Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46149)

In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf return in tgptgpmembersshow targettgptgpmembersshow formats LUN paths with snprintf into a 256-byte stack buffer, then will memcpy curlen bytes from that buffer. snprintf returns the length...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46161)

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix divide-by-zero in setupgeo with zero farcopies setupgeo extracts nearcopies nc and farcopies fc from the user-provided layout parameter without checking for zero. When fc=0 with the 'improved' far set layout...

Siemens SIMATIC S7-1500 TM MFP NULL Pointer Dereference (CVE-2026-23396)

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL deref in meshmatcheslocal meshmatcheslocal unconditionally dereferences ie-meshconfig to compare mesh configuration parameters. When called from meshrxcsaframe, the parsed action-frame elements may not...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23310)

In the Linux kernel, the following vulnerability has been resolved: bpf/bonding: reject vlan+srcmac xmithashpolicy change when XDP is loaded bondoptionmodeset already rejects mode changes that would make a loaded XDP program incompatible via bondxdpcheck. However, bondoptionxmithashpolicyset has ...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46243)

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.spnego descriptions cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcalltarget that cifs.upcall treats as kernel-originating inputs. However,...

Siemens SIMATIC S7-1500 TM MFP Improper Resource Locking (CVE-2026-23356)

In the Linux kernel, the following vulnerability has been resolved: drbd: fix 'LOGIC BUG' in drbdalbeginiononblock Even though we check that we 'should' be able to do lcgetcumulative while holding the device-allock spinlock, it may still fail, if some other code path decided to do lctrylock with...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23389)

In the Linux kernel, the following vulnerability has been resolved: ice: Fix memory leak in icesetringparam In icesetringparam, txrings and xdprings are allocated before rxrings. If the allocation of rxrings fails, the code jumps to the done label leaking both txrings and xdprings. Furthermore, i...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53358)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use chan timer to close channels in cleanuplisten l2capchanclose removes the channel from conn-chanl, which must be done under conn-lock. cleanuplisten runs under the parent sklock, so acquiring conn-lock would...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53177)

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix NULL pointer dereference PCIe errors detected by a Root Port or Downstream Port cause error recovery services to run on all subordinate devices regardless of administrative state. The .errordetected callback,...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2025-39997)

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix race condition to UAF in sndusbmidifree The previous commit 0718a78f6a9f 'ALSA: usb-audio: Kill timer properly at removal' patched a UAF issue caused by the error timer. However, because the error timer kill...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53255)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate advertising TLV before type checks tlvdataisvalid reads each advertising data field length from datai, then inspects datai + 1 for managed EIR types before checking that the current field still fits insi...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46056)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: fix potential UAF in SSP passkey handlers hciconn lookup and field access must be covered by hdev lock in hciuserpasskeynotifyevt and hcikeypressnotifyevt, otherwise the connection can be freed concurrently...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31407)

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: add missing netlink policy validations Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink. These attributes are used by the kernel without any validation. Extend the netlink policies accordingly...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46196)

In the Linux kernel, the following vulnerability has been resolved: tracepoint: balance regfunc on funcadd failure in tracepointaddfunc When a tracepoint goes through the 0 - 1 transition, tracepointaddfunc invokes the subsystem's ext-regfunc before attempting to install the new probe via funcadd...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46275)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciuart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free UAF and Null Pointer Dereference NPD conditions were observed in the lifecycle management of hciuart. The primary...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53350)

In the Linux kernel, the following vulnerability has been resolved: ASoC: wmadsp: Fix NULL dereference when removing firmware controls In wmadspcontrolremove check that the priv pointer is not NULL before attempting to cleanup what it points to. When csdsp creates a control it calls...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46088)

In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Validate buflen before strnlen in sndctleleminitenumnames sndctleleminitenumnames advances pointer p through the names buffer while decrementing buflen. If buflen reaches zero but items remain, the next iteration...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46120)

In the Linux kernel, the following vulnerability has been resolved: ip6gre: Use cached t-net in ip6erspanchangelink. After commit 5e72ce3e3980 'net: ipv6: Use link netns in newlink of rtnllinkops', ip6erspannewlink correctly resolves the per-netns ip6gre hash via linknet. ip6erspanchangelink was...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31624)

In the Linux kernel, the following vulnerability has been resolved: HID: core: clamp reportsize in s32ton to avoid undefined shift s32ton shifts by n-1 where n is the field's reportsize, a value that comes directly from a HID device. The HID parser bounds reportsize only to 32 clamp to the functi...

Siemens SIMATIC S7-1500 TM MFP Missing Lock Check (CVE-2026-23382)

In the Linux kernel, the following vulnerability has been resolved: HID: Add HIDCLAIMEDINPUT guards in rawevent callbacks missing them In commit 2ff5baa9b527 'HID: appleir: Fix potential NULL dereference at raw event handle', we handle the fact that raw event callbacks can happen even for a HID...