Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46003)

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Limit the total number of nodes Currently, the nameserver doesn't limit the number of nodes it handles. This can be an attack vector if a malicious client starts registering random nodes, leading to memory...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53356)

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sgpage returns struct page pointer not void so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46110)

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Prevent NULL deref when RX memory exhausted The CPU receives frames from the MAC through conventional DMA: the CPU allocates buffers for the MAC, then the MAC fills them and returns ownership to the CPU. For each...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46064)

In the Linux kernel, the following vulnerability has been resolved: ibmasm: fix heap over-read in ibmasmsendi2omessage The ibmasmsendi2omessage function uses getdotcommandsize to compute the byte count for memcpytoio, but this value is derived from user-controlled fields in the dotcommandheader...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23291)

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: properly drop the usb interface reference on disconnect When the device is disconnected from the driver, there is a 'dangling' reference count on the usb interface that was grabbed in the probe callback. Fix this up b...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46307)

In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: The ath5k driver seems to do an array-index-out-of-bounds access as shown by the UBSAN kernel message: UBSAN: array-index-out-of-bounds in...

Siemens SIMATIC S7-1500 TM MFP Improper Validation of Specified Index, Position, or Offset in Input (CVE-2026-23388)

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check metadata block offset is within range Syzkaller reports a 'general protection fault in squashfscopydata' This is ultimately caused by a corrupted index look-up table, which produces a negative metadata block offse...

Siemens SIMATIC S7-1500 TM MFP Out-of-bounds Write (CVE-2026-53148)

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tbxdppropertiesrequest derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A maliciou...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23312)

In the Linux kernel, the following vulnerability has been resolved: net: usb: kaweth: validate USB endpoints The kaweth driver should validate that the device it is probing has the proper number and types of USB endpoints it is expecting before it binds to it. If a malicious device were to not ha...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43111)

In the Linux kernel, the following vulnerability has been resolved: HID: roccat: fix use-after-free in roccatreportevent roccatreportevent iterates over the device-readers list without holding the readerslock. This allows a concurrent roccatrelease to remove and free a reader while it's still bei...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46159)

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix btrfsioctlspaceinfo slotcount TOCTOU which can lead to info-leak btrfsioctlspaceinfo has a TOCTOU race between two passes over the block group RAID type lists. The first pass counts entries to determine the allocation...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23066)

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recvmsg unconditional requeue If rxrpcrecvmsg fails because MSGDONTWAIT was specified but the call at the front of the recvmsg queue already has its mutex locked, it requeues the call - whether or not the call is alrea...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53149)

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size tbpropertyparsedir does not check that contentoffset + contentlen fits within blocklen for the root directory case. When rootdir-length equals or exceeds blocklen - 2, the...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45997)

"In the Linux kernel, the following vulnerability has been resolved: scsi: sd: fix missing putdisk when deviceadd&diskdev fails If deviceadd&sdkp-diskdev fails, putdevice runs scsidiskrelease, which frees the scsidisk but leaves the gendisk referenced. The deviceadddisk error path in sdprobe call...

Siemens SIMATIC S7-1500 TM MFP Double Free (CVE-2024-57980)

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix double free in error path If the uvcstatusinit function fails to allocate the inturb, it will free the dev-status pointer but doesn't reset the pointer to NULL. This results in the kfree call in...

Siemens SIMATIC S7-1500 TM MFP Out-of-bounds Write (CVE-2026-46331)

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcfpeditact computes the COW range for skbensurewritable once before the key loop using tcfpoffmaxhint, but the hint does not account for the runtime header offset...

CentOS 9 : kernel-5.14.0-757.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-757.el9 build changelog. - In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rxreqidx to prevent out-of-bounds array access ...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31451)

In the Linux kernel, the following vulnerability has been resolved: ext4: replace BUGON with proper error handling in ext4readinlinefolio Replace BUGON with proper error handling when inline data size exceeds PAGESIZE. This prevents kernel panic and allows the system to continue running while...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46320)

In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tapgetuserxdp tapgetuserxdp rejects a frame shorter than ETHHLEN with -EINVAL, and returns -ENOMEM when buildskb fails. Both paths jump to the err label without freeing the page that...

Siemens SIMATIC S7-1500 TM MFP Incorrect Synchronization (CVE-2026-23281)

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix use-after-free in lbsfreeadapter The lbsfreeadapter function uses timerdelete non-synchronous for both commandtimer and txlockuptimer before the structure is freed. This is incorrect because timerdelete does n...