These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A use-after-free vulnerability in the Linux kernel's virtio_pmem module allows for slab corruption and potential code execution. The vulnerability arises from the incorrect handling of request tokens, leading to a situation where a request can be freed while still being referenced. This issue has been addressed by introducing refcounting for struct virtio_pmem_request.
A vulnerability in the Linux kernel's drm/v3d component has been addressed. The issue involves a dangling pointer that can occur when v3d_fence_create() fails, potentially leading to system instability. This problem is resolved in the provided commits. The vulnerability was found in the Linux kernel's drm/v3d component, which is responsible for handling graphics and compute workloads. The drm/v3d componen [truncated]
A vulnerability in the Linux kernel's platform/chrome cros_ec_typec module allows for a buffer overflow when handling Partner Data Objects (PDOs) from the ChromeOS EC firmware. The issue arises from insufficient validation of source and sink cap counts, which are not properly checked against the maximum allowed value of 7. This can lead to a stack-based buffer overflow if the counts exceed the maximum lim [truncated]
A use-after-free vulnerability exists in the Linux kernel's HID core. When a driver's probe fails after enabling input delivery, the unwind process frees the struct hidraw object while in-flight HID reports may still be running on another CPU, leading to a use-after-free condition through hidraw_report_event(). This issue affects roughly half of the callers of the hid_device_io_start() API.
The Linux kernel has a vulnerability in the drm/amdgpu/pm/powerplay component. A bounds check is missing for voltage index in SMU7 lookup, which could lead to an out-of-range index being used. This issue has been resolved. Linux kernel developers and administrators should verify and apply the patch to prevent potential out-of-range voltage index access. The vulnerability could lead to potential security i [truncated]
A bounds-checking vulnerability was resolved in the Linux kernel's drm/amdgpu/pm/powerplay for Vega10 lookup, affecting voltage index calculations. This vulnerability could potentially allow for local privilege escalation if an attacker can trigger the out-of-bounds voltage index calculation. Linux system administrators and security teams should assess exposure and prioritize patching. The CVE record was [truncated]
A vulnerability in the Linux kernel's drm/amd/display component can lead to a dangling pointer if kzalloc() fails during plane reset. This issue has been resolved by allocating the new state first. The affected product is the Linux kernel, and the vulnerability class is related to memory management. The likely operational impact is a potential system crash or exploit. The source-confidence limits are base [truncated]
A race condition vulnerability in the Linux kernel's dmaengine xilinx_dma AXIDMA and MCDMA interrupt handlers could allow a channel to be incorrectly marked as idle, leading to spurious transfers and potential descriptor corruption or missed completions. This issue occurs when multiple descriptors are queued and active, and an interrupt fires after completing some descriptors, causing the channel to be ma [truncated]
A memory overread vulnerability was found in the Linux kernel's platform/chrome sensorhub. The issue arises from `max_response` and `sensor_num` being read from different EC commands, potentially causing the `msg->insize` to be clamped in `cros_ec_cmd_xfer()`. This could result in the subsequent `memcpy()` in `cros_ec_sensorhub_ring_handler()` overreading the `resp->fifo_info` buffer.
A high-severity vulnerability has been resolved in the Linux kernel, affecting RDMA/irdma. The vulnerability allowed userspace to deregister Memory Regions (MRs) backing QP/CQ/SRQ rings, potentially leading to system crashes or privilege escalation. Linux addressed this by adding refcounting to user ring MRs, preventing userspace from deregistering MRs that back QP/CQ/SRQ rings. This change ensures the st [truncated]
A memory leak vulnerability exists in the Linux kernel's nvmet-rdma component. When an NVMe target with RDMA transport is removed while I/Os are in flight, responses can be posted but their send completions are never delivered, leading to memory leaks of allocated RDMA read/write contexts and request SGLs. This issue can cause system instability or crashes due to potential memory exhaustion, especially in [truncated]
The Linux kernel has a high-severity vulnerability (CVE-2026-93148) that has been resolved, involving rejecting BTF accesses past object bounds for MEM_ALLOC BTF accesses. This vulnerability affects Linux kernel systems, particularly those using the affected versions. Defenders should prioritize verifying and applying patches for this vulnerability to prevent potential exploitation. The fix involves chang [truncated]
A vulnerability in the Linux kernel has been resolved, allowing for the rejection of writes through untrusted BTF pointers. The check_ptr_to_btf_access() function permits program-type btf_struct_access callbacks to validate writes before the default BTF access path rejects non-read accesses. This bypasses the read-only policy for untrusted BTF pointers created by helpers such as bpf_rdonly_cast().
A race condition vulnerability in the Linux kernel's bpf_get_btf_vmlinux function has been resolved. The vulnerability arises from the lazy parsing of vmlinux BTF under the bpf_verifier_lock and publishing the result through a plain store. This could lead to a concurrent first-time caller observing the pointer before the parsed contents are visible on a weakly ordered architecture.
