These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Linux kernel's sockmap feature contains a use-after-free vulnerability. The sk_msg_recvmsg() function processes sk_msg in a lockless manner, allowing multiple threads to access the same sk_msg. This can lead to use-after-free attacks. The fix involves adding lock_sock() in udp_bpf_recvmsg() to serialize sk_msg_recvmsg(). The vulnerability affects Linux kernel administrators and developers, network sec [truncated]
A vulnerability in the Linux kernel has been resolved, involving an integer overflow in the bpf_msg_pop_data() bounds check. The addition of start and len, both u32, was evaluated in 32-bit and wrapped before storing it in last, allowing an out-of-range start/len to pass the bounds check. This could lead to a general protection fault when the pop loop runs off the end of the scatterlist.
The Linux kernel has a use-after-free vulnerability in the tipc_l2_send_msg() function. This vulnerability is caused by a race condition between tipc_disable_l2_media() and bearer_disable(). Linux administrators and users should verify their kernel versions and update if necessary. The CVE record was published on 2026-08-15T06:22:24.627Z and has not been modified since then. The vulnerability affects the [truncated]
The Linux kernel has a vulnerability where a large MTU can cause ip6_default_advmss() to return IPV6_MAXPLEN (65535), which is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535. However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel. If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer der [truncated]
The Linux kernel vulnerability (CVE-2026-72496) was resolved with a proper rollback for ioremap failure in the RDMA/bnxt_re module. The bnxt_qplib_alloc_dpi function returned success even if ioremap failed. This change impacts Linux kernel users and administrators who should verify updates for the RDMA/bnxt_re module. The vulnerability affects Linux kernel deployments using the RDMA/bnxt_re module. The pr [truncated]
The Linux kernel vulnerability, CVE-2026-72495, involves a resolved issue in RDMA/bnxt_re where applications could request multiple WC pages for the same ucontext. The fix adds a lock to avoid concurrent access and a check to fail repeated requests, also freeing the Doorbell page index if mmap entry insertion fails for WC pages. Linux kernel users and administrators should be aware of this vulnerability a [truncated]
A race condition vulnerability was found in the Linux kernel's net: serialize netif_running() check in enqueue_to_backlog(). This issue allows packets to escape the backlog flushing during device unregistration, potentially leading to a use-after-free (UAF) error. The vulnerability was reported by Syzbot and is related to a TOCTOU (time-of-check to time-of-use) race window introduced by a lockless netif_r [truncated]
A use-after-free vulnerability was found in the Linux kernel's ksmbd implementation. The same_client_has_lease function returns an opinfo pointer from ci->m_op_list after dropping ci->m_lock without taking a reference. This can lead to a use-after-free when smb_grant_oplock dereferences the pointer in copy_lease and when checking breaking_cnt. The vulnerability was resolved in the Linux kernel. To verify, [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-15T06:22:23.307Z and has not been modified since then. The vulnerability is in the Linux kernel's staging: rtl8723bs module, specifically in the rtw_aes_decrypt function, where the null-pointer-guard was incorrect, returning _FAIL on a valid pointer. This issue has been resolved. Linux kernel develo [truncated]
The CVE-2026-72489 vulnerability is a use-after-free issue in the nvec_rx_completed() function of the Linux kernel's staging: nvec module. This vulnerability has been resolved in the Linux kernel. The issue arises when an incomplete RX transfer is detected and the nvec_msg_free() function is called to return the message back to the pool. However, the code then accesses nvec->rx->data[0] to check the messa [truncated]
The Linux kernel has a vulnerability in the soundwire component, specifically in the sdw_add_element_group_count function. An out-of-bounds memory access occurs when i equals num in a for-loop. The issue has been resolved by adding a check for existing rate/lane entries in the group before adding them. This change prevents potential memory access issues and ensures the soundwire component operates within [truncated]
The Linux kernel vulnerability CVE-2026-72487 was patched to prevent crashes caused by out-of-bounds access and alignment faults. The fix involves adding checks to the PCI ROM header and data structure access. This vulnerability affects Linux kernel developers, administrators, and users who rely on the Linux kernel. The crash occurs due to an out-of-bounds access when reading 4 bytes from a broken ROM spa [truncated]
The Linux kernel has a use-after-free vulnerability in the mailbox mtk-adsp driver. When the SOF audio driver fails to initialize, its devres unwind frees the snd_sof_dev object that the mailbox client reaches via chan->cl->rx_callback. A late interrupt can still queue a threaded handler after mbox_free_channel() had cleared chan->cl, triggering a use-after-free.
The CVE-2026-72485 vulnerability affects the Linux kernel, specifically in the coresight platform. It is caused by incrementing the connection counter before allocation succeeds in coresight_add_out_conn() and coresight_add_in_conn(). This can lead to a NULL or garbage entry in the array, causing a panic when coresight_release_platform_data() iterates over the entries. The vulnerability has been resolved [truncated]
The Linux kernel has a vulnerability in the staging: most: video module. A double free issue occurs when video_register_device() fails in comp_register_videodev(). This happens because video_device_alloc() allocates a video_device, and video_register_device() releases it if registration fails. However, if __video_register_device() fails, it calls put_device(&vdev->dev), leading to v4l2_device_release() an [truncated]
The Linux kernel's iio subsystem, specifically the mma8452_read function, contains a vulnerability that has been resolved. The issue arises when the i2c_smbus_read_i2c_block_data function fails but mma8452_set_runtime_pm_state succeeds, causing mma8452_read to return 0. This leads the caller, mma8452_read_raw, to use a buffer containing uninitialized stack memory. The vulnerability has been addressed by a [truncated]
The Linux kernel has a vulnerability in the fs/ntfs3 module, specifically in the run_get_highest_vcn() function. This function does not perform bounds checking on a packed NTFS mapping-pairs buffer, which can lead to a slab-out-of-bounds read when a crafted $LogFile UpdateMappingPairs record is encountered. The vulnerability has been resolved by adding a bounds check to the function.
