. Linux kernel maintainers, wifi mt76 driver users, and security teams should assess exposure and verify if their Linux kernel version is affected. The CVE record [truncated]
The Linux kernel has a vulnerability in the mt76 driver, specifically in the mt7996 module, where it fails to validate the default EEPROM firmware size. This can lead to a buffer read beyond the firmware buffer during variant validation or fallback copy if a truncated file is provided. The vulnerability requires attention from system administrators and security teams to prevent potential local attacks and [truncated]
A use-after-free vulnerability exists in the Linux kernel's virtio_vsock. The flaw occurs due to a race condition between the removal of the virtio_vsock and the execution of its associated work items. Specifically, the `virtio_vsock_remove` function stops the virtqueues and then flushes each work item before freeing the enclosing `virtio_vsock`. However, the current order does not account for dependencie [truncated]
A vulnerability in the Linux kernel's w1_f19_i2c_master_transfer function allows for an out-of-bounds read when handling I2C block reads. The function fails to reject oversized lengths, leading to a potential buffer overflow. This issue affects Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems. The vulnerability has a CVSS score of 7.8 and is classif [truncated]
A vulnerability in the Linux kernel's tpm_i2c_nuvoton module has been addressed. The i2c_nuvoton_wait_for_stat function enables the IRQ before waiting for an interrupt handler to report a status change. If the wait times out or is interrupted before the handler runs, the function returns without balancing the enable_irq call. This can lead to improper IRQ handling.
A use-after-free vulnerability was found in the Linux kernel's smack_file_send_sigiotask() function. The bug occurs when accessing the credentials of another task using both tsk->cred and __task_cred(tsk). This can lead to a KASAN-reported UAF of struct cred. The issue has been resolved by always accessing the objective credentials. The vulnerability allows for potential elevation of privileges or denial [truncated]
A vulnerability in the Linux kernel's timekeeping subsystem has been addressed. The __do_adjtimex() function did not check the return value of tk_get_aux_ts64(), potentially leading to the use of uninitialized stack data in calculations if the auxiliary clock is disabled and then enabled. This could indirectly leak data to userspace. The vulnerability has been resolved by adding a check for the return val [truncated]
A use-after-free vulnerability exists in the Linux kernel's ksmbd implementation, specifically in the oplock break notification. This issue allows an authenticated client to potentially execute arbitrary code or cause a denial of service by exploiting the freed connection. The vulnerability has a critical CVSS score of 9.8 and requires immediate attention. The use-after-free condition can lead to potentia [truncated]
A vulnerability in the Linux kernel's VLAN feature has been resolved. The issue occurs when toggling hardware VLAN TX offload on a lower device, causing a data race that leads to skb_under_panic and a mismatch between allocated headroom and header creation. This vulnerability affects Linux kernel developers, administrators, and users who need to assess exposure and apply patches. The issue has been resolv [truncated]
A use-after-free vulnerability exists in the Linux kernel's Bluetooth ISO subsystem, specifically in the `iso_conn_ready` function. This function attempts to create a child socket from a listener socket that has been concurrently closed, leading to a potential use-after-free error when the child socket is later disconnected. The issue affects Linux kernel versions and could allow for system crashes or pot [truncated]
The Linux kernel vulnerability in selinux security_get_classes() allows for NULL pointer dereference. This vulnerability was published on 2026-09-04T18:18:01.047Z and was last modified on 2026-09-14T13:18:48.763Z. The vulnerability exists in the selinux security_get_classes() function, which can lead to a NULL pointer dereference. The vulnerability has been resolved by rejecting unclaimed class values. Li [truncated]
The Linux kernel has a vulnerability in the drm/amdgpu module that has been resolved. The fix involves rejecting UVD messages with an invalid number of h265 references to avoid overflow when calculating the minimum dpb size. This vulnerability requires attention from Linux kernel developers and administrators responsible for maintaining systems with the drm/amdgpu module to verify system exposure and appl [truncated]
The Linux kernel has a vulnerability, tracked as CVE-2026-80908, that could lead to a potential overflow in DPB size calculations. This issue was resolved by rejecting UVD messages with dimensions above 4096. The vulnerability affects Linux kernel deployments, particularly those using AMD GPUs. Administrators should verify affected product deployments, review official advisories, and plan vendor-supported [truncated]