These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A use-after-free vulnerability exists in the Linux kernel's libceph component. When the authorizer is updated, the `auth->authorizer_buf` and `auth->authorizer_buf_len` are not refreshed, leading to a potential KASAN slab-use-after-free error in `_copy_from_iter()` during a subsequent msgr1 reconnect. This issue affects Linux kernel deployments utilizing the libceph component. Operators should review syst [truncated]
The CVE-2026-68155 vulnerability involves a flaw in the Linux kernel's handling of monmaps in the libceph library. A monmap with zero monitors can cause a client crash when attempting to open a session with a monitor in __open_session(). This happens because the 'BUG_ON(monc->monmap->num_mon < 1)' assertion in pick_new_mon() is triggered. The patch extends a check in ceph_monmap_decode() to also reject ar [truncated]
The Linux kernel vulnerability, CVE-2026-68154, is related to the libceph module. It has been resolved by rejecting zero bucket types in crush_decode. The CRUSH bucket type 0 is reserved for devices, and accepting a bucket with type 0 could lead to a negative bucket ID being treated as a device, causing an out-of-bounds index in the OSD weight array. This vulnerability has a critical CVSS score of 9.8 and [truncated]
A use-after-free vulnerability was found in the Linux kernel's libceph module. The `ceph_destroy_client()` function tears down the monitor client before removing per-client debugfs files, allowing a concurrent read of the monmap debugfs file to trigger a use-after-free error. To address this, the debugfs files should be removed before stopping the OSD and monitor clients.
The Linux kernel has a use-after-free vulnerability in AMT delayed works. When an AMT device is removed, pending delayed works can still access the freed amt_dev structure, potentially causing kernel crashes or memory corruption. This vulnerability is related to the AMT (Advanced Management Technology) component of the Linux kernel. The affected component is used for remote management of Intel-based syste [truncated]
A vulnerability in the Linux kernel's binfmt_elf_fdpic has been resolved. The program header scan handles PT_INTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. This allows a binary carrying more than one PT_INTERP to overwrite both interpreter_name and interpreter, leading to a memory leak and a denial of service.
A vulnerability in the Linux kernel has been resolved, related to the emergency thaw double-unlock of s_umount. The do_thaw_all function iterates over all superblocks with SUPER_ITER_EXCL, which acquires s_umount exclusively. However, the callback do_thaw_all_callback calls thaw_super_locked, which unconditionally releases s_umount, resulting in a second unlock attempt that corrupts the rwsem state.
A HIGH severity vulnerability was found in the Linux kernel, with a CVSS score of 8.4. The vulnerability is related to the preservation of ACL_DONT_CACHE state in the forget_cached_acl() function. This state is meant to be a constant state for inodes in filesystems that opt out of POSIX ACL caching. A commit introduced a bug that causes the loss of this state, leading to potential stale cached values bein [truncated]
A use-after-free vulnerability was found in the Linux kernel's fscrypt implementation. The fscrypt_direct_keys table, which caches master keys for v1 encryption policies, did not properly compare super_block pointers when finding existing keys. This could lead to inodes with different super_blocks pointing to the same fscrypt_direct_key, extending its lifetime beyond the super_block it points to and causi [truncated]
The Linux kernel vulnerability (CVE-2026-68147) was caused by dynamic allocation in fscrypt_get_devices(), which could fail and cause a use-after-free. The issue was resolved by switching to an on-stack array. This HIGH-severity vulnerability in the Linux kernel requires immediate attention to prevent potential local privilege escalation attacks. Linux kernel developers, Linux distribution vendors, system [truncated]
A race condition vulnerability in the Linux kernel's ftrace subsystem allows multiple threads to corrupt the internal state of the trace_parser structure, leading to undefined behavior or corrupted input. The vulnerability is caused by the lack of synchronization when accessing the trace_parser structure across multiple threads. The affected handler paths include open, write, and release handlers. To fix [truncated]
The Linux kernel vulnerability (CVE-2026-68145) allows for an out-of-bounds bitmap_set() operation with a zero-length range. This issue arises in ifs_set_range_dirty() and ifs_set_range_uptodate() functions. A !len guard has been added to both functions to prevent this issue. Linux kernel users and administrators should verify patches and monitor system logs for suspicious activity. The vulnerability has [truncated]
A use-after-free vulnerability was found in the Linux kernel's phonet: pep. The pep_get_sb() function does not account for potential skb data relocation caused by pskb_may_pull(), leading to a use-after-free error. This issue has been resolved by refetching the header with skb_header_pointer() after pskb_may_pull(). The vulnerability affects Linux kernel developers and maintainers, Linux distribution vend [truncated]
The Linux kernel's net: slip module is vulnerable to an out-of-bounds write due to a race condition between MTU changes and receive processing. This can be exploited by a local attacker to potentially escalate privileges. The vulnerability affects Linux kernel users, administrators, and developers. Linux kernel users should prioritize patching this vulnerability to prevent potential local privilege escala [truncated]
The Linux kernel has a vulnerability in the geneve device that allows for unauthorized configuration changes. The vulnerability requires CAP_NET_ADMIN in the device netns for changelink operations. A patch has been applied to gate geneve_changelink with rtnl_dev_link_net_capable(). Linux kernel administrators and users who utilize geneve devices should be aware of this vulnerability and take steps to miti [truncated]
