Siemens SIMATIC S7-1500 TM MFP Signal Handler Race Condition (CVE-2026-23372)

In the Linux kernel, the following vulnerability has been resolved: nfc: rawsock: cancel txwork before socket teardown In rawsockrelease, cancel any pending txwork and purge the write queue before orphaning the socket. rawsocktxwork runs on the system workqueue and calls nfcdataexchange which...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23336)

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel rfkillblock work in wiphyunregister There is a use-after-free error in cfg80211shutdownallinterfaces found by syzkaller: BUG: KASAN: use-after-free in cfg80211shutdownallinterfaces+0x213/0x220 Read of size ...

Siemens SIMATIC S7-1500 TM MFP Missing Release of Resource after Effective Lifetime (CVE-2026-23339)

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free skb on ncitransceive early error paths ncitransceive takes ownership of the skb passed by the caller, but the -EPROTO, -EINVAL, and -EBUSY error paths return without freeing it. Due to issues clearing NCIDATAEXCHAN...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23315)

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix possible oob access in mt76connac2macwritetxwi80211 Check frame length before accessing the mgmt fields in mt76connac2macwritetxwi80211 in order to avoid a possible oob access. fix check to also cover...

Siemens SIMATIC S7-1500 TM MFP Plaintext Storage of a Password (CVE-2026-23303)

In the Linux kernel, the following vulnerability has been resolved: smb: client: Don't log plaintext credentials in cifssetcifscreds When debug logging is enabled, cifssetcifscreds logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23302)

In the Linux kernel, the following vulnerability has been resolved: net: annotate data-races around sk-skdataready,writespace skmsg and probably other layers are changing these pointers while other cpus might read them concurrently. Add corresponding READONCE/WRITEONCE annotations for UDP, TCP an...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46065)

In the Linux kernel, the following vulnerability has been resolved: fbdev: defio: Disconnect deferred I/O from the lifetime of struct fbinfo Hold state of deferred I/O in struct fbdeferrediostate. Allocate an instance as part of initializing deferred I/O and remove it only after the final mapping...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53147)

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tbxdphandlerequest casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer...

Siemens SIMATIC S7-1500 TM MFP Multiple Locks of a Critical Resource (CVE-2026-23292)

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix recursive locking in configfsopenfile In flushwritebuffer, &p-fragsem is acquired and then the loaded store function is called, which, here, is targetcoreitemdbrootstore. This function called filpopen, following...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31699)

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed When retrieving the PEK CSR, don't attempt to copy the blob to userspace if the firmware command failed. If the failure was due to an invalid length, i.e...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31630)

In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for %pISpc output The AFRXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with '%pISpc'. That is too small for the longest current-tree IPv6-with-port...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53146)

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain response copy to actual frame size tbxdomaincopy copies req-responsesize bytes from the received packet buffer regardless of the actual frame size. When a short response arrives, this reads past the val...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46234)

In the Linux kernel, the following vulnerability has been resolved: vsock: fix buffer size clamping order In vsockupdatebuffersize, the buffer size was being clamped to the maximum first, and then to the minimum. If a user sets a minimum buffer size larger than the maximum, the minimum check...

Siemens SIMATIC S7-1500 TM MFP Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2025-21738)

In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer reveliofuzzing reported that a SCSIIOCTLSENDCOMMAND ioctl with outlen set to 0xd42, SCSI command set to ATA16 PASS-THROUGH, ATA command set to ATANOP, and...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46191)

In the Linux kernel, the following vulnerability has been resolved: fbcon: Avoid OOB font access if console rotation fails Clear the font buffer if the reallocation during console rotation fails in fbconrotatefont. The putcs implementations for the rotated buffer will return early in this case. S...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43094)

In the Linux kernel, the following vulnerability has been resolved: ixgbevf: add missing negotiatefeatures op to Hyper-V ops table Commit a7075f501bd3 'ixgbevf: fix mailbox API compatibility by negotiating supported features' added the .negotiatefeatures callback to ixgbemacoperations and populat...

Siemens SIMATIC S7-1500 TM MFP Missing Release of Memory after Effective Lifetime (CVE-2026-43502)

In the Linux kernel, the following vulnerability has been resolved: net/rds: handle zerocopy send cleanup before the message is queued A zerocopy send can fail after user pages have been pinned but before the message is attached to the sending socket. The purge path currently infers zerocopy stat...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46163)

In the Linux kernel, the following vulnerability has been resolved: wifi: b43legacy: enforce bounds check on firmware key index in RX path Same fix as b43: the firmware-controlled key index in b43legacyrx can exceed dev-maxnrkeys. The existing B43legacyWARNON is non-enforcing in production builds...

Siemens SIMATIC S7-1500 TM MFP Heap-based Buffer Overflow (CVE-2026-53362)

In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In ip6appenddata, when the paged-allocation branch is taken MSGMORE / NETIFFSG / large fraglen, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen;...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46321)

In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tunxdpone tunxdpone returns -EINVAL on a frame shorter than ETHHLEN without freeing the page that vhostnetbuildxdp allocated for it. tunsendmsg discards that -EINVAL and still returns...