Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46294)

"In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson using Claude found a buffer overflow in dm-ioctl in the function retrievestatus: 1. The code in retrievestatus checks that the output string fits into the output buffer...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46167)

In the Linux kernel, the following vulnerability has been resolved: usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Just like in a previous problem in this driver, usblpctrlmsg will collapse the usbcontrolmsg return value to 0/-errno, discarding the actual number of bytes transferre...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46107)

In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function rebalancechildren. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46177)

In the Linux kernel, the following vulnerability has been resolved: ipmi: Add limits to event and receive message requests The driver would just fetch events and receive messages until the BMC said it was done. To avoid issues with BMCs that never say they are done, add a limit of 10 fetches at a...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46185)

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in symlinkdata Since smb2checkmessage returns success without length validation for the symlink error response, in symlinkdata it is possible for iov-iovlen to be smaller than sizeofstruct...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53254)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in MCC handlers The RFCOMM MCC handlers cast skb-data to protocol-specific structs without validating skb-len first. A malicious remote device can send truncated MCC frames and trigger...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2024-56647)

In the Linux kernel, the following vulnerability has been resolved: net: Fix icmp host relookup triggering iprtbug arp link failure may trigger iprtbug while xfrm enabled, call trace is: WARNING: CPU: 0 PID: 0 at net/ipv4/route.c:1241 iprtbug+0x14/0x20 Modules linked in: CPU: 0 UID: 0 PID: 0 Comm...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53080)

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsfw: fix NULL dereference of 'old' filters before change Like pointed out by Sashiko 1, since commit ed76f5edccc9 'net: sched: protect filterchain list with filterchainlock mutex' TC filters are added to a shared blo...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53325)

In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agpamd64probe A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment e.g. qemu/kvm without a physical AMD northbridge. The crash occurs...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46149)

In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf return in tgptgpmembersshow targettgptgpmembersshow formats LUN paths with snprintf into a 256-byte stack buffer, then will memcpy curlen bytes from that buffer. snprintf returns the length...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46243)

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcalltarget that cifs.upcall treats as kernel-originating inputs. However,...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46120)

In the Linux kernel, the following vulnerability has been resolved: ip6gre: Use cached t-net in ip6erspanchangelink. After commit 5e72ce3e3980 'net: ipv6: Use link netns in newlink of rtnllinkops', ip6erspannewlink correctly resolves the per-netns ip6gre hash via linknet. ip6erspanchangelink was...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45843)

In the Linux kernel, the following vulnerability has been resolved: slip: bound decode reads against the compressed packet length slhcuncompress parses a VJ-compressed TCP header by advancing a pointer through the packet via decode and pull16. Neither helper bounds-checks against isize, and decod...

Linux Kernel Heap Buffer Overflow DoS

The vulnerability of the ocfs2readblocks function in the fs/ocfs2/bufferheadio.c file of the Linux kernel is related to the improper implementation of thread management. Exploiting this vulnerability could allow an attacker to cause a service failure...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31676)

In the Linux kernel, the following vulnerability has been resolved: rxrpc: only handle RESPONSE during service challenge Only process RESPONSE packets while the service connection is still in RXRPCCONNSERVICECHALLENGING. Check that state under statelock before running response verification and...

Siemens SIMATIC S7-1500 TM MFP Improper Resource Locking (CVE-2026-23356)

In the Linux kernel, the following vulnerability has been resolved: drbd: fix 'LOGIC BUG' in drbdalbeginiononblock Even though we check that we 'should' be able to do lcgetcumulative while holding the device-allock spinlock, it may still fail, if some other code path decided to do lctrylock with...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43421)

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Fix netdevice lifecycle with devicemove The network device outlived its parent gadget device during disconnection, resulting in dangling sysfs links and null pointer dereference problems. A prior attempt to sol...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23310)

In the Linux kernel, the following vulnerability has been resolved: bpf/bonding: reject vlan+srcmac xmithashpolicy change when XDP is loaded bondoptionmodeset already rejects mode changes that would make a loaded XDP program incompatible via bondxdpcheck. However, bondoptionxmithashpolicyset has ...

Siemens SIMATIC S7-1500 TM MFP NULL Pointer Dereference (CVE-2026-23396)

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL deref in meshmatcheslocal meshmatcheslocal unconditionally dereferences ie-meshconfig to compare mesh configuration parameters. When called from meshrxcsaframe, the parsed action-frame elements may not...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46161)

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix divide-by-zero in setupgeo with zero farcopies setupgeo extracts nearcopies nc and farcopies fc from the user-provided layout parameter without checking for zero. When fc=0 with the 'improved' far set layout...