These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Linux kernel has a use-after-free vulnerability in the route4 classifier fastmap. A race condition allows a reader to cache a pointer to a filter after it has been unlinked and freed by a writer. This can cause a KASAN slab-use-after-free report when a packet hits the stale fastmap entry. The vulnerability was introduced in the Linux kernel's route4 classifier fastmap. The route4 classifier maintains [truncated]
The Linux kernel has a vulnerability in the packet send paths. packet_snd() and packet_sendmsg_spkt() do not consistently use the device's hard_header_len, which can lead to out-of-bounds writes. This issue arises because packet_snd() reads dev->hard_header_len multiple times while allocating and constructing an skb, and device reconfiguration can change this value concurrently. For SOCK_RAW, packet_snd() [truncated]
The Linux kernel has a vulnerability in the net: ipv6: clear suppressed fib6 rule result. fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_look [truncated]
The Linux kernel has a vulnerability that has been resolved, affecting the vhost component. The vulnerability involves the improper resetting of the vring metadata cache during vring reconfiguration, which can lead to memory access outside the region the IOTLB actually maps. This issue arises when VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail, and vq->used, or when VHOST_SET_VRING_NUM changes the regi [truncated]
The Linux kernel vulnerability CVE-2026-74579 is related to the netfilter: nft_payload module. The issue is with building the offload match mask for a payload expression that covers only part of a header field. This vulnerability has been resolved and patches are available. Linux kernel users and administrators should review and update Linux kernel configurations to ensure nft_payload module is properly s [truncated]
The CVE-2026-74575 vulnerability in the Linux kernel is a use-after-free vulnerability in the thunderbolt subsystem. This vulnerability is caused by a race condition between the tb_xdp_handle_request() function and the tb_xdomain_remove() function. The affected product is the Linux kernel. The likely operational impact is a potential for an attacker to execute arbitrary code or cause a denial of service. [truncated]
A use-after-free vulnerability exists in the Linux kernel's netfilter component. The nft_object rhltable is currently global, allowing access to objects being dismangled from the lookup path by other existing netns. This can lead to use-after-free of these objects being released. The issue is addressed by making the rhltable per table. The vulnerability requires attention from Linux administrators and sec [truncated]
A vulnerability in the Linux kernel's ksmbd implementation could allow an attacker to incorrectly treat different ClientGUID values as equal due to the use of strncmp() instead of memcmp(). This has been resolved by using memcmp() instead. The vulnerability affects Linux system administrators and security teams, who should assess exposure and verify kernel versions. The issue arises from the ksmbd impleme [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-15T13:17:56.530Z and has not been modified since then. The CVE-2026-74514 vulnerability involves a memory accounting issue in the KVM s390 pci module of the Linux kernel. The account_mem() and unaccount_mem() functions call get_uid(), which increments the reference count of struct user_struct on eve [truncated]
The CVE-2026-74510 vulnerability is a use-after-free issue in the Linux kernel's Bluetooth management code. This vulnerability has a high CVSS score of 7.8 and can lead to a use-after-free and a second list_del(). The issue arises when the pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending without holding the mgmt_pending_l [truncated]
The Linux kernel vulnerability, CVE-2026-74509, is a use-after-free error in the Bluetooth hci_sync module. This issue can lead to a crash or potentially allow an attacker to execute arbitrary code. The vulnerability has a high CVSS score of 8.8 and is considered HIGH severity. Linux kernel developers, maintainers, and users of Linux-based systems should review and apply patches as soon as possible. The v [truncated]
A Linux kernel vulnerability was resolved, affecting the ALSA usb-audio component. The vulnerability, discovered by XBOW and triaged by Baul Lee, could allow an attacker to trigger a heap out-of-bounds write when writing to a /dev/snd/midiC*D* node, given a USB device with a small bulk-OUT endpoint. This issue arises from the snd_usbmidi_akai_output() function not properly handling a small device-advertis [truncated]
A use-after-free vulnerability was found in the Linux kernel's fou_create() function. When adding a new FOU port to the per-netns list fails, the error path frees the fou object while it is still reachable through sk_user_data, allowing a concurrent receive to dereference the freed object. This issue can occur when local port 0 is requested, as fou_cfg_cmp() compares the requested port 0 and reports -EALR [truncated]
The Linux kernel vulnerability, CVE-2026-74493, is a use-after-free issue in the net/smc module during link group termination. This vulnerability allows for potential denial of service or code execution attacks. Affected systems include Linux kernel users and administrators, as well as developers working with the net/smc module. The vulnerability has been publicly disclosed and may be targeted by attacker [truncated]
The Linux kernel has a vulnerability in the netfilter: ipset component. A PatchSiren debrief based on the supplied source corpus indicates that the vulnerability can lead to a stale pointer being dereferenced when the queued add is replayed on the new table. This occurs when the mtype_resize() function copies comment pointers with memcpy(), not the comment objects themselves. Linux kernel users, system ad [truncated]
