Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46275)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciuart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free UAF and Null Pointer Dereference NPD conditions were observed in the lifecycle management of hciuart. The primary...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23389)

In the Linux kernel, the following vulnerability has been resolved: ice: Fix memory leak in icesetringparam In icesetringparam, txrings and xdprings are allocated before rxrings. If the allocation of rxrings fails, the code jumps to the done label leaking both txrings and xdprings. Furthermore, i...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46088)

In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Validate buflen before strnlen in sndctleleminitenumnames sndctleleminitenumnames advances pointer p through the names buffer while decrementing buflen. If buflen reaches zero but items remain, the next iteration...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31624)

In the Linux kernel, the following vulnerability has been resolved: HID: core: clamp reportsize in s32ton to avoid undefined shift s32ton shifts by n-1 where n is the field's reportsize, a value that comes directly from a HID device. The HID parser bounds reportsize only to 32 clamp to the functi...

Siemens SIMATIC S7-1500 TM MFP Integer Underflow (CVE-2026-31617)

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: validate minimum blocklen in ncmunwrapntb The blocklen read from the host-supplied NTB header is checked against ntbmax but has no lower bound. When blocklen is smaller than opts-ndpsize, the bounds check of:...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45834)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2capsockstatechangecb Add the same NULL guard already present in l2capsockresumecb and l2capsockreadycb. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46056)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix potential UAF in SSP passkey handlers hciconn lookup and field access must be covered by hdev lock in hciuserpasskeynotifyevt and hcikeypressnotifyevt, otherwise the connection can be freed concurrently...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46050)

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix deadlock with check operation and nowait requests When an array check is running it will raise the barrier at which point normal requests will become blocked and increment the nrpending value to signal there is wor...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2025-39997)

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix race condition to UAF in sndusbmidifree The previous commit 0718a78f6a9f 'ALSA: usb-audio: Kill timer properly at removal' patched a UAF issue caused by the error timer. However, because the error timer kill...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46120)

In the Linux kernel, the following vulnerability has been resolved: ip6gre: Use cached t-net in ip6erspanchangelink. After commit 5e72ce3e3980 'net: ipv6: Use link netns in newlink of rtnllinkops', ip6erspannewlink correctly resolves the per-netns ip6gre hash via linknet. ip6erspanchangelink was...

Siemens SIMATIC S7-1500 TM MFP Detection of Error Condition Without Action (CVE-2026-23317)

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Return the correct value in vmwtranslateptr functions Before the referenced fixes these functions used a lookup function that returned a pointer. This was changed to another lookup function that returned an error code...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53255)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate advertising TLV before type checks tlvdataisvalid reads each advertising data field length from datai, then inspects datai + 1 for managed EIR types before checking that the current field still fits insi...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43421)

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fncm: Fix netdevice lifecycle with devicemove The network device outlived its parent gadget device during disconnection, resulting in dangling sysfs links and null pointer dereference problems. A prior attempt to sol...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43080)

In the Linux kernel, the following vulnerability has been resolved: l2tp: Drop large packets with UDP encap syzbot reported a WARN on my patch series 1. The actual issue is an overflow of 16-bit UDP length field, and it exists in the upstream code. My series added a debug WARN with an overflow...

Siemens SIMATIC S7-1500 TM MFP Improper Control of a Resource Through its Lifetime (CVE-2026-23253)

In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: fix wrong reinitialization of ringbuffer on reopen dvbdvropen calls dvbringbufferinit when a new reader opens the DVR device. dvbringbufferinit calls initwaitqueuehead, which reinitializes the waitqueue list head...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43099)

In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: fix null-ptr-deref in icmpbuildprobe ipv6stub-ipv6devfind may return ERRPTR-EAFNOSUPPORT when the IPv6 stack is not active CONFIGIPV6=m and not loaded, and passing this error pointer to devhold will cause a kernel cra...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46069)

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix use-after-free in mwifiexadaptercleanup The mwifiexadaptercleanup function uses timerdelete non-synchronous for the wakeuptimer before the adapter structure is freed. This is incorrect because timerdelete does...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46107)

In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function rebalancechildren. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23444)

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: always free skb on ieee80211txprepareskb failure ieee80211txprepareskb has three error paths, but only two of them free the skb. The first error path ieee80211txprepare returning TXDROP does not free it, while...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46185)

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in symlinkdata Since smb2checkmessage returns success without length validation for the symlink error response, in symlinkdata it is possible for iov-iovlen to be smaller than sizeofstruct...