These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in the Linux kernel has been resolved, involving the bpf_arena_free_pages function. This function accepts scalar arena addresses, which are then masked to the low 32 bits and reconstructed into a full user address from the arena base. However, when the scalar value is below the low 32 bits of the arena base, the full user address falls below the user_vm_start, leading to an out-of-range fr [truncated]
A vulnerability in the Linux kernel's dmaengine dw-edma has been resolved. The vulnerability occurs because the dw-edma calls vchan_cookie_complete() when a deferred STOP reaches the interrupt handler, which schedules a callback for the active descriptor and leaves other issued or submitted descriptors queued. This can cause a late callback after dmaengine_terminate_sync() to dereference client state that [truncated]
A use-after-free vulnerability exists in the Linux kernel's ASoC (Advanced System on Chip) meson driver. The meson_card_reallocate_links function grows the DAI link and private data arrays with two consecutive krealloc() calls and updates the owner pointers only after both calls have succeeded. If the second krealloc() call fails, the card->dai_link still points to the block that krealloc() already freed, [truncated]
A vulnerability in the Linux kernel's RDMA/hfi1 component has been addressed. The set_txreq_header_ahg() function ignored the return value of sdma_txinit_ahg(), which could lead to request processing continuing as if initialization had succeeded, even if it failed. This issue has been resolved by propagating sdma_txinit_ahg() failures to the caller and aborting request processing when initialization fails.
A local unprivileged user can cause a denial-of-service (DoS) in the Linux kernel by posting a specially crafted Work Queue Entry (WQE) to a User Queue Pair (QP). The issue arises from the kernel's failure to validate the `num_sge` and `cur_sge` fields in user-submitted WQEs before indexing the `wqe->dma.sge` array. This can lead to an out-of-bounds read of the per-WQE scatter-gather (sge) array in the `c [truncated]
A vulnerability in the Linux kernel has been resolved, affecting ACPI processor validation of MADT IOAPIC entry bounds. This issue has a CVSS score of 7.3 and is considered HIGH severity. The vulnerability involves improper validation of MADT IOAPIC entry bounds in ACPI processor, which could lead to potential system instability. Defenders and administrators responsible for Linux kernel systems, especiall [truncated]
A vulnerability in the Linux kernel has been resolved, which could lead to kernel stack corruption when CONFIG_CFI_CLANG is enabled. The issue arises from incorrect tailcall jump offset calculation, causing the kernel to skip the stack pointer adjustment. This vulnerability affects Linux kernel deployments and requires immediate attention from Linux kernel maintainers, Linux distribution maintainers, and [truncated]
A use-after-free vulnerability was found in the Linux kernel's RDMA/core subsystem. The ib_destroy_cq_user() function did not properly synchronize the destruction of a CQ (Completion Queue) with its potential use through the netlink path, leading to a short window where the CQ could be accessed after its internal resources were freed. This issue affects Linux kernel versions and requires attention from de [truncated]
A use-after-free vulnerability was found in the Linux kernel's RDMA/core component. The ib_destroy_srq_user() function did not properly synchronize the destruction of SRQ resources, potentially allowing for a short window of accessibility after free. This issue has been resolved by moving the rdma_restrack_begin_del() call to the start of ib_destroy_srq_user().
A use-after-free vulnerability was found in the Linux kernel's RDMA/core component. The ib_free_cq() function did not properly synchronize the removal of a CQ from the restrack, leading to a potential use-after-free when accessing the CQ via the netlink path. This issue has been resolved by moving the rdma_restrack_del() call to before the freeing of vendor-specific resources.
A use-after-free vulnerability was found in the Linux kernel's RDMA/core component. The ib_dealloc_pd_user() function did not properly synchronize the deallocation of PD resources, potentially allowing a short window of time where the PD remained accessible through restrack after its internal resources had been freed. This issue requires verification of patch implementation and monitoring for potential ex [truncated]
A vulnerability in the Linux kernel has been resolved, which could potentially allow for a high-severity attack. The issue arises from the thermal: intel: int3400 component, where evaluate_odvp() creates per-ODVP sysfs files before the thermal zone and later probe resources are registered. In case of probe failures after evaluate_odvp(), the current unwind path does not properly clean up the ODVP files an [truncated]
A critical vulnerability was resolved in the Linux kernel, related to double-free of skb in xfrm_dev_direct_output(). This issue could impact network packet handling, potentially disrupting network operations. Linux kernel maintainers, network administrators, and security teams should assess exposure and verify patch application to mitigate potential risks. The vulnerability was resolved by changing the h [truncated]
A vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem has been addressed. The erdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and erdma_destroy_ah() functions did not properly clean up resources when the destroy command failed, potentially leading to resource leaks. This issue has been resolved by ensuring that all software-owned resources are released and returning [truncated]
A vulnerability in the Linux kernel's bpf_tracing_link_release function has been resolved. The issue arose from the improper updating of trampoline flags, leading to a warning. This problem could potentially impact the stability and security of systems utilizing the Linux kernel. The vulnerability was caused by the blindly 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier. A fexit attached to a tail_cal [truncated]
A vulnerability in the Linux kernel's iommu/tegra241-cmdqv has been resolved. The tegra241_vintf_init_lvcmdq() function stored a freshly allocated vcmdq pointer to the vintf->lvcmdqs[] array before it was fully initialized, which could lead to a NULL pointer dereference in the error ISR. The vulnerability has been resolved by publishing the vcmdq at the end of the allocation instead, with an smp_store_rel [truncated]
A vulnerability in the Linux kernel's iommu/tegra241-cmdqv has been resolved. The vulnerability occurs due to a lack of synchronization between the error ISR and VINTF (de)init, which can lead to a NULL dereference or use-after-free. This issue arises from the error interrupt handler reading cmdqv->vintfs[] slots without proper synchronization, allowing for concurrent access and potential data corruption. [truncated]
A vulnerability in the Linux kernel's iommu/tegra241-cmdqv has been resolved. The __tegra241_cmdqv_probe() function used devm_krealloc() to grow @smmu into the larger tegra241_cmdqv, which frees the original @smmu once it relocates. A failure after that returned NULL, and the caller then dereferenced the freed @smmu on its fallback path. This issue could lead to potential crashes if not properly addressed [truncated]
A vulnerability in the Linux kernel's iommu/tegra241-cmdqv has been resolved. The tegra241_vintf_init_vsid() function maps a guest vSID to a single physical Stream ID, but only warns when a device does not have exactly one stream. This can lead to issues with guest vSID invalidation and ATC and IOTLB entries. The mapping is now rejected with -EOPNOTSUPP if the device has a different number of streams.
