These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Linux kernel vulnerability, CVE-2026-72340, relates to the microchip VCAP block, where different instances share the same hardware block and cache. This shared access can lead to races and data corruption. The fix involves introducing a single mutex to serialize access to all VCAP instances, preventing concurrent modifications and ensuring data integrity. Linux kernel users and administrators should b [truncated]
The Linux kernel vulnerability, CVE-2026-72338, is a TOCTOU heap OOB write in tc offload. The cls_flower classifier operates with TCF_PROTO_OPS_DOIT_UNLOCKED, while RTM_NEWACTION holds RTNL, making the race reachable in practice. KASAN confirms a slab-out-of-bounds write. The fix introduces reading tcfp_nkeys under act->tcfa_lock in all places using a new tcf_pedit_nkeys_locked() which replaces the old tc [truncated]
The Linux kernel's Bluetooth 6lowpan implementation is vulnerable to a use-after-free issue, which arises from a race condition between the debugfs enable write operation and the module exit path. This vulnerability affects Linux kernel developers and maintainers, Bluetooth 6lowpan users and deployers, and security teams responsible for Linux kernel vulnerability management. The issue allows the do_enable [truncated]
A use-after-free vulnerability exists in the Linux kernel's Bluetooth 6lowpan implementation. The bug occurs when the `lowpan_control_write` function accesses the L2CAP connection after the HCI connection has been closed. This can lead to a slab-use-after-free error. The vulnerability affects Linux kernel versions and can be exploited by an attacker to potentially execute arbitrary code or cause a denial [truncated]
A use-after-free vulnerability was found in the Linux kernel's Bluetooth MGMT component. The bug occurs when adding an advertising monitor and handling the MSFT offload add path, which can fail locally or in the MSFT add callback. This leads to a use-after-free error when the management completion frees the monitor on non-success after copying the response handle.
The Linux kernel has a vulnerability in the handling of Bluetooth ISO packets, specifically in the improper handling of malformed ISO_END/CONT packets. This issue arises because the Core specification (Part C vol 4 sec 5.4.5) does not explicitly exclude empty ISO_CONT and ISO_END packets. The current implementation rejects them if they are last in a sequence. However, if a controller sends a malformed seq [truncated]
The Linux kernel's Bluetooth L2CAP has a vulnerability where tx idents leak for commands without a response. This causes identifiers to be allocated but never released, potentially leading to exhaustion of the ident range and sending L2CAP_LE_CREDITS packets with an invalid ident of 0. The issue was fixed by releasing idents immediately after sending L2CAP_LE_CREDITS. Affected product deployments should b [truncated]
A deadlock vulnerability was found in the Linux kernel's accel/amdxdna component. The amdxdna_hwctx_sync_debug_bo() function holds the xdna->dev_lock while invoking a hardware callback, which may call amdxdna_pm_resume_get(). If the device is suspended, this may lead to a synchronous execution of amdxdna_pm_resume(), also acquiring xdna->dev_lock, causing a deadlock. To avoid this, amdxdna_pm_resume_get() [truncated]
The CVE-2026-72331 record indicates a potential use-after-free vulnerability in the Linux kernel due to a race condition in the accel/amdxdna component. The vulnerability arises from aie2_populate_range() and amdxdna_umap_release() accessing a saved VMA pointer that may have already been freed. Linux kernel users should verify their systems are updated with the latest security patches to mitigate potentia [truncated]
The Linux kernel has a vulnerability related to handling TLS application_data records. A peer may send a zero-length TLS application_data record, which can cause issues with the tls_sw_read_sock() function. The record has full_len == 0 after decryption. This vulnerability affects Linux kernel users and administrators, who should ensure their systems are updated with the latest patches to prevent potential [truncated]
The Linux kernel has a vulnerability that has been resolved. The PF SR-IOV enable path caches VF pci_dev pointers in dpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those entries do not own a reference, because the iterator drops the previous device reference on each step. The cached pointer is then dereferenced later when handling OCTEON_VF_FLR_REQUEST.
The Linux kernel has a vulnerability in the CAKE scheduler, where it accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. This can lead to a negative effective length wrapping to a large value, causing rate accounting to depend on integer wraparound rather than the packet size intended by userspace.
