Siemens SIMATIC S7-1500 TM MFP Out-of-bounds Read (CVE-2026-23141)

In the Linux kernel, the following vulnerability has been resolved: btrfs: send: check for inline extents in rangeisholeinparent Before accessing the diskbytenr field of a file extent item we need to check if we are dealing with an inline extent. This is because for inline extents their data star...

Siemens SIMATIC S7-1500 TM MFP Multiple Locks of a Critical Resource (CVE-2026-23292)

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix recursive locking in configfsopenfile In flushwritebuffer, &p-fragsem is acquired and then the loaded store function is called, which, here, is targetcoreitemdbrootstore. This function called filpopen, following...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45991)

In the Linux kernel, the following vulnerability has been resolved: udf: fix partition descriptor append bookkeeping Mounting a crafted UDF image with repeated partition descriptors can trigger a heap out-of-bounds write in partdescsloc. handlepartitiondescriptor deduplicates entries by partition...

Siemens SIMATIC S7-1500 TM MFP Out-of-bounds Write (CVE-2026-46195)

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers parsesecdesc, buildsecdesc, and the chown path in idmodetocifsacl all add the server-supplied dacloffset to pntsd before proving a DACL header fits inside the returne...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31612)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate EaNameLength in smb2getea smb2getea reads eareq-EaNameLength from the client request and passes it directly to strncmp as the comparison length without verifying that the length of the name really is the size of t...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31696)

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing validation of ticket length in non-XDR key preparsing In rxrpcpreparse, there are two paths for parsing key payloads: the XDR path for large payloads and the non-XDR path for payloads = 28 bytes. While the XDR...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31708)

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read in smb2ioctlqueryinfo QUERYINFO path smb2ioctlqueryinfo has two response-copy branches: PASSTHRUFSCTL and the default QUERYINFO path. The QUERYINFO branch clamps qi.inputbufferlength to the server-report...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2025-21830)

In the Linux kernel, the following vulnerability has been resolved: landlock: Handle weird files A corrupted filesystem e.g. bcachefs might return weird files. Instead of throwing a warning and allowing access to such file, treat them as regular files. This plugin only works with Tenable.ot. Plea...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43099)

In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: fix null-ptr-deref in icmpbuildprobe ipv6stub-ipv6devfind may return ERRPTR-EAFNOSUPPORT when the IPv6 stack is not active CONFIGIPV6=m and not loaded, and passing this error pointer to devhold will cause a kernel cra...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53080)

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsfw: fix NULL dereference of 'old' filters before change Like pointed out by Sashiko 1, since commit ed76f5edccc9 'net: sched: protect filterchain list with filterchainlock mutex' TC filters are added to a shared blo...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53228)

In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6tunnelxmit caches the inner IPv6 header pointer at function entry and continues using it after iptunnelhandleoffloads. For GSO skbs, iptunnelhandleoffloads calls...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31613)

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB reads parsing symlink error response When a CREATE returns STATUSSTOPPEDONSYMLINK, smb2checkmessage returns success without any length validation, leaving the symlink parsers as the only defense against an...

Siemens SIMATIC S7-1500 TM MFP Improper Validation of Consistency within Input (CVE-2026-31709)

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the whole DACL before rewriting it in cifsacl buildsecdesc and idmodetocifsacl derive a DACL pointer from a server-supplied dacloffset and then use the incoming ACL to rebuild the chmod/chown security...

Linux kernel RAID1 DoS

The vulnerability in the raid1readrequest function within the drivers/md/raid1.c component of the Linux kernel operating system is related to an improper thread management implementation. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

Linux kernel xfrm_input_state_lookup Buffer Overflow

The vulnerability of the xfrminputstatelookup function in the net/xfrm/xfrmstate.c component of the Linux kernel is related to the improper implementation of the control flow. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibili...

Linux Kernel Heap Buffer Overflow DoS

The vulnerability of the ocfs2readblocks function in the fs/ocfs2/bufferheadio.c file of the Linux kernel is related to the improper implementation of thread management. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the msmstartup function in the drivers/tty/serial/msmSerial.c component of the Linux kernel is related to the improper implementation of thread management. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the groupprocesstileroom function in the drivers/gpu/drm/panthor/panthorsched.c file of the Linux kernel is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the aspeedtachvaltorpm function in the drivers/hwmon/aspeed-g6-pwm-tach.c component of the Linux kernel is related to the improper implementation of the control flow. Exploiting this vulnerability could allow an attacker to cause a service failure...

Linux kernel pmbus_regulator_notify_worker Heap Buffer Overflow DoS

The vulnerability of the pmbusregulatornotifyworker function in the drivers/hwmon/pmbus/pmbuscore.c file of the Linux kernel is related to the improper implementation of thread management. Exploiting this vulnerability could allow an attacker to compromise the integrity and accessibility of...