p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Schwachstellen im Stack Betriebssysteme · Seite 17

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für Betriebssysteme: 6365. Davon im KEV-Katalog: 2.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Betriebssysteme

Sicherheitslücken: 159079

  1. CVE-2026-98953

    Nicht bewertetEPSS 0,18%Korrektur verfügbar

    devlink: fix devlink_rel reference leak when notify work is pending

    In the Linux kernel, the following vulnerability has been resolved: devlink: fix devlink_rel reference leak when notify work is pending devlink_rel_nested_in_notify_work_schedule() takes a reference on the devlink_rel for the notify work and then queues the work, ignoring the return value of schedule_delayed_work(). If the work is already pending, nothing new is queued, the work runs only once and drops only one reference, so the extra one is leaked together with the devlink_rel and its index in devlink_rels. This is easy to hit. devl_register() of a nested instance queues the work, and if the instance is unregistered before the work has r

    linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azureBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.11-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-98952

    Hoch · CVSS 7.3EPSS 0,38%Korrektur verfügbar

    pfcp: make sure the SEID is linear before reading it

    In the Linux kernel, the following vulnerability has been resolved: pfcp: make sure the SEID is linear before reading it pfcp_encap_recv() only makes sure that the UDP header and the 4 byte PFCP header are in the linear area. When the S flag is set, pfcp_session_recv() then reads the 8 byte SEID that follows, which is not covered by the pskb_may_pull() check. A short PFCP packet with the S flag set, or one whose session header lies in a fragment, therefore makes pfcp_session_recv() read beyond the end of the packet data, and whatever it finds there is stored in the tunnel metadata that flower later classifies on. Pull up to the end of the

    linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azureBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.11-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-98951

    Nicht bewertetEPSS 0,16%Korrektur verfügbar

    riscv: ptrace: Zero-initialize regset buffers before copyin

    In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET request with a short iov_len leaves the rest of the stack buffer uninitialized. In riscv_vr_set() that garbage is validated and copied into the target's vstate, and in riscv_cfi_set() it can be stored as the target's shadow stack pointer. Zero both buffers, as the get path already does.

    linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azureBetriebssysteme
    • Auf 6.6 aktualisieren
    • Auf 7.2.11-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-98950

    Nicht bewertetEPSS 0,18%Korrektur verfügbar

    flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()

    In the Linux kernel, the following vulnerability has been resolved: flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() bpf_flow_dissect() sanitizes the offsets returned by the BPF program with clamp_t(u16, ..., hlen). If hlen is bigger than 65535, the upper bound is truncated before the comparison. For instance, with hlen == 65536, both nhoff and thoff are forced to zero, even if the program returned sane values. This is the same class of bug as the one fixed in commit 99bda1ecbd56 ("flow_dissector: avoid u16 truncation of skb->len when computing thoff"). That fix does not cover the BPF path, because __skb_flow_dissect() r

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.11-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-98949

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    drm/imagination: Fix reference and vm_bo handling in remap()

    In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vm_bo handling in remap() When a map overlaps part of an existing mapping, pvr_vm_gpuva_remap() splits the mapping into prev/next parts covering what the request did not take, instead of creating something new. It gets two things wrong. - A GEM reference is taken for each part but it's never needed and never dropped, so it leaks one reference per split (remap-next-in-2m in tests/imagination/pvr_vm_map.c): CRITICAL: 33558528 bytes of shmem still held after close - The parts still belong to the original object being split, but p

    linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azureBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.11-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-98948

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()

    In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_flower: Fix port range register leak in tmplt_create() mlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template into a stack-local struct mlxsw_sp_acl_rule_info purely to compute rulei.values.elusage. Parsing can acquire port range registers via mlxsw_sp_flower_parse_ports_range(), but since this rulei never goes through mlxsw_sp_acl_rulei_destroy(), those registers were never released, including through chain template deletion. Factor out of mlxsw_sp_acl_rulei_destroy() the code to actually release the necessary resources and call from mlxsw_sp_fl

    linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azureBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.11-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-98947

