These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in the Linux kernel's swiotlb has been resolved. The swiotlb_alloc_tlb() function can allocate from the DMA atomic pool when a decrypted pool is needed from atomic context. However, swiotlb_init_io_tlb_pool() reconstructs the pool virtual address from the physical start address, which can store the wrong address in pool->vaddr for atomic-pool backed allocations. This can cause issues when [truncated]
The Linux kernel vulnerability CVE-2026-90383 has been resolved by removing the direct walker in the GRU TLB miss handler. This change sends interrupt faults directly to user polling mode, allowing the existing call-OS fallback to retry them in process context. The vulnerability was addressed by modifying the GRU TLB miss handler to remove the direct walker and send interrupt faults to user polling mode. [truncated]
A vulnerability in the Linux kernel's mt76 module has been addressed. The issue involves handling channel contexts with different bands in the mt76_switch_vif_chanctx() function. This vulnerability has been resolved through a rework of the mt76_switch_vif_chanctx() function to properly handle channel switches on different radios within a short timeframe.
A use-after-free vulnerability in the Linux kernel's mt76_rx_poll_complete function has been addressed. The issue arises from a race condition where a STA has been removed, but the rx_status still references the wcid in the STA. This vulnerability affects Linux kernel versions and requires verification of affected scope and remediation from official sources.
A vulnerability in the Linux kernel's mt76 Wi-Fi driver has been addressed. The vulnerability occurs when an AER (Advanced Error Reporting) error happens and the bus is hung, causing register reads to return 0xFFFFFFFF. This leads to corrupted DMA queue state and results in an invalid memory access. The fix involves validating the DMA index read from the hardware before using it as a queue index, clamping [truncated]
A vulnerability in the Linux kernel's mt76 driver has been resolved. The issue occurs in the `mt7915_mcu_get_sta_nss` function, where a peer's VHT/HE MCS map with no supported spatial stream can cause an underflow in the `nss` variable, leading to an invalid value being written to the firmware's `sta_rec_bf` beamforming fields. This vulnerability requires verification and patching to prevent potential exp [truncated]
A high-severity vulnerability, CVE-2026-90371, has been resolved in the Linux kernel, affecting the mt76 wifi module. The issue involves a race condition in RXDMAD_C buffer recycling, which could lead to undefined behavior. This CVE was published on 2026-09-17T17:17:36.263Z and was last modified on 2026-09-18T18:17:55.623Z. The vulnerability has a CVSS score of 8.8, indicating high severity. Defenders res [truncated]
A high-severity vulnerability has been resolved in the Linux kernel related to WiFi mt76 driver. The vulnerability occurs when the tx worker is disabled in SER, which could lead to corruption of descriptors or tokens. The issue arises from mt7996_mac_reset_work() parking the tx worker and disabling RX/TX NAPIs before taking dev->mt76.mutex. This fix involves taking the mutex before disabling the worker, a [truncated]
A vulnerability in the Linux kernel's bpf subsystem has been resolved. The `btf_distill_func_proto` function accepts a function argument up to 16 bytes, but the current implementation assumes an __int128 argument only needs one register. This under-allocation causes the `save_args` function to overwrite adjacent stack slots. The vulnerability affects Linux kernel versions and maintainers should assess exp [truncated]
A vulnerability in the Linux kernel's wifi mt76 mt7915 driver can cause a denial of service or potentially lead to code execution if exploited. The issue arises from improper handling of TWT flow agreements with the firmware, leading to potential list corruption and crashes. This vulnerability is considered high severity with a CVSS score of 8.8. The vulnerability affects Linux kernel deployments using th [truncated]
A use-after-free vulnerability was found in the Linux kernel's mt76 module, specifically in the mt7915_register_ext_phy function. When an error occurs during the registration of the main PHY, the function unwinds through free_phy2, which frees the ext PHY hw while it is still registered with mac80211. This can lead to a use-after-free condition. The vulnerability affects Linux kernel-based systems using t [truncated]
A vulnerability in the Linux kernel has been resolved, affecting arm64 ptrace. The issue involves keeping 'orig_x0' in-sync with x0 on syscall entry. A fix was attempted but was incomplete, leading to this CVE. The CVSS score is 8.4, indicating high severity. This vulnerability impacts Linux kernel systems using arm64 ptrace, requiring defenders to assess exposure and prioritize patching. The issue has be [truncated]
A vulnerability in the Linux kernel's cfg80211 has been resolved. The issue arises from the improper teardown of PMSR requests during P2P and NAN interface stopping, potentially leading to stale request retention and misuse by the driver. This vulnerability requires verification and patching to prevent potential issues with driver state inconsistencies. Defenders responsible for Linux kernel-based systems [truncated]
A vulnerability in the Linux kernel's firmware coreboot has been resolved. The existing coreboot_table_populate() bounds checks limit individual entries to the mapped length. However, coreboot_table_probe() replaces the platform resource length with header and table sizes supplied by firmware before mapping the full table. This could allow a malformed table to overflow the 32-bit size addition or advertis [truncated]
A vulnerability in the Linux kernel's PCI: dwc: ep has been resolved. The vulnerability involves flushing cached MSI writes before unmapping the iATU. This issue is significant for defenders as it could potentially lead to misrouted or dropped writes. The fix involves reading back from the mapped MSI window before the unmap to drain any posted MSI writes. This ensures that the write reaches the Root Compl [truncated]