A use-after-free vulnerability exists in the Linux kernel's bpf_find_vma() function, allowing for potential use-after-free when accessing the mm_struct of a foreign task. This vulnerability requires assessment and verification of Linux kernel configurations and BPF program usage to prevent potential exploitation. The bpf_find_vma() function reads task->mm and calls mmap_read_trylock(mm) without holding a [truncated]
A vulnerability in the Linux kernel has been resolved, involving the handling of sign-extending narrowing stack fills in BPF. When a spilled scalar is filled back with a sign-extending narrowing load, the scalar id is not dropped, leading to potential out-of-bounds access. This issue arises from the incorrect handling of sign-extending narrowing stack fills in BPF, which can result in out-of-bounds access [truncated]
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem can cause a verifier to record an incorrect memory size for a pointer, potentially leading to incorrect access checks. The flaw arises from the check_kfunc_args() function not properly bounding the rdonly_buf_size or rdwr_buf_size argument values for certain kfuncs, which can result in a u64 value being truncated when stored in a [truncated]
A Linux kernel vulnerability allows USB gadget users with local access to trigger an out-of-bounds write via the UAC1 and UAC2 configfs rate-list attributes. This issue can lead to a denial of service or potentially code execution. The vulnerability has been resolved with input validation added to reject additional tokens once the maximum rate limit is reached.
A vulnerability in the Linux kernel's USB gadget function f_fs has been addressed. The issue arises in the ffs_dmabuf_transfer() function, where error paths for endpoint-disabled and request-allocation failure conditions call dma_fence_put() on a fence that has not been fully initialized, leading to undefined behavior. Instead, kfree() should be used for cleanup at that stage.
A high-severity vulnerability was resolved in the Linux kernel, specifically in the platform/x86: asus-wmi module. The vulnerability involves resource leaks on probe failure, which could lead to various defensive consequences if left unaddressed. This issue arises from incorrectly ordered error path labels in the asus_wmi_add() function. Defenders and system administrators responsible for Linux kernel-bas [truncated]
A vulnerability in the Linux kernel has been resolved, requiring a BPF cpumask for bpf_cpumask_populate() to prevent the verifier from accepting borrowed cpumask pointers as writable destinations. The Linux kernel vulnerability requires attention from developers and administrators to assess exposure and prioritize verification of affected systems. The vulnerability has been resolved, but scope of affected [truncated]
A vulnerability in the Linux kernel has been resolved, involving the bpf (Berkeley Packet Filter) subsystem. The issue arises from the tracing_multi link not setting ftrace_managed, leading to a failure in releasing the tracing_multi link when attaching a tracing_multi link and then an fentry link. This oversight could allow for unintended behavior or exploitation in affected systems, emphasizing the need [truncated]
A vulnerability in the Linux kernel's RDMA/rxe component can cause duplicate completions, leading to data corruption and potential security issues. Defenders should assess exposure, prioritize remediation, and verify affected systems. The vulnerability occurs when a QP moves to the error state while a packet is being completed, causing the responder state machine to loop back into the request processing c [truncated]
A vulnerability in the Linux kernel's esp_ssg_unref() function can cause a page reference count underflow and potentially free a page still in use, leading to system instability or crashes. This issue arises when the function incorrectly unreferences managed frag pages in certain scenarios, such as with io_uring SEND_ZC and registered buffers. The vulnerability has a high severity score of 7.8 and require [truncated]
A vulnerability in the Linux kernel's hfsplus_delete_cat() function can lead to a buffer overflow when handling a corrupted HFS+ catalog B-tree. This occurs when the function attempts to rebuild the catalog key from a thread record without properly validating the record's size. An attacker could potentially exploit this vulnerability by providing a specially crafted HFS+ image, allowing for arbitrary code [truncated]
A vulnerability in the Linux kernel has been resolved, which could potentially allow for high impact attacks. The vulnerability is related to the use of __va(phys) for kaddr in direct_access. This change was made to correctly calculate the kernel virtual address for multi-range devices with physical gaps between ranges. The Linux kernel developers and administrators should assess exposure and apply patche [truncated]
A vulnerability was found in the Linux kernel's media ipu6 component. The issue arises from a double-free error when the auxiliary device is initialized. Specifically, the `ipu6_bus_initialize_device` function stores the isys/psys pdata pointer in `struct ipu6_bus_device` and initializes the auxiliary device. However, error unwinding must drop the auxiliary device reference and let `ipu6_bus_release` free [truncated]
A buffer overflow vulnerability was found in the Linux kernel's iwlwifi mei component. The vulnerability occurs when verifying the SAP message size before reading it. This could potentially allow an attacker to overflow the buffer. The issue arises from the lack of proper validation of the SAP message length, which could lead to a buffer overflow if the message size exceeds the buffer capacity. Linux kern [truncated]
A vulnerability in the Linux kernel's uio subsystem can lead to use-after-free memory access if a UIO device registration fails after the device becomes visible to userspace. This issue arises when an opener races with the failed registration path, causing the open file to keep a reference to the uio_device while the caller sees registration failure and may free its struct uio_info. Linux kernel developer [truncated]
A vulnerability in the Linux kernel's software node functionality has been addressed. The bounds check for the index passed to software_node_get_reference_args() was failing when passed UINT_MAX, leading to an out-of-bounds access in the property array. This issue has been resolved with a revised bounds check. The vulnerability was identified in the Linux kernel and has been patched to prevent potential e [truncated]