A vulnerability in the Linux kernel's xprtrdma module has been resolved. The issue involves decoupling req recycling from RPC completion to prevent premature freeing of rpcrdma_req structures. This change ensures proper handling of req structures and prevents potential crashes or security issues. Linux kernel developers, administrators, and users who rely on the xprtrdma module should review and apply the [truncated]
A Linux kernel vulnerability, CVE-2026-72472, was addressed by using nfsi->rwsem to protect traversal of the file lock list, preventing use-after-free problems with file locks in NFS. This change helps prevent use-after-free problems with file locks in NFS. The fix involves modifying the nfs_reclaim_locks function and moving the call to locks_lock_inode_wait into _nfs4_proc_setlk. System administrators an [truncated]
The Linux kernel has a vulnerability in the ntfs3 filesystem driver. When mounting a dirty NTFS volume, the log page size is adopted from the on-disk log, but the scratch buffer 'one_page_buf' is not resized accordingly. This can lead to a buffer overflow when reading log pages. The vulnerability exists due to a mismatch between the log page size recorded on disk and the size used for the initial allocati [truncated]
The Linux kernel vulnerability, CVE-2026-72469, relates to an ep kref imbalance on ADDR_CHANGE in the xprtrdma component. This issue arises from rpcrdma_cm_event_handler() calling rpcrdma_ep_put() without a matching get when RDMA_CM_EVENT_ADDR_CHANGE occurs before RDMA_CM_EVENT_ESTABLISHED. Consequently, the kref underflows during connect teardown, and rpcrdma_xprt_disconnect() operates on a freed ep. Use [truncated]
A local administrator can potentially crash the kernel with a NULL pointer dereference by racing an NFS/RDMA mount against RDMA device removal due to the delayed assignment of ep->re_id in rpcrdma_ep_create(). This issue arises from the Linux kernel's handling of RDMA device removal and NFS/RDMA mounts, allowing an administrator to exploit the vulnerability. The vulnerability has been resolved with an upd [truncated]
A vulnerability in the Linux kernel's xprtrdma has been resolved. The issue arises from the rpcrdma_xprt_connect() function ignoring the return value of frwr_wp_create(), which creates a singleton Memory Region for Write chunks with non-XDR-aligned payload lengths. If frwr_wp_create() fails after connection setup succeeds, xprt_rdma_connect_worker() sets XPRT_CONNECTED, leading to a potential NULL pointer [truncated]
The Linux kernel has a vulnerability in the xprtrdma component that could allow a remote attacker to leak the receive buffer and drain the Receive queue. This issue arises from two problems in the rpcrdma_is_bcall decode path. First, a speculative peek with xdr_inline_decode requests zero bytes, which can cause the five subsequent __be32 reads to walk past the wire payload into stale regbuf contents and m [truncated]
The Linux kernel has a vulnerability in xprtrdma reply credit grant sanitization, which could lead to rep allocation and Receive posting past re_max_requests. This vulnerability has been resolved by moving the credit clamp to immediately after the credit field is parsed. Linux kernel maintainers, users, and administrators should be aware of this vulnerability and take necessary actions to prevent potentia [truncated]
A use-after-free vulnerability exists in the Linux kernel's xfrm async resumption functionality. This issue arises from the incorrect handling of device references, leading to a potential use-after-free (UAF) of tunnel devices and a reference count leak of the original devices. The vulnerability can cause system instability, potential security bypass, or privilege escalation. Linux kernel developers, netw [truncated]
The CVE-2026-72462 vulnerability involves a race condition in unix socket mediation of AppArmor in the Linux kernel. This issue arises when accessing the peer path outside of the state lock, allowing for a race with unix_release_sock(). The fix involves taking the state lock and getting a reference to the path under lock. Linux kernel users and administrators who rely on AppArmor for unix socket mediation [truncated]
The CVE-2026-72459 vulnerability was found in the Linux kernel, specifically in the AppArmor component. The vulnerability occurs when aa_label_alloc() fails to properly clean up resources on allocation failure, potentially leading to resource leaks. This issue has been resolved by using aa_label_free() on the failure path. Linux kernel users should verify their systems are updated with the latest security [truncated]
The CVE-2026-72458 vulnerability is a NULL pointer dereference issue in the Linux kernel's AppArmor component. This vulnerability arises from the unpack_pdb function, which can fail if unpack_dfa returns NULL, potentially leading to a system crash. The vulnerability was published on 2026-08-15T06:22:19.783Z and has not been modified since then. Linux kernel users, especially those utilizing AppArmor, shou [truncated]
The Linux kernel vulnerability CVE-2026-72457 is related to AppArmor policy unpacking. The issue occurs when unpack_pdb() fails to allocate a missing ACCEPT2 table for older policy data, leading to a policydb with the required table missing. This vulnerability affects Linux kernel deployments and requires immediate attention from maintainers, users, and administrators. The fix involves returning -ENOMEM t [truncated]