The Linux kernel vulnerability CVE-2026-74491 is related to of/address, specifically in of_pci_range_parser_one(), which could lead to a NULL bus dereference. This issue arises from the bus matching rework that made of_match_bus() return NULL for nodes with ranges/dma-ranges but no local #address-cells. Affected Linux kernel users should review system configurations for potential exposure and apply patche [truncated]
The Linux kernel has a use-after-free vulnerability in the TIPC socket tracepoints. The tipc_poll() function calls trace_tipc_sk_poll() without holding the socket lock or sk->sk_lock.slock, allowing the poll trace path to reach tipc_list_dump() and backlog head/tail dumping while another context dequeues and frees an skb. This vulnerability can be exploited by an attacker to potentially execute arbitrary [truncated]
A use-after-free vulnerability was found in the Linux kernel's mac80211 module. When stopping a BA session, the `ieee80211_stop_tx_ba_cb` function hands `tid_tx` to `kfree_rcu` and then reads `tid_tx->ndp` after dropping `sta->lock`. This read is not covered by an RCU read-side critical section and can run in preemptible process context. Softirqs can also run in this window, allowing the RCU callback to f [truncated]
The Linux kernel vulnerability, CVE-2026-74488, involves a use-after-free issue in the mwifiex driver when parsing A-MSDU TDLS frames. This occurs because the wrong length is passed to mwifiex_process_tdls_action_frame(), using the A-MSDU parent length instead of the subframe length. The vulnerability can lead to use-after-free and buffer over-read issues. Linux kernel developers, mwifiex driver users, an [truncated]
The Linux kernel has a vulnerability that has been resolved. The binfmt_misc interpreter clone for MISC_FMT_OPEN_FILE entries in load_misc_binary() denies write access via plain deny_write_access(). However, the clone is installed as bprm->interpreter and later released by the exec machinery through exe_file_allow_write_access(), which skips the i_writecount increment for files with FMODE_FSNOTIFY_HSM set [truncated]
The Linux kernel has a vulnerability in the binfmt_misc subsystem. A user can cause an out-of-bounds read by registering a specially crafted string that is not properly terminated. The vulnerability is caused by the 'check_special_flags' function not properly checking for the delimiter character, which can lead to the function reading past the end of the buffer.
The Linux kernel vulnerability, CVE-2026-74484, is caused by a binfmt_misc 'F' entry pinning its own instance, leading to a denial of service (DoS). The issue arises when an entry registered with 'F' opens its interpreter at registration time and holds that file until the entry is freed. If the interpreter lives on a mount that keeps that superblock alive, the two pin each other, resulting in a file that [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-15T13:17:53.163Z and has not been modified since then. The Linux kernel's binfmt_misc subsystem does not properly release user namespaces when a mount operation fails. This allows an unprivileged caller to leak one user namespace per failed mount attempt. The issue arises from the fact that generic_ [truncated]
A use-after-free vulnerability was found in the Linux kernel's memory management subsystem. The issue occurs in the __folio_split function, which is used to split a large folio into smaller ones. When the split operation is performed, the function fails to properly synchronize access to the inode's i_mmap_rwsem semaphore, leading to a potential use-after-free error. This could allow an attacker to cause a [truncated]
The Linux kernel vulnerability, CVE-2026-74481, involves a Use-After-Free (UAF) issue during suspend/resume cycles, specifically affecting the page reporting process. This problem arises because the page reporting work is scheduled on the global system_wq, which lacks the WQ_FREEZABLE flag. As a result, the PM freezer skips it, leading to UAF errors when pages are freed into the buddy allocator while susp [truncated]
The Linux kernel's pktgen module has a use-after-free vulnerability, CVE-2026-74479, which can lead to a slab-use-after-free error. This vulnerability affects Linux kernel users and administrators who use pktgen. The bug occurs due to a race condition between pktgen_change_name() and pktgen_remove_device(). To prevent potential exploitation, Linux kernel users should verify their pktgen configuration and [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-15T13:17:52.600Z and has not been modified since then. The Linux kernel's vector_mmsg_rx() function has a use-after-free vulnerability. When a packet's overlay header fails verification, the function frees the skb but does not clear the consumed slot, allowing the next iteration to read the freed sk [truncated]
A NULL pointer dereference vulnerability was found in the Linux kernel's uprobes subsystem. The vulnerability occurs when forking a task that has a pending uretprobe, which can cause a NULL pointer dereference in the clone() path. This issue was found on real hosts on the Meta fleet. The vulnerability affects the Linux kernel's uprobes subsystem and can be mitigated by applying the patch and monitoring sy [truncated]
The Linux kernel vulnerability CVE-2026-74476 was resolved by converting frag_list skbs before running XDP. A frag_list skb can reach veth with data_len set but nr_frags zero. The conversion ensures that XDP frags are only advertised when the resulting skb has frags[]. This vulnerability affects Linux kernel versions and may impact various Linux distributions. Users of these distributions should be aware [truncated]
A vulnerability in the Linux kernel has been resolved. The vxlan: use neigh_ha_snapshot() in route_shortcircuit() fix addresses a potential issue with reading the neighbour hardware address n->ha without holding the seqlock loop, which can lead to torn reads or reading a partially updated MAC address. This issue affects Linux kernel developers, administrators, and users who rely on the Linux kernel for th [truncated]