Back to CVE records
Medium 5.5Published Apr 3, 2026
CVE-2026-31391crypto: atmel-sha204a - Fix OOM ->tfm_count leak
Updated under an hour ago ()
Does this affect you?
It affects Linux and 4 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - Fix OOM ->tfm_count leak If memory allocation fails, decrement ->tfm_count to avoid blocking future reads.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from da001fb651b00e1deeaf24767dd691ae8152a4f5 before c2d0c45dbb9eb272385ae919b17eef5a5318d3f8; from da001fb651b00e1deeaf24767dd691ae8152a4f5 before 66ee9c1c3575b5d6afc340faca00fd40ed5b7ad9; from da001fb651b00e1deeaf24767dd691ae8152a4f5 before 2bfc83cee05f8b9604502df27d94e8e2b4a3dbf1; from da001fb651b00e1deeaf24767dd691ae8152a4f5 before 1ab70c260cf16f931a728b2cb63fff5f38c814d8; from da001fb651b00e1deeaf24767dd691ae8152a4f5 before 6f502049a96b368ea6646c49d9520d6f69a101fa; from da001fb651b00e1deeaf24767dd691ae8152a4f5 before fd262dc6d758232511127372eba866b7600739ba; from da001fb651b00e1deeaf24767dd691ae8152a4f5 before d240b079a37e90af03fd7dfec94930eb6c83936e | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 5.3 before 5.10.253; from 5.11 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10; 7.0; 7.0 | NVD |
References
- https://git.kernel.org/stable/c/c2d0c45dbb9eb272385ae919b17eef5a5318d3f8patch
- https://git.kernel.org/stable/c/66ee9c1c3575b5d6afc340faca00fd40ed5b7ad9patch
- https://git.kernel.org/stable/c/2bfc83cee05f8b9604502df27d94e8e2b4a3dbf1patch
- https://git.kernel.org/stable/c/1ab70c260cf16f931a728b2cb63fff5f38c814d8patch
- https://git.kernel.org/stable/c/6f502049a96b368ea6646c49d9520d6f69a101fapatch
- https://git.kernel.org/stable/c/fd262dc6d758232511127372eba866b7600739bapatch
- https://git.kernel.org/stable/c/d240b079a37e90af03fd7dfec94930eb6c83936epatch
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.