Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46122)

In the Linux kernel, the following vulnerability has been resolved: wifi: b43: enforce bounds check on firmware key index in b43rx The firmware-controlled key index in b43rx can exceed the dev-key array size 58 entries. The existing B43WARNON is non-enforcing in production builds, allowing an...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46136)

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix a potential clc buffer length underflow The buflen is used to limit the iterations for retrieving the country power setting and may underflow under certain conditions due to changes in the power table in...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31685)

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6teui64: reject invalid MAC header for all packets eui64mt6 derives a modified EUI-64 from the Ethernet source address and compares it with the low 64 bits of the IPv6 source address. The existing guard only rejects ...

Siemens SIMATIC S7-1500 TM MFP Unchecked Return Value (CVE-2025-21832)

In the Linux kernel, the following vulnerability has been resolved: block: don't revert iter for -EIOCBQUEUED blkdevreaditer has a few odd checks, like gating the position and count adjustment on whether or not the result is bigger-than-or-equal to zero where bigger than makes more sense, and not...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53131)

In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using ethhdr ip6teui64, xtmac, the bitmap:ip,mac, hash:ip,mac, and hash:mac ipset types, and nflogsyslog access ethhdrskb after either assuming that the skb is associated with an...

ALSA-2026:85773 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-52935 kernel: USB: serial: ioti: fix heap overflow in getmanufinfo CVE-2026-53196 kernel: sctp: keep chunk-transport in...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2025-21708)

In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: enable basic endpoint checking Syzkaller reports 1 encountering a common issue of utilizing a wrong usb endpoint type during URB submitting stage. This, in turn, triggers a warning shown below. For now, enable...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46321)

In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tunxdpone tunxdpone returns -EINVAL on a frame shorter than ETHHLEN without freeing the page that vhostnetbuildxdp allocated for it. tunsendmsg discards that -EINVAL and still returns...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53256)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: hold listener socket in rfcommconnectind rfcommgetsockbychannel scans rfcommsklist under the list lock, but returns the selected listener after dropping that lock without taking a reference. rfcommconnectind th...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53181)

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix skackbacklog leak on failed handshake When vmcitransportrecvconnectingserver returns an error, vmcitransportrecvlisten calls vsockremovepending but never calls skacceptqremoved. This leaves skackbacklog incremente...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46180)

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Watchdog task might end between sendsig and kthreadstop calls, what results in the use-after-free issue. Fix this by increasing watchdog task referenc...

Siemens SIMATIC S7-1500 TM MFP Plaintext Storage of a Password (CVE-2026-23303)

In the Linux kernel, the following vulnerability has been resolved: smb: client: Don't log plaintext credentials in cifssetcifscreds When debug logging is enabled, cifssetcifscreds logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31697)

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed When retrieving the ID for the CPU, don't attempt to copy the ID blob to userspace if the firmware command failed. If the failure was due to an invalid...

Siemens SIMATIC S7-1500 TM MFP Heap-based Buffer Overflow (CVE-2026-53362)

In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In ip6appenddata, when the paged-allocation branch is taken MSGMORE / NETIFFSG / large fraglen, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen;...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46083)

In the Linux kernel, the following vulnerability has been resolved: spi: fix resource leaks on device setup failure Make sure to call controller cleanup if spisetup fails while registering a device to avoid leaking any resources allocated by setup. This plugin only works with Tenable.ot. Please...

Siemens SIMATIC S7-1500 TM MFP Signal Handler Race Condition (CVE-2026-23372)

In the Linux kernel, the following vulnerability has been resolved: nfc: rawsock: cancel txwork before socket teardown In rawsockrelease, cancel any pending txwork and purge the write queue before orphaning the socket. rawsocktxwork runs on the system workqueue and calls nfcdataexchange which...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53146)

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain response copy to actual frame size tbxdomaincopy copies req-responsesize bytes from the received packet buffer regardless of the actual frame size. When a short response arrives, this reads past the val...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-52918)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: serialize acceptq access btsockpoll walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchronized accept queue walk has existed since th...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2025-23131)

In the Linux kernel, the following vulnerability has been resolved: dlm: prevent NPD when writing a positive value to eventdone douevent returns the value written to eventdone. In case it is a positive value, newlockspace would undo all the work, and lockspace would not be set. dlmnewlockspace,...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46187)

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix kthread lifetime race between self-exit and external-stop RSI driver use both self-exitkthreadcompleteandexit and external-stop kthreadstop when killing a kthread. Generally, kthreadstop is called first, and in thi...