p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Schwachstellen im Stack Betriebssysteme · Seite 23

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für Betriebssysteme: 6543. Davon im KEV-Katalog: 3.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Betriebssysteme

Sicherheitslücken: 159263

  1. RLSA-2026:88207

    Hoch · CVSS 7.5Korrektur verfügbar

    Important: iperf3 security update

    Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fix(es): * iperf3: iperf3: Denial of Service via UDP receive worker infinite loop (CVE-2026-102253) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    iperf3Betriebssysteme
    • Auf 0:3.17.1-6.el10_2.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-98930

    Nicht bewertetEPSS 0,19%Korrektur verfügbar

    KVM: s390: Fix IRQ injection with SIGP Stop and Store Status

    In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status When __inject_sigp_stop() is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pending and the status is stored by the thread performing the KVM_RUN IOCTL. If the vCPU is already stopped, the status is stored immediately. Storing the status means writing into userspace, which might fault, and __inject_sigp_stop() is called from do_inject_vcpu() which in turn is always called holding a spinlock, which is obviously an issue. Fix this by returning -EWOULDBLOCK from __

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-98929

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    macsec: initialize SecY before registering the netdevice

    In the Linux kernel, the following vulnerability has been resolved: macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in rtmsg_ifinfo_build_skb() when IPv4 forwarding is enabled by default. register_netdevice() invokes inetdev_init(), which disables LRO and emits a NETDEV_FEAT_CHANGE notification. This reaches macsec_fill_info() before macsec_add_dev() initializes the SecY. key_len is still zero, so macsec_fill_info() returns -EMSGSIZE and trips the WARN_ON in rtmsg_ifinfo_build_skb(), even though the skb has enough space. Even without the

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-98928

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2 pkvm_init_features_from_host() takes KVM_ARCH_FLAG_GUEST_HAS_SVE and KVM_ARM_VCPU_SVE from the host separately, but pkvm_vcpu_init_sve() tests the bit while vcpu_has_sve() reads the flag. A host that sets the flag without the bit gets a vCPU with a NULL sve_state that the world switch loads the guest's SVE state from. Derive the flag from the bit, and drop the protected path's copy of the host's flag, which is dead code since protected VMs are not allowed SVE.

    linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azure linux-gcpBetriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-98927

    Hoch · CVSS 7EPSS 0,15%Korrektur verfügbar

    KVM: arm64: nv: Fix life cycle of the nested_mmus array

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nested_mmus array The nested_mmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPU_INIT for whole guest, which implies that they may have to be relocated as the array grows. Should a VCPU_INIT occur whilst a vcpu is actively running an L2 and that the allocation requires relocation, that vcpu will still be running with a pointer to the previous structure, which will have been freed. Fix this by turning the array of structures to an array of pointers, whic

    linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azureBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-98926

    Nicht bewertetEPSS 0,16%Korrektur verfügbar

    drm/amd/display: Remove sink usage from DPMS

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS [Why] stream->sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream->sink->link, which can be replaced with stream->link, as the two should always be the same. [How] * Replace stream->sink->link in DPMS on/off * Add assert to USB4 BW allocation where sink is required * Avoid inconsistencies in resource access, e.g. don't repeat stream->link after it was already saved to a local variable * Pull out effective VPG calculation to helper gette

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-98925

    Nicht bewertetEPSS 0,19%Korrektur verfügbar

    bpf, sockmap: Fix self-redirect copied_seq double-counting

    In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copied_seq double-counting When a BPF stream_verdict program redirects an skb back to the same socket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply() calls tcp_eat_skb() which advances tcp_sk->copied_seq. However, the skb is then delivered to the socket's psock ingress queue and later read by tcp_bpf_recvmsg_parser(), which also advances copied_seq via the copied_from_self accounting path. This double-counting causes copied_seq to advance by 2x the actual data length, triggering: TCP recvmsg seq # bug 2: copied BF2E806, seq BF

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.1.189 aktualisieren
    • Auf 6.1.190-1 aktualisieren
    • Auf 6.12.113-1 aktualisieren
    • Auf 6.4 aktualisieren
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-98924

    Nicht bewertetEPSS 0,18%Korrektur verfügbar

    fs: avoid repeated scans in evict_inodes()

    In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evict_inodes() We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fs_bdev_mark_dead() calls evict_inodes() while holding s_umount. Each time evict_inodes() drops s_inode_list_lock to reschedule, it restarts the walk from the head of s_inodes. With many referenced inodes at the head of the list, these restarts repeatedly scan the same inodes without reclaiming them. This can keep s_umount held for a long time, blocking concurrent umount attempts and trigge

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2026-98923

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    arm64: io: Reject non-user protection in ioremap_prot()

