Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53253)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: reject short frames before parsing A BNEP peer can send a short BNEP SDU. bneprxframe reads the packet type byte immediately and, for control packets, reads the control opcode and setup UUID-size byte before...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2025-22105)

In the Linux kernel, the following vulnerability has been resolved: bonding: check xdp prog when set bond mode Following operations can trigger a warning1: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip link set dev bond0 xdp obj afxdpkern.o se...

Siemens SIMATIC S7-1500 TM MFP Improper Update of Reference Count (CVE-2026-23296)

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix refcount leak for tagsetrefcnt This leak will cause a hang when tearing down the SCSI host. For example, iscsid hangs with the following call trace: 130120.652718 scsiallocsdev: Allocation failure during SCSI...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31532)

In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro-uniq use-after-free in rawrcv rawrelease unregisters raw CAN receive filters via canrxunregister, but receiver deletion is deferred with callrcu. This leaves a window where rawrcv may still be running in an RCU...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46120)

In the Linux kernel, the following vulnerability has been resolved: ip6gre: Use cached t-net in ip6erspanchangelink. After commit 5e72ce3e3980 'net: ipv6: Use link netns in newlink of rtnllinkops', ip6erspannewlink correctly resolves the per-netns ip6gre hash via linknet. ip6erspanchangelink was...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46294)

"In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson using Claude found a buffer overflow in dm-ioctl in the function retrievestatus: 1. The code in retrievestatus checks that the output string fits into the output buffer...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2025-38250)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix use-after-free in vhciflush syzbot reported use-after-free in vhciflush without repro. 0 From the splat, a thread closed a vhci file descriptor while its device was being used by iotcl on another thread...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45850)

In the Linux kernel, the following vulnerability has been resolved: ipvs: skip ipv6 extension headers for csum checks Protocol checksum validation fails for IPv6 if there are extension headers before the protocol header. iph-len already contains its offset, so use it to fix the problem. This plug...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46023)

In the Linux kernel, the following vulnerability has been resolved: dm mirror: fix integer overflow in createdirtylog The argument count calculation in createdirtylog performs argsused = 2 + paramcount before validating against argc. When a user provides a paramcount close to UINTMAX via the devi...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46044)

In the Linux kernel, the following vulnerability has been resolved: ipmi:ssif: Clean up kthread on errors If an error occurs after the ssif kthread is created, but before the main IPMI code starts the ssif interface, the ssif kthread will not be stopped. So make sure the kthread is stopped on an...

Linux kernel SFP I2C DoS

The vulnerability in the sfpi2cmdiobuscreate function within the drivers/net/phy/sfp.c component of the Linux kernel operating system is related to insufficient resource control during its existence. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

Linux kernel enetc_xdp_xmit() Data Compromise

The vulnerability of the enetcxdpxmit function in the drivers/net/ethernet/freescale/enetc/enetc.c component of the Linux kernel is related to insufficient resource control during its existence. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, an...

intel_crtc_put_color_blobs() Function Kernel Module Use-After-Free

The vulnerability of the intelcrtcputcolorblobs function in the drivers/gpu/drm/i915/display/intelatomic.c file of the Linux kernel is related to the improper implementation of thread management. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, a...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-52947)

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtrportremove In qrtrportremove, the socket reference count is decremented via sockput before the port is removed from the qrtrports XArray and before the RCU grace period...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2024-57993)

In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: Fix warning in thrustmasterprobe by adding endpoint check syzbot has found a type mismatch between a USB pipe and the transfer endpoint, which is triggered by the hid-thrustmaster driver1. There is a number...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2025-38584)

In the Linux kernel, the following vulnerability has been resolved: padata: Fix pd UAF once and for all There is a race condition/UAF in padatareorder that goes back to the initial commit. A reference count is taken at the start of the process in padatadoparallel, and released at the end in...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45840)

In the Linux kernel, the following vulnerability has been resolved: openvswitch: cap upcall PID array size and pre-size vport replies The vport netlink reply helpers allocate a fixed-size skb with nlmsgnewNLMSGDEFAULTSIZE, ... but serialize the full upcall PID array via ovsvportgetupcallportids...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46159)

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix btrfsioctlspaceinfo slotcount TOCTOU which can lead to info-leak btrfsioctlspaceinfo has a TOCTOU race between two passes over the block group RAID type lists. The first pass counts entries to determine the allocation...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23272)

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: unconditionally bump set-nelems before insertion In case that the set is full, a new element gets published then removed without waiting for the RCU grace period, while RCU reader can be walking over it...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53167)

In the Linux kernel, the following vulnerability has been resolved: fuse: limit FUSENOTIFYRETRIEVE to uptodate folios FUSENOTIFYRETRIEVE must be limited to uptodate folios; !uptodate folios can contain uninitialized data. Since FUSENOTIFYRETRIEVE is intended to only return data that is already in...