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    vsock: Fix memory leak in vmci_transport_recv_dgram_cb()

    In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmci_transport_recv_dgram_cb() During the closure of a datagram socket, the vmci_transport_recv_dgram_cb() function may be called, which will add the packets to the socket's backlog; then, after the receive queue is cleared, the __release_sock() function will move the packet back from the socket's backlog to the receive queue, which will lead to a memory leak. sock_close __sock_release __vsock_release // take ownership by user-space lock_sock_nested sock_set_flag(sk, SOCK_DEAD) vmci_transport_release

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.11-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-98946

    Nicht bewertetEPSS 0,16%Korrektur verfügbar

    drm/vc4: Disable the V3D interrupt across runtime suspend

    In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4_irq_disable() masks the V3D interrupt sources and then calls synchronize_irq() before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt handler. synchronize_irq() waits for handlers that have already set IRQD_IRQ_INPROGRESS, and for irqchips reporting IRQCHIP_STATE_ACTIVE. A GIC interrupt chip is able to mark an interrupt active as soon as a CPU acknowledges it, so there these checks cover the whole dispatch path. On RPi 0-3, however, the interrupt controller is ARMCTRL, wh

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 7.2.11-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2026-98945

    Hoch · CVSS 7.8EPSS 0,16%Korrektur verfügbar

    HID: steam: Rearrange teardown sequence

    In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This also puts work canceling for rumble and mode switch in steam_unregister, as that shouldn't persist while the client hdev is open.

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.11-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2026-98944

    Hoch · CVSS 7.8EPSS 0,18%Korrektur verfügbar

    HID: steam: Refactor registration

    In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and the rest of the function streamlined. We also remove the previous assumption that we have a serial number to show we're registered, replacing it with a single purpose boolean. In a previous refactor the code for unregistering a battery if later registration steps failed was accidentally left out. As a result, a lingering power_supply object could ge

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 4.20 aktualisieren
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.11-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2026-98942

    Nicht bewertetEPSS 0,16%Korrektur verfügbar

    sched_ext: Build the cid tables privately and publish them with RCU

    In the Linux kernel, the following vulnerability has been resolved: sched_ext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before filling them, ops.init_cids() overrides rewrite them in place, and re-enables rebuild them in place. A racing TRACING or SYSCALL program can read unfilled entries, including uninitialized memory in the kmalloc'd tables, or torn topo updates. Tie the tables' lifetimes to the root sched instead: each root enable builds a fresh set privately and publishes the per-table __rcu globals once th

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 7.2.10-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. openSUSE-SU-2026:22159-1

    Nicht bewertetKorrektur verfügbar

    Security update for mozilla-nss, MozillaFirefox

    This update for mozilla-nss, MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 153.5.1 ESR (MFSA 2026-112, bsc#1286385): - CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component (bsc#1286261).

    mozillafirefox mozilla-nssBetriebssysteme
    • Auf 153.5.1-160000.1.1 aktualisieren
    • Auf 3.125-160000.3.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2026-98941

    Hoch · CVSS 7EPSS 0,14%Korrektur verfügbar

    ext4: don't enable large folios on encrypted inodes

    In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable large folios on encrypted inodes Commit 709f0f1f1bf5 ("ext4: add checks for large folio incompatibilities when BS > PS") disables large folios at mount time if the "encrypt" feature is set. However, enabling that feature on a mounted filesystem circumvents that check, and writing encrypted data results in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000028 Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work RIP: 0010:ext4_finish_bio+0xf7/0x3e0 Call Trace: ext4_release_io_end+0x51/0x110 ext4_end_io_end+0x4c/0xe0 ext4_

    linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azure linux-gcpBetriebssysteme
    • Auf 7.2.10-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  14. CVE-2026-98940

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    ASoC: qcom: lpass-cpu: use DAI table index for playback constraints