The Linux kernel vulnerability CVE-2026-72325 relates to the handling of perf/x86/amd/core features, specifically the interaction between Branch Sampling (BRS) and Last Branch Record (LBR). This vulnerability has the potential to cause a #GP error on certain processors when BRS is enabled inappropriately from the SVM reload path. The fix ensures that BRS is not enabled from the event selector reprogrammin [truncated]
A vulnerability in the Linux kernel's gpio mvebu driver has been addressed. The driver did not properly free generic chips on unbind, leading to a potential memory leak. The issue was resolved by explicitly calling irq_domain_remove_generic_chips() before irq_domain_remove(). This vulnerability affects Linux kernel developers and users who utilize the gpio mvebu driver. The vulnerability may also affect o [truncated]
A race condition exists between device teardown and incoming IGMP query processing, leading to a Use-After-Free in the IGMP timer callback. The issue is resolved by using refcount_inc_not_zero() to prevent acquiring a reference if the device is already being destroyed. This vulnerability affects the Linux kernel and could allow an attacker to cause a kernel panic. Linux kernel developers, administrators r [truncated]
A race condition exists between device teardown and incoming MLD query processing in the Linux kernel, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary reference to inet6_dev is dropped, which can drop its refcount to 0. The actual freeing of inet6_dev memory is deferred via RCU. Concurrently, the packet receive path runs under RCU read lock and obtains the inet6 [truncated]
A potential memory leak vulnerability was found in the Linux kernel's IPv4 IGMP implementation. The vulnerability occurs when a timer is deleted and not re-armed in the igmp_mod_timer() function or stopped in the igmp_stop_timer() function. This can lead to a memory leak if the group im was concurrently removed from the list by ip_mc_dec_group(). The issue has been resolved by using ip_ma_put(im) instead [truncated]
A vulnerability in the Linux kernel has been resolved, ensuring inner headers in ICMP errors are in headroom for the ipvs component. This issue relates to the ipvs component and has been addressed. Linux kernel maintainers, users, and administrators should review the patches and update their systems accordingly. The vulnerability affects the Linux kernel and requires verification of the ipvs component and [truncated]
A use-after-free vulnerability was found in the Linux kernel's SUNRPC TLS connect path. The vulnerability occurs when the upper rpc_clnt is not pinned across the delayed connect_worker, leading to a potential use-after-free error when the connect_worker fires after the rpc_clnt has been freed. This issue affects Linux kernel versions and could allow attackers to execute arbitrary code or cause denial-of-s [truncated]
A Linux kernel vulnerability was resolved, involving the regulator core's handling of nested mutexes. The regulator_lock_two function was incorrectly checking for EDEADLOCK instead of EDEADLK, which could lead to improper handling of deadlocks on certain architectures. This issue primarily affects MIPS platforms as the regulator core is not built or used on other affected platforms.
The Linux kernel has a vulnerability that has been resolved in the drm/fb-helper module. The issue involves synchronizing fbdev output to the vblank of an active CRTC. The fix ensures that only active CRTCs are considered for vblank sync, addressing warnings related to vblank wait timeouts. This change affects Linux kernel developers and maintainers, users of Linux distributions, and administrators respon [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-15T06:22:04.013Z and has not been modified since then. CVE-2026-72312 relates to a vulnerability in the Linux kernel, specifically in the octeontx2-af module. The vulnerability affects the Virtual Function (VF) bring-up process, which can inadvertently impact the Physical Function (PF) promiscuous s [truncated]
A vulnerability in the Linux kernel has been resolved, involving the drm/xe component. The issue pertains to the handling of madvise VMA arrays during L2 flush failure. Specifically, the function xe_vm_madvise_ioctl() allocates memory for madvise_range.vmas in get_vmas(). However, in the event of an L2 flush validation failure after get_vmas() has succeeded, the code incorrectly jumps directly to madv_fin [truncated]
The Linux kernel has a vulnerability in the smb: client: fix overflow in passthrough ioctl bounds check. A malicious server can use a large OutputOffset and a small OutputCount to make the wrapped sum pass the bounds check, allowing for a potential out-of-bounds read. This vulnerability affects Linux kernel developers and users, as well as security teams monitoring for potential malicious server activity. [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-15T06:22:03.673Z and has not been modified since then. The CVE-2026-72309 vulnerability was found in the Linux kernel's tracing/remotes functionality. A memory leak occurs in the trace_remote_alloc_buffer() error path due to desc->nr_cpus not being incremented before page allocation. This results in [truncated]
A vulnerability was found in the Linux kernel's mlxsw_sp_port_lag_join() function, which could lead to a reference count leak. When mlxsw_sp_port_lag_index_get() fails, the function returns an error without releasing the lag reference obtained earlier. This issue has been resolved by replacing the bare 'return err' with a goto to the existing error cleanup label, ensuring the reference is safely dropped.
The Linux kernel's ASoC SOF ipc4-control component has a TOCTOU vulnerability in the sof_ipc4_bytes_put function. The function derives the copy size from the old data->size in the buffer rather than the incoming new data's size field from ucontrol. This can lead to truncation of valid data or copying of stale bytes. The vulnerability affects Linux kernel maintainers, Linux distribution vendors, and users [truncated]
The Linux kernel has a vulnerability in the ASoC: SOF: ipc3-control component. The vulnerability is related to the use of overflow checks in control_update size calculation. The expected_size calculation uses firmware-provided cdata->num_elems in arithmetic that could overflow on 32-bit platforms, wrapping to a small value. This could allow the cdata->rhdr.hdr.size comparison to pass with mismatched sizes [truncated]
A use-after-free vulnerability was discovered in the Linux kernel's ASoC (Advanced System on Chip) SOF (Sound Open Firmware) ipc3-control module. The vulnerability arises from a timing issue (TOCTOU, or Time-of-Check-to-Time-of-Use) in the `bytes_put` and `bytes_get` functions. In `sof_ipc3_bytes_put()`, the size used for the memcpy operation is derived from the old `data->size` already in the buffer, rat [truncated]
The Linux kernel has a vulnerability in the ASoC: SOF: topology component. The vulnerability is related to the validation of vendor array sizes before parsing. A malformed topology with a truncated trailing vendor array can cause the parser to read the size field before a full vendor-array header is available. This issue has been resolved by validating that the remaining private data contains a complete s [truncated]