p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Schwachstellen im Stack Betriebssysteme · Seite 20

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für Betriebssysteme: 6392. Davon im KEV-Katalog: 2.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Betriebssysteme

Sicherheitslücken: 159106

  1. CVE-2026-98927

    Hoch · CVSS 7EPSS 0,15%Korrektur verfügbar

    KVM: arm64: nv: Fix life cycle of the nested_mmus array

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nested_mmus array The nested_mmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPU_INIT for whole guest, which implies that they may have to be relocated as the array grows. Should a VCPU_INIT occur whilst a vcpu is actively running an L2 and that the allocation requires relocation, that vcpu will still be running with a pointer to the previous structure, which will have been freed. Fix this by turning the array of structures to an array of pointers, whic

    linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azureBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-98926

    Nicht bewertetEPSS 0,16%Korrektur verfügbar

    drm/amd/display: Remove sink usage from DPMS

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS [Why] stream->sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream->sink->link, which can be replaced with stream->link, as the two should always be the same. [How] * Replace stream->sink->link in DPMS on/off * Add assert to USB4 BW allocation where sink is required * Avoid inconsistencies in resource access, e.g. don't repeat stream->link after it was already saved to a local variable * Pull out effective VPG calculation to helper gette

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-98925

    Nicht bewertetEPSS 0,19%Korrektur verfügbar

    bpf, sockmap: Fix self-redirect copied_seq double-counting

    In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copied_seq double-counting When a BPF stream_verdict program redirects an skb back to the same socket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply() calls tcp_eat_skb() which advances tcp_sk->copied_seq. However, the skb is then delivered to the socket's psock ingress queue and later read by tcp_bpf_recvmsg_parser(), which also advances copied_seq via the copied_from_self accounting path. This double-counting causes copied_seq to advance by 2x the actual data length, triggering: TCP recvmsg seq # bug 2: copied BF2E806, seq BF

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.1.189 aktualisieren
    • Auf 6.1.190-1 aktualisieren
    • Auf 6.12.113-1 aktualisieren
    • Auf 6.4 aktualisieren
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-98924

    Nicht bewertetEPSS 0,18%Korrektur verfügbar

    fs: avoid repeated scans in evict_inodes()

    In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evict_inodes() We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fs_bdev_mark_dead() calls evict_inodes() while holding s_umount. Each time evict_inodes() drops s_inode_list_lock to reschedule, it restarts the walk from the head of s_inodes. With many referenced inodes at the head of the list, these restarts repeatedly scan the same inodes without reclaiming them. This can keep s_umount held for a long time, blocking concurrent umount attempts and trigge

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-98923

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    arm64: io: Reject non-user protection in ioremap_prot()

    In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremap_prot() Mapping a stack-top page via /dev/mem with PROT_NONE and then reading that process's /proc/<pid>/cmdline triggers a spurious WARN in ioremap_prot() through generic_access_phys(): WARNING: ./arch/arm64/include/asm/io.h:275 at generic_access_phys Call trace: generic_access_phys+0x1c8/0x228 (P) __access_remote_vm+0x2b4/0x398 access_remote_vm+0x14/0x30 get_mm_cmdline+0xf8/0x2a0 proc_pid_cmdline_read+0x68/0x120 generic_access_phys() passes the protection derived from the user PTE to ioremap_prot().

    linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azureBetriebssysteme
    • Auf 6.12.112 aktualisieren
    • Auf 6.12.113-1 aktualisieren
    • Auf 6.18.55 aktualisieren
    • Auf 6.20 aktualisieren
    • Auf 6.6.158 aktualisieren
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-98922

    Nicht bewertetEPSS 0,16%Korrektur verfügbar

    net: emac: move setting of netops to fix crash

    In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: |BUG: Kernel NULL pointer dereference on read at 0x00000158 |Faulting instruction address: 0xc0566b40 |Oops: Kernel access of bad area, sig: 11 [#1] |BE PAGE_SIZE=4K PowerPC 44x Platform |Modules linked in: |CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: GW 7.3.0-rc3+ #1 |Tainted: [W]=WARN |Hardware name: MyBook Live APM821XX 0x12c41c83 PowerPC 44x Platform |NIP: c0566b40 LR: c05648f8 CTR: c04c1e9c |REGS: c1053a20 TRAP: 0300 Tainted: GW (7.3.0-rc3+) |MSR: 0002b000 <CE,EE

    linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azure linux-gcpBetriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-98921