    In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant->dai_driver. When configuring a DAI with LPAIF_I2SCTL_MODE_QUAD01, the probe code currently uses dai_id to index variant->dai_driver. This is incorrect for platforms where DAI IDs are sparse. For example, the IPQ806x MI2S DAI has ID 4 while it is the only entry in the DAI driver table. If that DAI is configured for QUAD01 and probe reaches this branch, the code writes beyond that single entry via dai_dri

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.10-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2026-98939

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    x86/mm: Drop unnecessary PMD page copy when freeing

    In the Linux kernel, the following vulnerability has been resolved: x86/mm: Drop unnecessary PMD page copy when freeing On a box with a discrete GPU, lockdep reports a possible deadlock as soon as kswapd shrinks the TTM page pool. The immediate cause is an x86 commit that added an mmap_read_lock() to kernel page protection munging code. The huge vmap code holds the same lock over a GFP_KERNEL allocation, which is a no-no now that reclaim can take it. That allocation is in a page table *free* path and ends up being for dubious purposes[1]. Basically, it tries to avoid hardware setting Accessed=1 in page table entries that are unreachable by

    linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azure linux-gcpBetriebssysteme
    • Auf 6.18.56 aktualisieren
    • Auf 7.2.10 aktualisieren
    • Auf 7.2.10-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. RLSA-2026:88455

    Mittel · CVSS 6.8Korrektur verfügbar

    Critical: ca-certificates security update

    The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI). Security Fix(es): * ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    ca-certificatesBetriebssysteme
    • Auf 0:2026.2.92_v9.0.319-100.3.el10_2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2026-98938

    Nicht bewertetEPSS 0,16%Korrektur verfügbar

    rust: irq: pass RegistrationInner as cookie to request_irq

    In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to request_irq With commit ba268514ea14 ("rust: devres: fix race condition due to nesting"), Devres::new() returns Result<Self> by value instead of initializing in-place via PinInit. Because request_irq() is called inside Devres::new(), registration.inner is still uninitialized when the IRQ is enabled, so accessing registration.inner.device() in the IRQ callback can read uninitialized memory. Fix this by storing the Device and handler pointer in RegistrationInner and passing RegistrationInner as the IRQ cookie after its fields ar

    linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azure linux-gcpBetriebssysteme
    • Auf 7.2.10-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  18. CVE-2026-98937

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    perf/core: Check kernel access when kernel callchains are requested

    In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf_event_open() currently gates perf_allow_kernel() only on !attr.exclude_kernel. However, users can still request kernel callchain collection with attr.exclude_callchain_kernel == 0 even when attr.exclude_kernel == 1. That still requires kernel profiling privilege, but the existing check does not enforce it. Update the permission check to call perf_allow_kernel() when either kernel sampling is requested or kernel callchains are requested. This keeps permission checks aligned with requested data and pr

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.10-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2026-98936

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    wifi: ath11k: reset ar->num_stations on hardware start

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar->num_stations on hardware start When (multiple) hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'num_stations' in 'struct ath11k' that did not get reset properly in this case. In ath11k_mac_op_start(), it was indeed the only accounting var that did not get reset so let's clear it too. This avoids problems like those: [1248828.088023] WARNING: CPU: 0 PID: 12281 at net/mac80211/util.c:1682 ieee80211_reconfig_stations+0x98/0xc0 [1248828.088115] Call trace: [1248828.088116] ieee80211

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.10-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2026-98935

    Nicht bewertetEPSS 0,18%Korrektur verfügbar

    rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak

    In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak The struct rtc_wkalrm has padding holes after the 'pending' member. When returned to userspace via the RTC_WKALRM_RD ioctl, uninitialized kernel stack data residing in these holes may be leaked. Zero-initialize the struct at declaration to eliminate this information leak risk. Fixes smatch warnings: - drivers/rtc/dev.c:392 rtc_dev_ioctl() warn: check that 'alarm' doesn't leak information (struct has a hole after 'pending')

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.10-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →