Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43052)

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check tdls flag in ieee80211tdlsoper When NL80211TDLSENABLELINK is called, the code only checks if the station exists but not whether it is actually a TDLS station. This allows the operation to proceed for non-TDL...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46102)

In the Linux kernel, the following vulnerability has been resolved: net: strparser: fix skbhead leak in strpabortstrp When the stream parser is aborted, for example after a message assembly timeout, it can still hold a reference to a partially assembled message in strp-skbhead. That skb is not...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46038)

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: ns: Free the node during ctrlcmdbye A node sends the BYE packet when it is about to go down. So the nameserver should advertise the removal of the node to all remote and local observers and free the node finally. But...

Siemens SIMATIC S7-1500 TM MFP Use After Free (CVE-2024-58083)

In the Linux kernel, the following vulnerability has been resolved: KVM: Explicitly verify target vCPU is online in kvmgetvcpu Explicitly verify the target vCPU is fully online prior to clamping the index in kvmgetvcpu. If the index is 'bad', the nospec clamping will generate '0', i.e. KVM will...

Siemens SIMATIC S7-1500 TM MFP Use After Free (CVE-2024-58013)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmtremoveadvmonitorsync This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in...

Siemens SIMATIC S7-1500 TM MFP Improper Validation of Consistency within Input (CVE-2026-31488)

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not skip unrelated mode changes in DSC validation Starting with commit 17ce8a6907f7 'drm/amd/display: Add dsc pre-validation in atomic check', amdgpu resets the CRTC state modechanged flag to false when...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53265)

In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: check allocation under invalidate lock commit 2d1f7b65f5de 'dm cache policy smq: fix missing locks in invalidating cache blocks' added mq-lock around the destructive part of smqinvalidatemapping, but left the...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31698)

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed When retrieving the PDH cert, don't attempt to copy the blobs to userspace if the firmware command failed. If the failure was due to an invalid length...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53225)

"In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in sctprcvasconflookup sctprcvasconflookup in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af-fromaddrparam, which reads the full address ...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2024-36922)

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: read txq-readptr under lock If we read txq-readptr without lock, we can read the same value twice, then obtain the lock, and reclaim from there to two different places, but crucially reclaim the same entry twice,...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31642)

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix call removal to use RCU safe deletion Fix rxrpc call removal from the rxnet-calls list to use listdelrcu rather than listdelinit to prevent stuffing up reading /proc/net/rxrpc/calls from potentially getting into an...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-43493)

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix handling of MAYBACKLOG requests MAYBACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 TM MFP Use After Free (CVE-2026-53264)

"In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER an...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-52917)

In the Linux kernel, the following vulnerability has been resolved: sctp: diag: reject stale associations in dumpone path The SCTP exact sockdiag lookup can hold a transport reference, block on locksocksk, and then resume after sctpassociationfree has marked the association dead and freed its bin...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31673)

In the Linux kernel, the following vulnerability has been resolved: afunix: read UNIXDIAGVFS data under unixstatelock Exact UNIX diag lookups hold a reference to the socket, but not to u-path. Meanwhile, unixreleasesock clears u-path under unixstatelock and drops the path reference after unlockin...

Siemens SIMATIC S7-1500 TM MFP Use After Free (CVE-2025-21700)

In the Linux kernel, the following vulnerability has been resolved: net: sched: Disallow replacing of child qdisc from one parent to another Lion Ackermann was able to create a UAF which can be abused for privilege escalation with the following script Step 1. create root qdisc tc qdisc add dev lo...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31500)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: serialize btintelhwerror with hcireqsynclock btintelhwerror issues two hcicmdsync calls HCIOPRESET and Intel exception-info retrieval without holding hcireqsynclock. This lets it race against hcidevdoclose -...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53221)

In the Linux kernel, the following vulnerability has been resolved: ip6vti: fix incorrect tunnel matching in vti6tnllookup In vti6tnllookup, when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remot...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46168)

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix scheduling with atomic in timestamp sockopt Using locksockfast atomic context around socksettimestamp and socksettimestamping is unsafe, as both helpers can sleep. Replace locksockfast with sleepable locksock/releaseso...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23302)

In the Linux kernel, the following vulnerability has been resolved: net: annotate data-races around sk-skdataready,writespace skmsg and probably other layers are changing these pointers while other cpus might read them concurrently. Add corresponding READONCE/WRITEONCE annotations for UDP, TCP an...