Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53225)

"In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in sctprcvasconflookup sctprcvasconflookup in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af-fromaddrparam, which reads the full address ...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46304)

"In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq flush in nvmetctrlfree nvmettcpreleasequeuework runs on nvmet-wq and can drop the final controller reference through nvmetcqput. If that triggers nvmetctrlfree, the teardown path flushes...

Siemens SIMATIC S7-1500 TM MFP Time-of-check Time-of-use (CVE-2026-46227)

In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctpsendmsgtoasoc in SCTPSENDALL The SCTPSENDALL path in sctpsendmsg iterates ep-asocs with listforeachentrysafe, which caches the next entry in @tmp before the loop body runs. The body calls...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31611)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require 3 sub-authorities before reading subauth2 parsedacl compares each ACE SID against sidunixNFSmode and on match reads sid.subauth2 as the file mode. If sidunixNFSmode is the prefix S-1-5-88-3 with numsubauth = 2 then...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31625)

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix NULL pointer dereference in alpsrawevent Commit ecfa6f34492c 'HID: Add HIDCLAIMEDINPUT guards in rawevent callbacks missing them' attempted to fix up the HID drivers that had missed the previous fix that was done i...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46137)

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADDADDR rtx: fix potential data-race This mptcppmaddtimer helper is executed as a timer callback in softirq context. To avoid any data races, the socket lock needs to be held with bhlocksock. If the socket is in use,...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23336)

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel rfkillblock work in wiphyunregister There is a use-after-free error in cfg80211shutdownallinterfaces found by syzkaller: BUG: KASAN: use-after-free in cfg80211shutdownallinterfaces+0x213/0x220 Read of size ...

Siemens SIMATIC S7-1500 TM MFP Improper Control of a Resource Through its Lifetime (CVE-2026-43503)

"In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers pskbcopyfclone and skbshift fail to propagate the SKBFLSHAREDFRAG bit in skbshinfo-flags when moving frags from source to...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53337)

"In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix NULL pointer dereference in bonddoioctl In bonddoioctl, slavedev is obtained via devgetbyname which can return NULL if the requested interface name does not exist. However, the subsequent slavedbg call is place...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46107)

In the Linux kernel, the following vulnerability has been resolved: dm-thin: fix metadata refcount underflow There's a bug in dm-thin in the function rebalancechildren. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46180)

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task Watchdog task might end between sendsig and kthreadstop calls, what results in the use-after-free issue. Fix this by increasing watchdog task referenc...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46128)

In the Linux kernel, the following vulnerability has been resolved: ipmi: Check event message buffer response for bad data The event message buffer response data size got checked later when processing, but check it right after the response comes back. It appears some BMCs may return an empty...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53181)

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix skackbacklog leak on failed handshake When vmcitransportrecvconnectingserver returns an error, vmcitransportrecvlisten calls vsockremovepending but never calls skacceptqremoved. This leaves skackbacklog incremente...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-45842)

"In the Linux kernel, the following vulnerability has been resolved: slip: reject VJ receive packets on instances with no rstate array slhcinit accepts rslots == 0 as a valid configuration, with the documented meaning of 'no receive compression'. In that case the allocation loop in slhcinit is...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53150)

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject zero-length property entries in validator tbpropertyentryvalid accepts entries with length == 0 for DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes validation but causes an underflow in the...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46018)

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: stop parsing UAC2 rates at MAXNRRATES parseuac2sampleraterange caps the number of enumerated rates at MAXNRRATES, but it only breaks out of the current rate loop. A malformed UAC2 RANGE response with additional...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53228)

In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6tunnelxmit caches the inner IPv6 header pointer at function entry and continues using it after iptunnelhandleoffloads. For GSO skbs, iptunnelhandleoffloads calls...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31711)

"In the Linux kernel, the following vulnerability has been resolved: smb: server: fix activenumconn leak on transport allocation failure Commit 77ffbcac4e56 'smb: server: fix leak of activenumconn in ksmbdtcpnewconnection' addressed the kthreadrun failure path. The earlier alloctransport == NULL...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23444)

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: always free skb on ieee80211txprepareskb failure ieee80211txprepareskb has three error paths, but only two of them free the skb. The first error path ieee80211txprepare returning TXDROP does not free it, while...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53131)

In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using ethhdr ip6teui64, xtmac, the bitmap:ip,mac, hash:ip,mac, and hash:mac ipset types, and nflogsyslog access ethhdrskb after either assuming that the skb is associated with an...