A use-after-free vulnerability exists in the Linux kernel's RDMA/rxe component. When initializing an On-Demand Paging (ODP) memory region, the code fails to reset the 'mr->umem' pointer to NULL upon error, leading to a use-after-free condition when the memory region is later cleaned up. This vulnerability could allow local attackers to potentially escalate privileges or cause a denial of service. The issu [truncated]
A vulnerability in the Linux kernel's iSER (iSCSI over RDMA) implementation allows an initiator to declare a data segment larger than the bytes it actually sent, causing an out-of-bounds read of the receive buffer. This can lead to heap contents being written through the backend to the backing store. The vulnerability is triggered after login completes when an initiator sends a PDU with a declared data-se [truncated]
The Linux kernel has a vulnerability in the ath12k_wmi_process_csa_switch_count_event() function, which can cause an out-of-bounds read due to a missing policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT and insufficient validation of the num_vdevs field. This issue has been resolved by adding a TLV policy entry and a helper function to bound num_vdevs.
A vulnerability in the Linux kernel's ath11k component has been addressed, where an out-of-bounds read could occur due to insufficient validation of event structure lengths from firmware. This issue arises from the lack of a policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, leading to potential overreads when processing events. The fix involves adding a TLV policy entry for this event and intro [truncated]
A vulnerability in the Linux kernel's rtlwifi driver has been addressed. The issue was caused by an incorrect error path in the rtl_pci_probe() function, which led to skipped cleanup functions and unreverted successful calls. This has been fixed by updating the labels and adding relevant cleanup functions. The vulnerability affects Linux kernel versions and requires verification of kernel version status. [truncated]
A vulnerability in the Linux kernel's MHI host controller has been addressed. The issue occurs when the `mhi_register_controller` function adds a controller device before creating the optional `trigger_edl` sysfs file. If `sysfs_create_file` fails, the error path only drops the device reference, leaving the device registered. To fix this, `device_del` should be called in the error path before `put_device`.
The Linux kernel vulnerability CVE-2026-90401 has been resolved by removing REQ_NOWAIT support from raid1, raid10, and raid456. This change addresses issues with REQ_NOWAIT support in md personalities that can block internally, which could lead to divergent data in mirrors. The vulnerability affects Linux kernel configurations using raid1, raid10, or raid456. Defenders and system administrators should ass [truncated]
A PatchSiren debrief of CVE-2026-90399 based on the supplied source corpus. The CVE record was published on 2026-09-17T17:17:39.643Z and has not been modified since then. This vulnerability in the Linux kernel, specifically in the ath12k_wmi_mac_phy_caps_parse() function, can be exploited due to a stride mismatch in mac_phy_caps_parse(), allowing for potential buffer overflow attacks. Linux kernel maintai [truncated]
A PatchSiren debrief of CVE-2026-90398, a HIGH severity vulnerability in the Linux kernel's ath11k component. This vulnerability is caused by a stride mismatch in mac_phy_caps_parse(), which could allow attackers to write past the end of an allocated buffer. Linux administrators, security teams, and developers working with the Linux kernel's ath11k component should assess potential exposure and verify fir [truncated]
A potential use-after-free (UAF) vulnerability was found in the Linux kernel when reading BPF link information. The issue arises from accessing the link->prog pointer without holding any locks, which can lead to a UAF issue if the prog is concurrently replaced via bpf_link_update. This vulnerability has been resolved by accessing link->prog under RCU protection.
A high-severity vulnerability has been resolved in the Linux kernel, affecting the iommu/dma allocation path. The vulnerability arises from incorrect handling of allocation failure detection. This issue has been addressed through a direct check of the allocation result. The Linux kernel maintainers and users should assess exposure and prioritize patching to prevent potential issues. The vulnerability has [truncated]