A use-after-free vulnerability exists in the Linux kernel's HID subsystem. When a HID device probe fails, the driver resources are released without stopping concurrent report callbacks, potentially leading to a use-after-free condition. This issue can cause system crashes, elevation of privileges, or unauthorized access. The vulnerability requires immediate attention from Linux kernel developers, system a [truncated]
A use-after-free vulnerability exists in the Linux kernel's blk-cgroup component. When switching an IO scheduler on a block device, a race condition can occur between policy activation and blkg destruction, leading to use-after-free and memory leak issues. This vulnerability can cause system crashes, memory leaks, and potential elevation of privileges. Linux kernel developers, system administrators, and u [truncated]
A use-after-free vulnerability in the Linux kernel's blk-cgroup has been resolved. The issue occurs when switching IO schedulers on a block device, which can lead to a use-after-free in rcu_accelerate_cbs. This happens because blkcg_activate_policy() can race with concurrent blkcg deletion. The fix involves checking hlist_unhashed(&blkg->blkcg_node) before getting a reference to the blkg. This check is us [truncated]
A vulnerability in the Linux kernel's ublk subsystem has been addressed. The issue arises from the improper handling of the import_ubuf() function, which can fail if the provided address range is outside the allowed user address space. This can lead to the passing of an uninitialized struct iov_iter to ublk_copy_user_pages(). The vulnerability affects Linux kernel deployments and requires verification of [truncated]
A vulnerability in the Linux kernel's ocfs2 filesystem has been addressed. The vulnerability involves the validation of inline extended attributes (xattrs) during inode block validation. A patch series has been applied to validate OCFS2 xattr entry name/value bounds when xattr metadata is read and validated. This helps prevent potential use-after-free and out-of-range entry array or offset issues from cor [truncated]
A vulnerability in the Linux kernel's ocfs2 file system has been addressed. The ocfs2_validate_xattr_block() function did not properly verify that non-indexed block's xh_count and entry offsets fit inside the block, and indexed buckets reached list/get consumers without an entry-bounds check. This could lead to a use-after-free vulnerability when reading metadata.
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) implementation has been addressed. The issue involves the handling of RCU (Read-Copy-Update) pointers after a spin lock is released in a sleepable BPF program. This could potentially lead to a use-after-free vulnerability, as demonstrated by a capability-limited runtime PoC that triggered a task_struct use-after-free in __bpf_get_task_stac [truncated]
A vulnerability in the Linux kernel's drm/omap: dsi component has been addressed. The issue involved a copied isr table which could potentially lead to use-after-free (UAF) vulnerabilities if interrupts were unregistered during handling. This debrief assesses the defensive significance and provides recommended actions for Linux kernel maintainers and administrators.
A vulnerability in the Linux kernel's bpf (Berkeley Packet Filter) subsystem has been identified. The vulnerability arises from a type confusion issue that occurs when the check_atomic_load() function calls check_load_mem() before verifying the source pointer type with atomic_ptr_type_ok(). This can lead to the loading of disallowed types, such as ctx, pkt, flow_keys, or sock, into the source register. As [truncated]
A vulnerability in the Linux kernel's RDMA/erdma component has been addressed. The issue arises from the improper handling of QP references during AE and CM processing, which could lead to use-after-free vulnerabilities. The fix involves adding erdma_qp_get_by_qpn() to safely acquire QP references under the xarray lock. This change aims to prevent potential use-after-free vulnerabilities by ensuring that [truncated]
A Linux kernel vulnerability was addressed, resolving an issue with ARM breakpoint handling when Control Flow Integrity (CFI) is not actively used. The fix prevents the CFI breakpoint handler from stealing breakpoint type 0x03, allowing userspace to utilize this breakpoint when CFI is not instrumented or when a breakpoint is issued in userspace. This change ensures proper breakpoint handling and allows us [truncated]
A use-after-free vulnerability exists in the Linux kernel's ocfs2 component. The bug occurs due to improper handling of the o2hb region's lifetime, allowing a peer to access the region's timeout work before the dev_store() function has finished building the heartbeat runtime or after teardown has started to shut down the runtime. This vulnerability can lead to denial-of-service (DoS) or elevation of privi [truncated]
A Linux kernel vulnerability allows a general protection fault due to a NULL pointer dereference when an initiator issues a SCSI command immediately after receiving the final Login Response. The bug arises from isert_put_login_tx() sending the final Login Response before __transport_register_session(), causing iscsi_post_login_handler() to access a NULL se_tpg. This issue affects Linux kernel versions and [truncated]
A Linux kernel vulnerability was resolved, addressing a scenario where an initiator could execute a SCSI command against an se_session with a NULL se_tpg, leading to a potential oops. The fix involves posting full-feature receive buffers after session registration. This change prevents potential SCSI command execution against unregistered sessions, which could lead to system instability or crashes. Linux [truncated]
A use-after-free vulnerability was found in the Linux kernel's RDMA/siw implementation. The siw_accept() function does not properly handle QP associations, leading to a potential use-after-free error. This issue has been resolved. The vulnerability could allow local attackers to potentially escalate privileges or cause a denial-of-service. Linux kernel developers and administrators should assess their exp [truncated]