A NULL pointer dereference vulnerability exists in the Linux kernel's af_iucv module. The vulnerability is caused by a failure to check for a NULL pointer in the afiucv_hs_callback_syn() function. When the allocation of a child socket fails, the function will call iucv_sock_kill() with a NULL pointer, resulting in a NULL pointer dereference. The affected product deployments should be reviewed for potentia [truncated]
A use-after-free vulnerability was found in the Linux kernel's net/iucv component. When a peer severs a connection, the iucv_path is freed, but queued message notifications still hold raw pointers to the connection's iucv_path, leading to a potential use-after-free error when these notifications are later processed. The vulnerability has been resolved by dropping queued notifications when the path is seve [truncated]
A vulnerability in the Linux kernel has been resolved, related to the net/mlx5e driver. After a PCIe DPC recovery, the mlx5 reloads affected functions and replays multiport affiliation events. The issue arises when the MPV devcom registration publishes mlx5e private data to the component peer list before storing the returned component device in priv->devcom, potentially leading to a NULL pointer dereferen [truncated]
The Linux kernel's net/sched module is vulnerable to a use-after-free / double-free exploit due to a race condition in qdisc_rtab_list and a non-atomic refcnt. This is caused by cls_flower setting TCF_PROTO_OPS_DOIT_UNLOCKED, leading to tc_new_tfilter() keeping rtnl_held == false. The bug affects the kmalloc-2k struct qdisc_rate_table and can lead to system-wide corruption. Linux kernel users, administrat [truncated]
A use-after-free vulnerability was found in the Linux kernel's X.25 network protocol implementation. The `x25_kill_by_neigh` function did not properly handle socket lifetime, allowing a concurrent close operation to free the socket while it was still being accessed. This could lead to a slab-use-after-free error. The vulnerability affects Linux kernel deployments using the X.25 protocol. To address this, [truncated]
A vulnerability in the Linux kernel has been resolved, which could lead to a kernel panic when processing GRO (Generic Receive Offload) packets. The issue arises from the lack of a flush check in `skb_gro_receive_list()`, allowing packets marked with `NAPI_GRO_CB(skb)->flush` to be re-aggregated, potentially corrupting the frag_list chain structure.
A vulnerability was found in the Linux kernel's net: hip04 component. The issue causes a RX buffer leak when build_skb() fails in hip04_rx_poll(). This leads to resource leaks as the current RX buffer and its DMA mapping are not released, and a newly allocated RX fragment is not freed when dma_map_single() fails. To address this, the current slot should be kept intact and the budget returned so NAPI retri [truncated]
The Linux kernel ptp_s390 module has a vulnerability that requires facility 28 to be installed and PTFF QAF to return that PTFF QPT is available to register the physical clock. This HIGH-severity vulnerability can lead to potential security issues if not patched. Affected systems should be reviewed for Linux kernel updates and patches applied as soon as possible. The vulnerability is related to the ptp_s3 [truncated]
A vulnerability has been identified in the Linux kernel, specifically in the ice driver, which could lead to a call trace during PTP release when a PF reset occurs. The issue arises when the PTP state is ICE_PTP_UNINIT and ice_ptp_rebuild() updates the state to ICE_PTP_ERROR, resulting in an invalid state transition. This has been observed when passing PF1 through to a VM and ice_ptp_init() fails due to c [truncated]
The Linux kernel had a vulnerability where an emergency thaw deadlock could occur on frozen block devices due to a circular dependency between s_umount and bd_fsfreeze_mutex. This was caused by do_thaw_all_callback() calling bdev_thaw() while holding sb->s_umount exclusively. The issue was resolved by not holding s_umount around the bdev_thaw() loop and instead pinning the superblock with an active reference.
A vulnerability in the Linux kernel has been resolved. The rbd: Reset positive result codes to zero in object map update path allows a corrupted reply to an object map update to trigger an assertion in __rbd_obj_handle_request(). This issue arises because rbd_object_map_callback() does not reset positive result codes to zero, unlike rbd_osd_req_callback(). As a result, a corrupted reply can cause the rbd_ [truncated]
The Linux kernel vulnerability, CVE-2026-68130, is related to ksmbd, a kernel module that provides SMB/CIFS server functionality. An authenticated attacker can exploit this vulnerability to destroy a victim's session by manipulating the NTLM blob username field and PreviousSessionId. The issue arises from the improper handling of the destroy_previous_session() function, which is called before the NTLMv2 r [truncated]
The Linux kernel's gve Rx buffer refill loop vulnerability allows for potential denial-of-service via queue stall under extreme memory pressure. This issue arises when the system is under extreme memory pressure, causing page allocations to fail during the Rx buffer refill loop. If the number of buffers posted to hardware falls below a critical low threshold and the refill loop exits due to allocation fai [truncated]
A flaw was found in the Linux kernel's ice module, where the ice_parser_profile_init function did not properly validate the ptype value. This could lead to an out-of-bounds write in the prof->ptypes bitmap, causing a kernel page fault. The issue arises when a malicious VF provides a ptype value greater than or equal to 1024 through VIRTCHNL. The fix is to reject out-of-range ptype values with an -EINVAL error.
A use-after-free vulnerability exists in the Linux kernel's ILA (Identifier-Locator Addressing) implementation. The issue arises when the `pskb_may_pull` function is called, potentially freeing the old skb head and leaving the `ip6h` pointer dangling. This can lead to a slab-use-after-free in `ila_update_ipv6_locator` when processing an IPv6 packet routed through a configured ILA csum-adjust-transport rou [truncated]