Siemens SIMATIC S7-1500 TM MFP Improper Validation of Consistency within Input (CVE-2026-31488)

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not skip unrelated mode changes in DSC validation Starting with commit 17ce8a6907f7 'drm/amd/display: Add dsc pre-validation in atomic check', amdgpu resets the CRTC state modechanged flag to false when...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23291)

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: properly drop the usb interface reference on disconnect When the device is disconnected from the driver, there is a 'dangling' reference count on the usb interface that was grabbed in the probe callback. Fix this up b...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23278)

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: always walk all pending catchall elements During transaction processing we might have more than one catchall element: 1 live catchall element and 1 pending element that is coming as part of the new batch. If...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53227)

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix possible kfreeskb of ERRPTR After the patch in the 'Fixes' tag, the allocation of the 'reply' skb can happen either before or after locking the ovsmutex. However, error cleanups still follow the classical...

Siemens SIMATIC S7-1500 TM MFP Out-of-bounds Write (CVE-2026-46195)

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DACL pointers parsesecdesc, buildsecdesc, and the chown path in idmodetocifsacl all add the server-supplied dacloffset to pntsd before proving a DACL header fits inside the returne...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-52929)

In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADDOUTSTREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext a...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2024-57993)

In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: Fix warning in thrustmasterprobe by adding endpoint check syzbot has found a type mismatch between a USB pipe and the transfer endpoint, which is triggered by the hid-thrustmaster driver1. There is a number...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53168)

In the Linux kernel, the following vulnerability has been resolved: fuse: reject fusenotify pagecache ops on directories The operations FUSENOTIFYSTORE and FUSENOTIFYRETRIEVE allow the FUSE daemon to actively write/read pagecache contents. For directories with FOPENCACHEDIR, the pagecache is used...

Siemens SIMATIC S7-1500 TM MFP Incorrect Synchronization (CVE-2026-23281)

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix use-after-free in lbsfreeadapter The lbsfreeadapter function uses timerdelete non-synchronous for both commandtimer and txlockuptimer before the structure is freed. This is incorrect because timerdelete does n...

Siemens SIMATIC S7-1500 TM MFP NULL Pointer Dereference (CVE-2025-21779)

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reject Hyper-V's SENDIPI hypercalls if local APIC isn't in-kernel Advertise support for Hyper-V's SENDIPI and SENDIPIEX hypercalls if and only if the local API is emulated/virtualized by KVM, and explicitly reject said...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46167)

In the Linux kernel, the following vulnerability has been resolved: usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl Just like in a previous problem in this driver, usblpctrlmsg will collapse the usbcontrolmsg return value to 0/-errno, discarding the actual number of bytes transferre...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46083)

In the Linux kernel, the following vulnerability has been resolved: spi: fix resource leaks on device setup failure Make sure to call controller cleanup if spisetup fails while registering a device to avoid leaking any resources allocated by setup. This plugin only works with Tenable.ot. Please...

Siemens SIMATIC S7-1500 TM MFP Signal Handler Race Condition (CVE-2026-23372)

In the Linux kernel, the following vulnerability has been resolved: nfc: rawsock: cancel txwork before socket teardown In rawsockrelease, cancel any pending txwork and purge the write queue before orphaning the socket. rawsocktxwork runs on the system workqueue and calls nfcdataexchange which...

Siemens SIMATIC S7-1500 TM MFP Plaintext Storage of a Password (CVE-2026-23303)

In the Linux kernel, the following vulnerability has been resolved: smb: client: Don't log plaintext credentials in cifssetcifscreds When debug logging is enabled, cifssetcifscreds logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing...

Siemens SIMATIC S7-1500 TM MFP Heap-based Buffer Overflow (CVE-2026-53362)

In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In ip6appenddata, when the paged-allocation branch is taken MSGMORE / NETIFFSG / large fraglen, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen;...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43093)

In the Linux kernel, the following vulnerability has been resolved: xsk: tighten UMEM headroom validation to account for tailroom and min frame The current headroom validation in xdpumemreg could leave us with insufficient space dedicated to even receive minimum-sized ethernet frame. Furthermore ...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46322)

In the Linux kernel, the following vulnerability has been resolved: tun: free page on buildskb failure in tunxdpone When buildskb fails in tunxdpone, the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhostnetbuildxdp allocated for the frame. ...

Siemens SIMATIC S7-1500 TM MFP Expired Pointer Dereference (CVE-2026-46125)

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: remove station if connection prep fails If connection preparation fails for MLO connections, then the interface is completely reset to non-MLD. In this case, we must not keep the station since it's related to the...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-52947)

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtrportremove In qrtrportremove, the socket reference count is decremented via sockput before the port is removed from the qrtrports XArray and before the RCU grace period...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46165)

In the Linux kernel, the following vulnerability has been resolved: openvswitch: vport: fix self-deadlock on release of tunnel ports vports are used concurrently and protected by RCU, so netdevput must happen after the RCU grace period. So, either in an RCU call or after the synchronizenet. The...