These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A deadlock vulnerability exists in the Linux kernel SMB client implementation within the smb2_find_smb_tcon() function. This flaw can cause the SMB client to become unresponsive when processing certain SMB2 protocol operations, leading to a denial-of-service condition. The vulnerability stems from improper locking mechanisms that can result in a circular wait condition between kernel threads.
CVE-2024-39276 is a reference count leak vulnerability in the Linux kernel's ext4 filesystem, specifically within the `ext4_xattr_block_cache_find()` function. The issue occurs when `ext4_sb_bread()` returns `-ENOMEM` (out of memory), causing the `mb_cache_entry`'s `e_refcnt` reference count—incremented during `__entry_find()`—to not be decremented. This leads to a reference count leak that triggers a war [truncated]
A vulnerability in the Linux kernel's dma-buf/sw-sync subsystem could allow a local attacker to cause a denial of service condition. The issue stems from improper interrupt handling in the sync_print_obj() function, where IRQs were incorrectly enabled. This vulnerability affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE X-family switches. The [truncated]
CVE-2024-38662 is a MEDIUM-severity Linux kernel BPF vulnerability affecting the SIMATIC S7-1500 TM MFP GNU/Linux subsystem. The issue stems from insufficient access control in the BPF verifier: BPF programs attached to tracepoints could perform map_delete operations on sockmap/sockhash map types, triggering locking rule violations. The kernel maintainers determined this was an unsupported artificial use [truncated]
CVE-2024-38659 is a medium-severity vulnerability (CVSS 5.5) in the Cisco enic driver affecting Siemens industrial networking products. The flaw stems from improper length validation of netlink attributes in the `enic_set_vf_port` function, which assumes fixed-length attributes (PORT_PROFILE_MAX for IFLA_PORT_PROFILE, PORT_UUID_MAX for IFLA_PORT_INSTANCE_UUID and IFLA_PORT_HOST_UUID). However, the underly [truncated]
A null pointer dereference vulnerability in the Linux kernel's Greybus lights subsystem could allow local attackers to cause a denial of service. The issue occurs in the get_channel_from_mode function where the return value is not validated before use in two locations. When a channel for a given node is not found, the function returns NULL, leading to a null pointer dereference if not properly checked. Th [truncated]
A race condition in the Linux kernel's MAX3100 serial driver could allow local attackers to trigger a kernel warning or potentially cause undefined behavior. The vulnerability exists because uart_handle_cts_change() was called without holding the required port lock when running in a separate workqueue context. Siemens has identified this issue as affecting certain industrial networking products running SI [truncated]
A logic error in the Linux kernel's MAX3100 serial driver causes a NULL pointer dereference and kernel oops when the driver is reloaded after removal. The global variable tracking UART driver registration state is not updated on driver removal, causing subsequent probe attempts to reference invalid memory. Siemens SINEC OS-based products including RUGGEDCOM RST2428P and SCALANCE X-family switches are affected.
A double-free vulnerability exists in the Linux kernel's System Trace Module (STM) class subsystem. The flaw occurs in `stm_register_device()` where `put_device(&stm->dev)` triggers `stm_device_release()`, which already frees the `stm` structure. A subsequent `vfree(stm)` call results in a double-free condition. This vulnerability affects Siemens industrial networking products running SINEC OS, specifical [truncated]
CVE-2024-38619 is a medium-severity vulnerability (CVSS 5.5) in the Linux kernel's USB storage driver, specifically the Alauda media handling code. The flaw occurs when `alauda_init_media()` fails to initialize media, leaving the `uzonesize` member of `struct alauda_info` set to zero. This uninitialized value subsequently causes divide-by-zero errors in `alauda_read_data()` and `alauda_write_lba()` functi [truncated]
A vulnerability in the Linux kernel cpufreq subsystem affects Siemens industrial networking products. The issue involves a missing NULL pointer check before calling the optional exit() callback, which can lead to a denial of service condition. The vulnerability has a CVSS 3.1 score of 5.5 (MEDIUM) with local attack vector and high availability impact. Siemens has released updates to address this issue in [truncated]
CVE-2024-38612 is a vulnerability in the Linux kernel's IPv6 Segment Routing (SR) subsystem. The issue exists in the error path of the `seg6_init()` function when `CONFIG_IPV6_SEG6_LWTUNNEL` is not defined. If `seg6_hmac_init()` fails during initialization, the `genl_unregister_family()` function is not called, leading to improper cleanup. This vulnerability was introduced in kernel commit 46738b1317e1 an [truncated]
A race condition in the Linux kernel's ring buffer implementation can cause tracing to stop unexpectedly when ring buffer resize operations occur concurrently with reader page swaps. The vulnerability exists in the doubly-linked list manipulation during page replacement in rb_get_reader_page(), where temporary inconsistency between page->prev->next and page->next->prev pointers can be detected by rb_check [truncated]
A vulnerability in the Linux kernel's md (Multiple Device) driver could cause a softlockup during RAID resync operations when the bitmap size is smaller than the array size. This local denial-of-service condition requires low privileges and no user interaction. Siemens has identified this vulnerability affects certain industrial networking products running SINEC OS, with a vendor fix available in version [truncated]
A vulnerability in the Linux kernel's sungem Ethernet driver could lead to deadlocks when netpoll is active. The gem_poll_controller() function disables interrupts, which may sleep—a prohibited operation in netpoll contexts where interrupts are completely disabled. The issue manifests as netpoll warnings indicating that the driver enabled interrupts during poll operations. The fix removes the .ndo_poll_co [truncated]
CVE-2024-38596 is a data race vulnerability in the Linux kernel's AF_UNIX socket implementation, specifically affecting the unix_release_sock and unix_stream_sendmsg functions. The vulnerability was resolved in the upstream Linux kernel. Siemens has identified this vulnerability as affecting certain industrial networking products running SINEC OS, including the RUGGEDCOM RST2428P and SCALANCE XC-300/XR-30 [truncated]
CVE-2024-38590 is a Linux kernel vulnerability in the RDMA/hns (Hisilicon Network Subsystem) driver where excessive error logging could trigger a kernel panic. The issue stems from unbounded error messages when CQE (Completion Queue Entry) errors occur, potentially causing resource exhaustion. The fix implements rate-limited error logging and reduces CQE dump verbosity to debug level. Siemens has identifi [truncated]
A local privilege escalation vulnerability exists in the Linux kernel's NET/ROM amateur radio networking protocol implementation. The flaw involves a potential deadlock condition in the nr_rt_ioctl() function due to improper lock ordering between nr_node_list_lock and nr_node_lock. An attacker with local access could exploit this race condition to cause a denial of service through system deadlock. The vul [truncated]
A vulnerability in the Linux kernel's speakup accessibility subsystem could allow out-of-bounds access due to a coding error where sizeof() was used instead of ARRAY_SIZE() on a u16 array. The bug causes the code to use 512 (byte size) rather than 256 (element count) as the bounds check, potentially permitting access beyond the allocated buffer. This affects Siemens industrial networking products running [truncated]
A vulnerability in the r8169 Ethernet driver affects the RTL8125b network controller when transmitting small fragmented packets. The flaw occurs in `rtl8169_start_xmit()`, which fails to detect changes to `nr_frags` that can happen when small packets are padded in `rtl8169_tso_csum_v2()` to work around hardware quirks. This leads to invalid entries being inserted into the transmit ring buffer, subsequentl [truncated]
CVE-2024-38579 is a medium-severity vulnerability (CVSS 5.5) in the Linux kernel's Broadcom crypto driver (crypto: bcm). The flaw exists in the `spu2_dump_omd()` function where pointer arithmetic incorrectly increments by `ciph_key_len` instead of `hash_iv_len`, potentially causing out-of-bounds buffer access. This vulnerability was published on August 12, 2025, and last modified on February 25, 2026. Sie [truncated]
CVE-2024-38578 is a buffer overflow vulnerability in the eCryptfs kernel module affecting Siemens industrial networking products. The flaw stems from an incorrect buffer size calculation in the TAG 66 packet format handling, where the cipher code and checksum fields were omitted from the allocation size. This results in a 3-byte undersized buffer, causing write_tag_66_packet() to write up to 3 bytes past [truncated]
CVE-2024-38558 is a vulnerability in the Linux kernel's Open vSwitch (OVS) networking subsystem, specifically affecting how ICMPv6 packets are handled during userspace packet execution. The flaw occurs when OVS_PACKET_CMD_EXECUTE processes packet metadata, where the connection tracking (conntrack) original tuple for ICMPv6 packets can be incorrectly overwritten. This results from improper parsing of OVS_P [truncated]
CVE-2024-38555 is a use-after-free vulnerability in the Linux kernel's Mellanox mlx5 driver (net/mlx5). The flaw occurs when a firmware command completion arrives while the device is in an internal error state, triggering a refcount underflow and potential memory corruption. The vulnerability was resolved by discarding command completions in internal error states to prevent the completion handler from bei [truncated]
A use of uninitialized value vulnerability exists in the Linux kernel's NFC (Near Field Communication) NCI (NFC Controller Interface) subsystem. The nci_rx_work() function processes received packets from ndev->rx_q without properly validating header size, payload size, and total packet size before processing. An attacker with local access could trigger this flaw to cause a denial of service condition. The [truncated]
A shift-out-of-bounds vulnerability in the Linux kernel's DCTCP (Data Center TCP) congestion control algorithm could allow a local attacker to cause denial of service or potentially achieve code execution. The flaw exists in the dctcp_update_alpha() function where improper bounds checking on shift operations could lead to undefined behavior. Siemens has confirmed this vulnerability affects multiple indust [truncated]
CVE-2024-37078 is a kernel vulnerability in the nilfs2 filesystem affecting Siemens industrial networking products. The issue stems from a race condition where the log writer initiates writeback for segment summary blocks or super root blocks using the backing device's page cache without waiting for ongoing folio/page writeback operations to complete. This results in an inconsistent writeback state that c [truncated]
CVE-2024-36978 is a medium-severity (CVSS 6.1) out-of-bounds write vulnerability in the Linux kernel's network traffic scheduler, specifically within the sch_multiq module's multiq_tune() function. The flaw occurs when the q->bands value is incorrectly used during a kmalloc allocation before being reassigned to qopt->bands, potentially allowing an attacker with local access to trigger memory corruption. T [truncated]
CVE-2024-36974 is a medium-severity vulnerability (CVSS 5.5) in the Linux kernel's taprio network scheduler, affecting the Siemens SIMATIC S7-1500 TM MFP GNU/Linux subsystem. The flaw exists in the `taprio_parse_mqprio_opt()` function within `net/sched/taprio.c`, where improper validation of the `TCA_TAPRIO_ATTR_PRIOMAP` attribute allows userspace to inject arbitrary data into the kernel on subsequent cal [truncated]
A vulnerability in the Linux kernel's 9P filesystem implementation allows improper permission bit handling in plain 9P2000 protocol mode. The issue permits non-standard permission bits—including the setuid bit—to pass through validation when they should be filtered. This occurs because the code only explicitly handles Unix extended permission bits conditionally, while allowing unvalidated 'garbage' bits t [truncated]