These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in the Linux kernel's cfg80211_wext_siwgenie() function allows for an out-of-bounds read and integer underflow when processing a malformed IE buffer. This issue can be triggered by a local attacker through the SIOCSIWGENIE and SIOCSIWESSID ioctls, potentially leading to a denial of service. The vulnerability has been resolved by validating the IE buffer in cfg80211_wext_siwgenie() before storing it.
A vulnerability in the Linux kernel's Bluetooth RFCOMM implementation can cause an out-of-bounds read of uninitialized memory when processing truncated frames. This issue was resolved by validating the frame length before accessing its contents. The fix ensures that frames smaller than the minimum header size plus one byte for FCS are rejected, preventing potential exposure to out-of-bounds memory reads a [truncated]
A vulnerability in the Linux kernel's vhost-scsi component can allow an attacker to write responses to unrelated userspace objects, potentially leading to data corruption or other security issues. This issue arises from the component's failure to properly flush backend operations after device ioctls, allowing in-flight commands to access old memory mappings. The vulnerability has been resolved, and patche [truncated]
A Linux kernel vulnerability allows a circular dependency in SCSI error handling, potentially causing a deadlock and preventing I/O submission. This issue occurs when the SCSI error handler thread waits for a sched tag held by a requeued command, which cannot complete until the error handler thread restarts the queues. The problem arises from the SCSI error handler attempting to allocate a request via scs [truncated]
A vulnerability in the Linux kernel's netfilter component has been addressed. The nfnetlink_log module did not properly wait for RCU readers to complete before freeing per-net state, potentially leading to use-after-free issues. This has been resolved by moving the logger pointer clearing to the .pre_exit phase. The change ensures that RCU readers have completed before per-net storage is freed, preventing [truncated]
A Linux kernel vulnerability allows user-controlled oversized block lengths to reach tracepoint memcpy calls and driver callbacks unchecked, enabling potential out-of-bounds reads and writes. The issue was resolved by adding early validation in __i2c_smbus_xfer() to reject block transfers with zero or excessive lengths. This change prevents potential out-of-bounds read/write attempts and system instabilit [truncated]
A vulnerability in the Linux kernel's ksmbd module allows for incorrect access checks, potentially leading to STATUS_ACCESS_DENIED errors. The vulnerability has been resolved with improved access checks and maximal access calculations. This fix addresses the issue by properly considering Authenticated Users ACEs and processing only applicable ACEs for access calculations. It also modifies the handling of [truncated]
A vulnerability in the Linux kernel's greybus audio module can lead to out-of-bounds reads when parsing topology blobs. This occurs because the module-supplied size fields for sections like controls, widgets, and routes are not checked against the fetched topology blob size. As a result, a malicious module could provide a small topology size with large section sizes, causing the parsing code to access mem [truncated]
A vulnerability in the Linux kernel's RDMA/bnxt_re subsystem has been resolved. The destroy callbacks currently zero the udata output after tearing down driver resources. If the userspace access fails, uverbs preserves the uobject and allows the destroy callback to run again, even though the driver resource has already been freed. This issue allows userspace access to fail and uverbs to preserve the uobje [truncated]
A vulnerability in the Linux kernel's PCI/pwrctrl tc9563 has been resolved. The issue involves parsing the integrated Ethernet MAC Endpoint node under DSP3. The existing logic had an out-of-bounds issue when parsing both physical functions of the Endpoint device. This vulnerability requires attention from Linux kernel maintainers, administrators, and users of affected systems to assess their configuration [truncated]
A use-after-free vulnerability was found in the Linux kernel's md/raid5-ppl component. The loop in ppl_do_flush() continues iterating after calling ppl_io_unit_finished(), leading to a use-after-free. This issue has been resolved with a break statement to stop the loop once io is freed. The vulnerability affects Linux kernel versions and requires verification of affected systems and prioritized patching o [truncated]
A use-after-free vulnerability was found in the Linux kernel's powerpc/xive component. When xive_init_ipis() fails, the error path frees the global xive_ipis array, but xive_smp_probe() ignores this failure and proceeds to call xive_setup_cpu_ipi(), which dereferences the already-freed xive_ipis pointer. This issue can lead to potential system crashes or instability due to use-after-free attacks. The vuln [truncated]
A use-after-free vulnerability in the Linux kernel's ACPI bus has been addressed. The `acpi_get_first_physical_node()` function could return a stale device pointer, leading to a use-after-free issue if the caller invoked `get_device()` on the pointer. A new function, `acpi_bus_get_primary_device()`, has been introduced to reference count the device before returning the pointer, mitigating this issue.
A use-after-free vulnerability exists in the Linux kernel's vxlan_mdb_flush() function. This function is used to flush multicast database entries. When an entry is removed, it can trigger the removal of another entry, leading to a use-after-free error. This can occur when flushing the remotes of a (*, G) entry, which also removes (S, G) entries that were created for its source list.
A Linux kernel vulnerability was resolved, addressing an issue where a killed job could be stuck in the exit path for several hours due to memory reclaim and OOM killer serialization. The issue was caused by serialization behind the oom_lock, which could lead to a killed job being stuck in the exit path for several hours. This was observed in a job with ~55 GiB memory.max and zswap enabled, which had almo [truncated]
A vulnerability in the Linux kernel's memcg (memory cgroup) subsystem has been addressed. The v1 soft limit knob has been made inert, as it has been deprecated since Linux kernel version 6.12. This change decouples the interface from its implementation, keeping the memory.soft_limit_in_bytes interface but making writes to it inert and always reporting the maximum value on read.