    Nicht bewertetEPSS 0,16%Korrektur verfügbar

    ovl: fix UAF in ovl_do_mkdir() debug print

    In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_do_mkdir() debug print ovl_do_mkdir() prints the input dentry with %pd after vfs_mkdir(). Since commit fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on failure."), vfs_mkdir() calls end_creating() on the input dentry on failure and may replace it on success, so the post-call %pd can use-after-free the dentry when CONFIG_OVERLAY_FS_DEBUG is enabled. Print the dentry before the call and only the result afterward.

    linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azure linux-gcpBetriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-98920

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    netfs: Fix missing alloc tagging of direct mempool allocations

    In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef ("netfs: Fix folio_queue ENOMEM in writeback by adding a mempool") added a mempool for the folio_queues and made the request, subrequest and folio_queue allocations distinguish between writeback and everything else. Writeback is part of memory reclaim and must not fail due to ENOMEM, so it allocates under GFP_NOFS through mempool_alloc(), which may dip into the pool's reserve and, if that runs empty, wait for elements to be returned. The GFP_KERNEL paths, which can return -ENOMEM to their c

    linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azure linux-gcpBetriebssysteme
    • Auf 6.13 aktualisieren
    • Auf 7.2 aktualisieren
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2026-98919

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    drm/xe: harden adjust_idledly() against divide-by-zero and overflow

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: harden adjust_idledly() against divide-by-zero and overflow adjust_idledly() has several corner-case issues flagged during review: 1. If xe_gt_clock_init() failed to recognise the crystal clock, gt->info.timestamp_base is 0, which makes idledly_units_ps also 0. The subsequent DIV_ROUND_CLOSEST(..., idledly_units_ps) is then a divide-by-zero and panics the kernel. 2. The tick-to-ns conversions are done in u32: idledly * idledly_units_ps, (maxcnt - 1) * 1000 Both overflow u32 before DIV_ROUND_CLOSEST() sees them. 3. If IDLE_WAIT_TI

    linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azure linux-gcpBetriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2026-98918

    Nicht bewertetEPSS 0,16%Korrektur verfügbar

    mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()

    In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold() __damon_va_prepare_access_check() picks a random byte address within the region and stores it in r->sampling_addr. damon_va_mkold() passes it into a page table walk, which hands it to damon_ptep_mkold() as the address of the page to sample: damon_va_mkold(mm, r->sampling_addr) damon_va_walk_page_range(mm, addr, addr + 1) damon_mkold_pmd_entry() damon_ptep_mkold(pte, vma, addr) ptep_test_and_clear_young(vma, addr, pte) mmu_notifier_clear_young(mm, addr, addr + PAGE

    linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azure linux-gcpBetriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2026-98917

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    parisc: Increase kernel stack size to 32kb

    In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size (THREAD_SIZE_ORDER) to 32 kB, in order to avoid kernel crashes which have been triggered recently when building the debian vtk9 package with gcc 17: stackcheck: kworker/u128:0 will most likely overflow kernel stack (sp:179a83af0, stk bottom-top:179a80000-179a84000) Kernel panic - not syncing: low stack detected by irq handler - check messages CPU: 2 UID: 0 PID: 30760 Comm: kworker/u128:0 Tainted: G W 6.18.46-dirty #1 NONE Tainted: [W]=WARN Hardware name: 9000/800/rp3

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 4.15 aktualisieren
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2026-98916

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    wifi: nl80211: check link is beaconing for color change

    In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with an invalid link.

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 7.2.6-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2026-98915

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    media: video-i2c: use vb2_video_unregister_device on driver removal

    In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2_video_unregister_device on driver removal The driver uses vb2_fop_release() as its file release operation, so vb2_video_unregister_device() should be used instead of video_unregister_device() during driver removal. This ensures that the vb2 queue is properly disconnected before the video device is unregistered.

