Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31704)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use checkaddoverflow to prevent u16 DACL size overflow setposixaclentriesdacl and setntacldacl accumulate ACE sizes in u16 variables. When a file has many POSIX ACL entries, the accumulated size can wrap past 65535, causin...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53350)

In the Linux kernel, the following vulnerability has been resolved: ASoC: wmadsp: Fix NULL dereference when removing firmware controls In wmadspcontrolremove check that the priv pointer is not NULL before attempting to cleanup what it points to. When csdsp creates a control it calls...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46120)

In the Linux kernel, the following vulnerability has been resolved: ip6gre: Use cached t-net in ip6erspanchangelink. After commit 5e72ce3e3980 'net: ipv6: Use link netns in newlink of rtnllinkops', ip6erspannewlink correctly resolves the per-netns ip6gre hash via linknet. ip6erspanchangelink was...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53253)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: reject short frames before parsing A BNEP peer can send a short BNEP SDU. bneprxframe reads the packet type byte immediately and, for control packets, reads the control opcode and setup UUID-size byte before...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2025-22105)

In the Linux kernel, the following vulnerability has been resolved: bonding: check xdp prog when set bond mode Following operations can trigger a warning1: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip link set dev bond0 xdp obj afxdpkern.o se...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46092)

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: check for PCI upstream bridge existence pciupstreambridge returns NULL if the device is on a root bus. If 8821CE is installed in the system with such a PCI topology, the probing routine will crash. This has probably...

Siemens SIMATIC S7-1500 TM MFP Out-of-bounds Read (CVE-2026-43112)

In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fix out-of-bounds read in cifssanitizeprepath When cifssanitizeprepath is called with an empty string or a string containing only delimiters e.g., '/', the current logic attempts to check cursor2 - 1 before cursor2...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53242)

In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in sndpcmdrain on linked streams sndpcmdrain uses initwaitqueueentry which does not clear entry.prev/next, and addwaitqueue with a conditional removewaitqueue that is skipped when tocheck...

Siemens SIMATIC S7-1500 TM MFP Missing Lock Check (CVE-2026-23382)

In the Linux kernel, the following vulnerability has been resolved: HID: Add HIDCLAIMEDINPUT guards in rawevent callbacks missing them In commit 2ff5baa9b527 'HID: appleir: Fix potential NULL dereference at raw event handle', we handle the fact that raw event callbacks can happen even for a HID...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46161)

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix divide-by-zero in setupgeo with zero farcopies setupgeo extracts nearcopies nc and farcopies fc from the user-provided layout parameter without checking for zero. When fc=0 with the 'improved' far set layout...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53227)

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible kfreeskb of ERRPTR After the patch in the 'Fixes' tag, the allocation of the 'reply' skb can happen either before or after locking the ovsmutex. However, error cleanups still follow the classical...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43421)

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Fix netdevice lifecycle with devicemove The network device outlived its parent gadget device during disconnection, resulting in dangling sysfs links and null pointer dereference problems. A prior attempt to sol...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-52948)

In the Linux kernel, the following vulnerability has been resolved: i2c: dev: prevent integer overflow in I2CTIMEOUT ioctl While fuzzing with Syzkaller, a persistent scheduletimeout: wrong timeout value warning was observed, accompanied by SMBus controller state machine corruption. The I2CTIMEOUT...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31622)

In the Linux kernel, the following vulnerability has been resolved: NFC: digital: Bounds check NFC-A cascade depth in SDD response handler The NFC-A anti-collision cascade in digitalinrecvsddres appends 3 or 4 bytes to target-nfcid1 on each round, but the number of cascade rounds is controlled...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45835)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2capsocknewconnectioncb Add the same NULL guard already present in l2capsockresumecb and l2capsockreadycb. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53349)

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: destroy stale expectfn expectations on unregister NAT helpers such as nfnath323 store a raw pointer to module text in exp-expectfn e.g. ipnatq931expect. nfcthelperexpectfnunregister only unlinks the callba...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45850)

In the Linux kernel, the following vulnerability has been resolved: ipvs: skip ipv6 extension headers for csum checks Protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. iph-len already contains its offset, so use it to fix the problem. This plug...

Siemens SIMATIC S7-1500 TM MFP Use of Incorrect Operator (CVE-2026-43114)

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapoavx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used. The test first loads a ranomly generated pipapo set with 'ipv4 . port' key, i.e. nft -...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46088)

In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Validate buflen before strnlen in sndctleleminitenumnames sndctleleminitenumnames advances pointer p through the names buffer while decrementing buflen. If buflen reaches zero but items remain, the next iteration...

Siemens SIMATIC S7-1500 TM MFP Deadlock (CVE-2026-23157)

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not strictly require dirty metadata threshold for metadata writepages BUG There is an internal report that over 1000 processes are waiting at the ioscheduletimeout of balancedirtypages, causing a system hang and trigger...