A Linux kernel vulnerability allows page table corruption on LoongArch CPUs with specific configurations, potentially leading to system instability or crashes. The issue arises from the incorrect definition of DIRECT_MAP_PHYSMEM_END, affecting memory region searches and vmemmap population. This vulnerability impacts Linux systems using LoongArch CPUs, requiring prompt assessment and patching to prevent po [truncated]
A Linux kernel vulnerability has been resolved, which could expose stale disk data beyond the previous end-of-file (EOF) after remounting or crash recovery. This issue arises when extending file size across an unaligned EOF boundary, as post-EOF data in the partial page may not be zeroed out in the page cache and marked dirty. The vulnerability involves a fix to zero post-EOF data when extending file size [truncated]
A vulnerability in the Linux kernel's nfsd has been addressed. The hand-rolled seqcount-like protocol in nfsd_nl_rpc_status_get_dumpit() was missing a read memory barrier (smp_rmb) before its second counter check. This could cause the CPU to reorder field reads past the second counter check on weakly-ordered architectures, making the retry logic ineffective.
A vulnerability in the Linux kernel's svcrdma has been resolved. The vulnerability involves rejecting Write/Reply chunks with segcount 0. A peer can send a Write or Reply chunk with a zero segcount field, which was not properly rejected. This could lead to potential issues with the parsed chunk lists. The fix ensures that such malformed frames are rejected at the decode boundary.
A typec switch leak vulnerability was found in the Linux kernel's phy: fsl-imx8mq-usb component. The vulnerability occurs when probe fails after imx95_usb_phy_get_tca() succeeds, causing a typec switch leak as the only cleanup path was in .remove(), which never runs on probe failure. This issue can lead to potential denial of service and requires verification of probe failure and driver removal cleanup pa [truncated]
A vulnerability in the Linux kernel's svcrdma has been resolved. The issue arises when svc_rdma_accept() fails before rpcrdma_rn_register() succeeds, leading to an unmatched rn_unregister and a potential memory leak. This vulnerability can cause memory leaks and potentially lead to security incidents if not addressed. The Linux kernel patch fixes the svcrdma vulnerability by adding a guard to rpcrdma_rn_u [truncated]
A vulnerability in the Linux kernel's nfsd subsystem has been addressed. The issue involves the nfsd_net structure, which contains several boolean fields accessed from concurrent contexts without proper serialization. This can lead to a double-free vulnerability and data corruption when multiple threads attempt to update these fields simultaneously.
A vulnerability in the Linux kernel's SMB client has been addressed, hardening the DFS cache against invalid target hints. The fix ensures that callers of get_tgt_name() are hardened against ERR_PTR results and dfs_cache_noreq_update_tgthint() is protected against NULL pointer dereferences. This change prevents potential issues with NULL pointer dereferences and ERR_PTR results, enhancing the security and [truncated]
A critical vulnerability has been resolved in the Linux kernel, specifically in the SUNRPC (Sun Remote Procedure Call) implementation. The vulnerability arises from the improper handling of the rpc_gss_wire_cred structure in the svcauth_gss_decode_credbody() function. This function is responsible for decoding credentials in the RPC service. The issue occurs when the function fails to zero out the rpc_gss_ [truncated]
A Linux kernel vulnerability allows unprivileged processes to read the entire PCI config space when a privileged process opens the config space file and passes the file descriptor. This discrepancy in capability checks between procfs and sysfs interfaces can be exploited to bypass restrictions. The vulnerability arises from differing capability checks between procfs and sysfs interfaces for PCI config spa [truncated]
A Linux kernel vulnerability has been resolved, addressing an issue with the iommu/arm-smmu-v3 component where improper teardown management could lead to use-after-free. The vulnerability was introduced due to the incorrect order of cleanup during the device removal process, which could result in accessing the IOPF queue after it has been freed. This issue has been fixed by managing the teardown with devm [truncated]
The Linux kernel vulnerability CVE-2026-53266 has been resolved. The ebtables SNAT target was not making the ARP sender hardware address rewrite writable, potentially causing issues with packet rewriting. This vulnerability affects Linux kernel-based systems, particularly those using the ebtables SNAT target. Linux kernel maintainers, network administrators, and security teams should assess exposure and a [truncated]
A vulnerability in the Linux kernel's batman-adv module could allow an attacker to corrupt CRC values, potentially leading to issues with claim validation and backbone updates. This vulnerability arises from the handling of claims and modifications to the backbone of claims for CLAIM frames from remote backbones and local packets. The issue can cause CRC corruption due to parallel claim additions, affecti [truncated]
The Linux kernel vulnerability in dm-pcache allows for out-of-bounds read and write via cache segment id from persistent memory. This vulnerability requires validation checks to prevent potential data corruption and system instability. Affected systems include Linux kernel deployments utilizing dm-pcache, particularly those with untrusted or unauthenticated cache devices. The vulnerability can be exploite [truncated]