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.1.190-1 aktualisieren
    • Auf 6.12.111-1 aktualisieren
    • Auf 7.2.6-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2026-98914

    Nicht bewertetEPSS 0,16%Korrektur verfügbar

    drm/amdgpu: cap ATOM command table nesting depth

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: cap ATOM command table nesting depth Cap nesting at 32 levels with execute_depth and return -ELOOP when exceeded.

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 7.2.6-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2026-98913

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    net: thunderx: fix PTP device ref leak in nicvf_probe()

    In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvf_probe() cavium_ptp_get() acquires a reference to the PTP PCI device through pci_get_device(). If any initialization step fails after cavium_ptp_get(), the PTP PCI device reference is leaked. Add a common error path to release the PTP reference before returning from probe failures.

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.1.190-1 aktualisieren
    • Auf 6.12.111-1 aktualisieren
    • Auf 7.2.6-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2026-98912

    Nicht bewertetEPSS 0,19%Korrektur verfügbar

    ALSA: seq: oss: Reject reads that cannot fit the next event

    In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it from the read queue. The check is inverted. It currently stops when the event is smaller than the remaining buffer, so a normal 4-byte event is not copied for an 8-byte read buffer. Conversely, an 8-byte event can be copied for a smaller read count. Break only when the remaining userspace buffer is smaller than the next event, and report -EINVAL if no complete event has been copied. This

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.1.190-1 aktualisieren
    • Auf 6.12.111-1 aktualisieren
    • Auf 7.2.6-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2026-98911

    Hoch · CVSS 7.5EPSS 0,32%Korrektur verfügbar

    dpaa2-switch: fix the error path in dpaa2_switch_rx()

    In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect since the dpaa2_switch_free_fd() is intended to be used on Tx frame descriptors, meaning that it expects in the software annotation area of the FD data to find a valid skb pointer on which to call dev_kfree_skb(). Fix this by extracting the dma_unmap_page() from dpaa2_switch_build_linear_skb() directly into the dpaa2_switch_rx() function. This allows us to directly use free_pages() in case o

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.1.190-1 aktualisieren
    • Auf 6.12.111-1 aktualisieren
    • Auf 7.2.6-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2026-98910

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    drm/amdkfd: Unwind debug trap enable on copy_to_user failure

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copy_to_user failure If kfd_dbg_trap_enable() fails while copying runtime_info to userspace, it had already activated the trap, set debug_trap_enabled, taken an extra process reference, and opened the debug event file. Return -EFAULT without unwinding that state, leaving inconsistent trap state and a refcount imbalance that could break later DISABLE/ENABLE. On copy_to_user failure, deactivate the trap and undo the rest of the enable setup before returning.

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.12.111-1 aktualisieren
    • Auf 7.2.6-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2026-98909

    Nicht bewertetEPSS 0,19%Korrektur verfügbar

    net: cpsw_new: unregister devlink on port registration failure

    In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before registering the CPSW ports. If cpsw_register_ports() fails, the error path only unregisters the notifiers and then releases the lower level resources. It does not undo the successful cpsw_register_devlink() call, leaving the devlink instance and its parameters registered after probe has failed. Add a devlink cleanup label for the path where devlink registration has already succeeded, and use it when port registration fails.

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.1.190-1 aktualisieren
    • Auf 6.12.111-1 aktualisieren
    • Auf 7.2.6-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2026-98908

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    net: microchip: sparx5: clean up PSFP resources on flower setup failure

    In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5_tc_flower_psfp_setup() allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP actions. If a later step fails, the resources allocated earlier in the function are not unwound. Add error paths to release the stream filter, flow meter and stream gate when setup fails after they have been acquired. Also make sparx5_psfp_fm_add() return the acquired flow-meter id before the existing-flow-meter early return. When an existing flow meter is reused, sparx5_psfp_fm_get() in

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.12.111-1 aktualisieren
    • Auf 7.2.6-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →