These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2023-6932 is a Linux kernel use-after-free in the ipv4: igmp path. NVD rates it High (CVSS 7.8) and the published description ties it to local privilege escalation, so systems running affected kernel releases should be treated as priority patch targets.
An out-of-bounds read vulnerability in the Linux Kernel's SMB client implementation (smbCalcSize in fs/smb/client/netmisc.c) affects Siemens industrial networking products. The vulnerability allows a local attacker to crash the system or leak internal kernel information. Siemens has assessed this vulnerability as **Misinformed** for affected product lines, indicating the reported impact does not apply to [truncated]
CVE-2023-6121 is a Linux kernel NVMe-oF/TCP issue that can expose kernel memory contents through an out-of-bounds read. According to the supplied source description, a crafted TCP packet may trigger a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg). NVD classifies the weakness as CWE-125 and rates it CVSS 4.3 (AV:N/AC:L/PR:L/UI [truncated]
CVE-2023-5717 is a high-severity Linux kernel performance events (perf) vulnerability that Siemens lists as affecting multiple SCALANCE WAB/WAM/WUB/WUM products. The issue is a heap out-of-bounds write in perf_read_group() that can lead to local privilege escalation. Siemens and CISA published the advisory on 2025-02-11 and later revised it on 2025-05-06 for typos; the remediation is to update to V3.0.0 or later.
CVE-2023-5678 is a denial-of-service issue in OpenSSL’s X9.42 Diffie-Hellman handling. When applications generate DH keys or validate DH keys/parameters that come from an untrusted source, excessively long X9.42 DH values can trigger long processing delays. The issue was published on 2023-11-06. OpenSSL states that the SSL/TLS implementation and the 3.0/3.1 FIPS providers are not affected.
A NULL pointer dereference vulnerability in the Linux kernel's NFC (Near Field Communication) NCI (NFC Controller Interface) subsystem was resolved in the `send_acknowledge()` function. The vulnerability could allow a local attacker to trigger a kernel crash through a NULL pointer dereference. Siemens has assessed this vulnerability as not affecting their RUGGEDCOM RST2428P and SCALANCE product families, [truncated]
A NULL pointer dereference vulnerability exists in the Linux kernel's cx23885 media driver. The cx23885_vdev_init() function can return NULL, but this return value was not checked before use, potentially leading to a kernel crash. This vulnerability affects Siemens industrial networking products that incorporate the vulnerable Linux kernel component. The issue was resolved by adding a NULL pointer check a [truncated]
This CVE addresses a vulnerability in the Linux kernel's J1939 CAN (Controller Area Network) protocol implementation, specifically within the `xtp_rx_rts_session_new` function. The issue involves improper error handling when closely received RTS (Request to Send) messages are processed, which could lead to problematic session states. The fix replaces less informative kernel backtraces with a new method th [truncated]
This CVE addresses a Linux kernel clock driver instability in the Allwinner H6 SoC's sunxi-ng clock framework. The vulnerability occurs when the PLL CPUX clock rate changes while the CPU is actively running from that clock source. Under these conditions, intermittent system instability manifests as crashes and undefined behavior. The root cause stems from insufficient clock source stability during dynamic [truncated]
A vulnerability in the Linux kernel's TCP implementation allowed acceptance of acknowledgment (ACK) packets for bytes that were never actually sent. This TCP protocol handling flaw could potentially enable connection manipulation or disruption attacks. The issue was resolved by implementing proper validation to reject ACKs for unsent data. Siemens has identified this vulnerability as affecting certain ind [truncated]
This CVE addresses a vulnerability in the Linux kernel's tracing subsystem where trace_event_file structures lacked proper reference counting. The fix introduces reference counters to prevent use-after-free conditions that could occur when trace event files are accessed concurrently with their removal or modification. The vulnerability was resolved by implementing proper reference counting mechanisms for [truncated]
This CVE addresses a missing null-pointer check in the MediaTek clock driver for MT7629 Ethernet (clk-mt7629-eth) within the Linux kernel. The vulnerability was resolved by adding a check for the return value of mtk_alloc_clk_data(), which could fail and return NULL, potentially leading to a null pointer dereference if not handled. The issue affects Siemens industrial networking products that incorporate [truncated]
A vulnerability in the Linux kernel's Mediatek clock driver (clk-mt2701) was resolved by adding a null-check for mtk_alloc_clk_data. The issue was a missing validation that could lead to undefined behavior if memory allocation failed. Siemens has assessed this CVE as **Misinformed** for their affected industrial networking products (RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, [truncated]
This CVE addresses a vulnerability in the Linux kernel's Qualcomm LLCC (Last Level Cache Controller) driver. The issue involves improper handling when a second device is present, which could lead to data corruption. The vulnerability was resolved by implementing proper handling for multiple devices in the LLCC driver. Siemens has identified this CVE as affecting certain industrial networking products runn [truncated]
A string overflow vulnerability in the Linux kernel thermal subsystem was resolved upstream. Siemens ProductCERT has assessed this CVE as **Misinformed** for affected industrial network devices, indicating the vulnerability does not apply to the listed products as originally reported. The CISA ICS advisory ICSA-25-226-15 (published 2025-08-12, updated 2026-02-25) republishes Siemens guidance from SSA-6131 [truncated]
CVE-2023-52867 is a buffer overflow vulnerability in the Linux kernel's drm/radeon driver. The vulnerability was resolved in the Linux kernel, indicating a patch is available upstream. Siemens has identified this CVE as affecting multiple industrial networking products including the RUGGEDCOM RST2428P and SCALANCE X-family switches running SINEC OS. The CISA advisory ICSA-25-226-15, republished on 2026-02 [truncated]
A vulnerability in the Linux kernel's Mediatek clock driver (clk-mt6797) was resolved by adding a null-check for mtk_alloc_clk_data. The issue affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE X-family switches. The vulnerability stems from a missing validation check that could lead to undefined behavior if memory allocation fails. Siemens ad [truncated]
CVE-2023-52864 is a vulnerability in the Linux kernel's Windows Management Instrumentation (WMI) platform/x86 driver, specifically affecting the opening of a character device. The vulnerability was resolved in the Linux kernel with a fix for improper handling of the WMI char device open operation. Siemens has identified this CVE as affecting certain industrial networking products running SINEC OS, includi [truncated]
A vulnerability in the Linux kernel's Mediatek clock driver for MT7629 platforms was resolved by adding a null-check for `mtk_alloc_clk_data`. The fix prevents potential null pointer dereference issues when clock data allocation fails. Siemens has assessed this CVE as misinformed for their affected industrial networking products, indicating the vulnerability does not apply to their specific implementations.
A NULL pointer dereference vulnerability in the Linux kernel's USB DWC2 (DesignWare Core 2) driver, triggered by driver concurrency conditions. The vulnerability was resolved in the Linux kernel with a fix for the race condition. Siemens has identified this CVE as affecting certain industrial networking products running SINEC OS, including the RUGGEDCOM RST2428P and SCALANCE X-family switches. The CISA CS [truncated]
A vulnerability in the Linux kernel's HID CP2112 driver allowed duplicate workqueue initialization, which could lead to system instability or undefined behavior. The issue was resolved by fixing the duplicate initialization in the driver code. Siemens has assessed this vulnerability as affecting certain industrial networking products running SINEC OS, which incorporates the vulnerable Linux kernel compone [truncated]
A use-after-free vulnerability in the Linux kernel's BtTV (Brooktree TV) media driver could allow local attackers to cause memory corruption. The flaw exists in the btv->timeout timer handling, where improper synchronization may lead to accessing freed memory. Siemens has assessed this vulnerability as affecting certain industrial network infrastructure products running SINEC OS, which incorporates the vu [truncated]
This CVE addresses a vulnerability in the Linux kernel's Logical Link Control (LLC) protocol implementation. The issue involves insufficient validation of MAC header length before reading the MAC header, which could lead to out-of-bounds memory access. The vulnerability was resolved by adding proper verification of the MAC length prior to header access. Siemens has identified this vulnerability as affecti [truncated]
A use-after-free vulnerability in the Linux kernel's Synaptics RMI4 input driver was resolved via a fix in rmi_unregister_function(). The vulnerability affects Siemens industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE X-family switches. CISA published this advisory on August 12, 2025, with subsequent revisions through February 25, 2026, including corrections [truncated]
A resource leak vulnerability in the Linux kernel's imsttfb framebuffer driver probe function was resolved. The issue could lead to resource exhaustion during device initialization. Siemens has assessed this CVE as 'Misinformed' for affected industrial networking products, indicating the vulnerability does not apply to their specific product configurations. The advisory was initially published on August 1 [truncated]
CVE-2023-52835 is a vulnerability in the Linux kernel's perf/core subsystem related to out-of-bounds AUX (auxiliary) area requests. The vulnerability was resolved by adding an early bail-out check when the requested AUX area is out of bounds. This fix prevents potential security issues that could arise from improper bounds checking in the performance monitoring subsystem. The vulnerability affects Siemens [truncated]
A vulnerability in the Linux kernel's AMD GPU driver (drm/amd) could cause array-index-out-of-bounds errors on Polaris and Tonga graphics hardware. The issue was resolved in the Linux kernel. Siemens has assessed this CVE as applicable to certain industrial networking products running SINEC OS, which incorporates the affected Linux kernel components. The vulnerability is classified with an impact of 'Misi [truncated]
A vulnerability in the Linux kernel's AMD GPU driver (drm/amd) for SMU7 could allow array-index-out-of-bounds access, potentially leading to undefined behavior or system instability. The issue was resolved with a kernel patch. Siemens has assessed this CVE as not affecting their RUGGEDCOM RST2428P and SCALANCE product families, marking it as 'Misinformed' in their security advisory.
A null pointer dereference vulnerability in the Linux kernel's AMDGPU DRM driver, specifically in the `smc_rreg` pointer handling, has been identified and resolved. The vulnerability could allow an attacker to trigger a kernel crash through null pointer access when the `smc_rreg` function pointer is NULL. This affects Siemens industrial networking products that incorporate the vulnerable Linux kernel comp [truncated]
CVE-2023-52813 is a vulnerability in the Linux kernel's crypto subsystem, specifically within the pcrypt parallel crypto framework. The issue involves a hung task condition that occurs during PADATA_RESET operations, which could lead to system unavailability or denial of service conditions. The vulnerability was resolved in the Linux kernel with a fix for the hungtask condition in pcrypt's PADATA_RESET ha [truncated]