Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46209)

"In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane dimension calculation in drmgemfbinitwithfuncs drmgemfbinitwithfuncs computes sub-sampled plane dimensions using plain integer division: unsigned int width = modecmd-width / i ? info-hsub : 1...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46234)

In the Linux kernel, the following vulnerability has been resolved: vsock: fix buffer size clamping order In vsockupdatebuffersize, the buffer size was being clamped to the maximum first, and then to the minimum. If a user sets a minimum buffer size larger than the maximum, the minimum check...

Siemens SIMATIC S7-1500 TM MFP Use After Free (CVE-2025-21791)

In the Linux kernel, the following vulnerability has been resolved: vrf: use RCU protection in l3mdevl3out l3mdevl3out can be called without RCU being held: rawsendmsg ippushpendingframes ipsendskb iplocalout iplocalout l3mdevipout Add rcureadlock / rcureadunlock pair to avoid a potential UAF. Th...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46065)

In the Linux kernel, the following vulnerability has been resolved: fbdev: defio: Disconnect deferred I/O from the lifetime of struct fbinfo Hold state of deferred I/O in struct fbdeferrediostate. Allocate an instance as part of initializing deferred I/O and remove it only after the final mapping...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53192)

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at sndtimeruserparams At releasing a timer object, e.g. when a userspace timer CONFIGSNDUTIMER gets closed and sndtimerfree is called, it tries to detach the timer instances and release the resources. However...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45836)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2capsockgetsndtimeocb Add the same NULL guard already present in l2capsockresumecb and l2capsockreadycb. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 TM MFP Release of Invalid Pointer or Reference (CVE-2026-23352)

In the Linux kernel, the following vulnerability has been resolved: x86/efi: defer freeing of boot services memory efifreebootservices frees memory occupied by EFIBOOTSERVICESCODE and EFIBOOTSERVICESDATA using memblockfreelate. There are two issue with that: memblockfreelate should be used for...

Siemens SIMATIC S7-1500 TM MFP NULL Pointer Dereference (CVE-2025-21790)

In the Linux kernel, the following vulnerability has been resolved: vxlan: check vxlanvnigroupinit return value vxlaninit must check vxlanvnigroupinit success otherwise a crash happens later, spotted by syzbot. Oops: general protection fault, probably for non-canonical address 0xdffffc000000002c:...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46150)

In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotifygetmarksafe may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping over detached marks that are not in the...

Siemens SIMATIC S7-1500 TM MFP Use After Free (CVE-2025-39863)

"In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free when rescheduling brcmfbtcoexinfo work The brcmfbtcoexdetach only shuts down the btcoex timer, if the flag timeron is false. However, the brcmfbtcoextimerfunc, which runs as timer handler, sets...

Siemens SIMATIC S7-1500 TM MFP Multiple Locks of a Critical Resource (CVE-2026-23292)

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix recursive locking in configfsopenfile In flushwritebuffer, &p-fragsem is acquired and then the loaded store function is called, which, here, is targetcoreitemdbrootstore. This function called filpopen, following...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31630)

In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for %pISpc output The AFRXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with '%pISpc'. That is too small for the longest current-tree IPv6-with-port...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31699)

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed When retrieving the PEK CSR, don't attempt to copy the blob to userspace if the firmware command failed. If the failure was due to an invalid length, i.e...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23315)

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: Fix possible oob access in mt76connac2macwritetxwi80211 Check frame length before accessing the mgmt fields in mt76connac2macwritetxwi80211 in order to avoid a possible oob access. fix check to also cover...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53147)

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tbxdphandlerequest casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer...

Siemens SIMATIC S7-1500 TM MFP Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2025-21738)

In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer reveliofuzzing reported that a SCSIIOCTLSENDCOMMAND ioctl with outlen set to 0xd42, SCSI command set to ATA16 PASS-THROUGH, ATA command set to ATANOP, and...

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: openvswitch: defer tunnel netdevput to RCU release CVE-2026-31678 kernel: xfrm: espintcp: do not reuse an in-progress partial send CVE-2026-52935 kernel: USB: serial: mxuport: fix memory...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2025-38105)

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer in an active state while the assigned...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31580)

In the Linux kernel, the following vulnerability has been resolved: bcache: fix cacheddev.sbbio use-after-free and crash In our production environment, we have received multiple crash reports regarding libceph, which have caught our attention: 6888366.280350 Call Trace: 6888366.280452...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46163)

In the Linux kernel, the following vulnerability has been resolved: wifi: b43legacy: enforce bounds check on firmware key index in RX path Same fix as b43: the firmware-controlled key index in b43legacyrx can exceed dev-maxnrkeys. The existing B43legacyWARNON is non-enforcing in production builds...