    In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremap_prot() Mapping a stack-top page via /dev/mem with PROT_NONE and then reading that process's /proc/<pid>/cmdline triggers a spurious WARN in ioremap_prot() through generic_access_phys(): WARNING: ./arch/arm64/include/asm/io.h:275 at generic_access_phys Call trace: generic_access_phys+0x1c8/0x228 (P) __access_remote_vm+0x2b4/0x398 access_remote_vm+0x14/0x30 get_mm_cmdline+0xf8/0x2a0 proc_pid_cmdline_read+0x68/0x120 generic_access_phys() passes the protection derived from the user PTE to ioremap_prot().

    linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azureBetriebssysteme
    • Auf 6.12.112 aktualisieren
    • Auf 6.12.113-1 aktualisieren
    • Auf 6.18.55 aktualisieren
    • Auf 6.20 aktualisieren
    • Auf 6.6.158 aktualisieren
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2026-98922

    Nicht bewertetEPSS 0,16%Korrektur verfügbar

    net: emac: move setting of netops to fix crash

    In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: |BUG: Kernel NULL pointer dereference on read at 0x00000158 |Faulting instruction address: 0xc0566b40 |Oops: Kernel access of bad area, sig: 11 [#1] |BE PAGE_SIZE=4K PowerPC 44x Platform |Modules linked in: |CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: GW 7.3.0-rc3+ #1 |Tainted: [W]=WARN |Hardware name: MyBook Live APM821XX 0x12c41c83 PowerPC 44x Platform |NIP: c0566b40 LR: c05648f8 CTR: c04c1e9c |REGS: c1053a20 TRAP: 0300 Tainted: GW (7.3.0-rc3+) |MSR: 0002b000 <CE,EE

    linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azure linux-gcpBetriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2026-98921

    Nicht bewertetEPSS 0,16%Korrektur verfügbar

    ovl: fix UAF in ovl_do_mkdir() debug print

    In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_do_mkdir() debug print ovl_do_mkdir() prints the input dentry with %pd after vfs_mkdir(). Since commit fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on failure."), vfs_mkdir() calls end_creating() on the input dentry on failure and may replace it on success, so the post-call %pd can use-after-free the dentry when CONFIG_OVERLAY_FS_DEBUG is enabled. Print the dentry before the call and only the result afterward.

    linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azure linux-gcpBetriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2026-98920

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    netfs: Fix missing alloc tagging of direct mempool allocations

    In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef ("netfs: Fix folio_queue ENOMEM in writeback by adding a mempool") added a mempool for the folio_queues and made the request, subrequest and folio_queue allocations distinguish between writeback and everything else. Writeback is part of memory reclaim and must not fail due to ENOMEM, so it allocates under GFP_NOFS through mempool_alloc(), which may dip into the pool's reserve and, if that runs empty, wait for elements to be returned. The GFP_KERNEL paths, which can return -ENOMEM to their c

    linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azure linux-gcpBetriebssysteme
    • Auf 6.13 aktualisieren
    • Auf 7.2 aktualisieren
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2026-98919

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    drm/xe: harden adjust_idledly() against divide-by-zero and overflow

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: harden adjust_idledly() against divide-by-zero and overflow adjust_idledly() has several corner-case issues flagged during review: 1. If xe_gt_clock_init() failed to recognise the crystal clock, gt->info.timestamp_base is 0, which makes idledly_units_ps also 0. The subsequent DIV_ROUND_CLOSEST(..., idledly_units_ps) is then a divide-by-zero and panics the kernel. 2. The tick-to-ns conversions are done in u32: idledly * idledly_units_ps, (maxcnt - 1) * 1000 Both overflow u32 before DIV_ROUND_CLOSEST() sees them. 3. If IDLE_WAIT_TI

    linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azure linux-gcpBetriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2026-98918

    Nicht bewertetEPSS 0,16%Korrektur verfügbar

    mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()

    In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold() __damon_va_prepare_access_check() picks a random byte address within the region and stores it in r->sampling_addr. damon_va_mkold() passes it into a page table walk, which hands it to damon_ptep_mkold() as the address of the page to sample: damon_va_mkold(mm, r->sampling_addr) damon_va_walk_page_range(mm, addr, addr + 1) damon_mkold_pmd_entry() damon_ptep_mkold(pte, vma, addr) ptep_test_and_clear_young(vma, addr, pte) mmu_notifier_clear_young(mm, addr, addr + PAGE

    linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azure linux-gcpBetriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2026-98917

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    parisc: Increase kernel stack size to 32kb

    In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size (THREAD_SIZE_ORDER) to 32 kB, in order to avoid kernel crashes which have been triggered recently when building the debian vtk9 package with gcc 17: stackcheck: kworker/u128:0 will most likely overflow kernel stack (sp:179a83af0, stk bottom-top:179a80000-179a84000) Kernel panic - not syncing: low stack detected by irq handler - check messages CPU: 2 UID: 0 PID: 30760 Comm: kworker/u128:0 Tainted: G W 6.18.46-dirty #1 NONE Tainted: [W]=WARN Hardware name: 9000/800/rp3

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 4.15 aktualisieren
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. SUSE-SU-2026:24382-1

    Nicht bewertetKorrektur verfügbar

    Security update for openssh

    This update for openssh fixes the following issues: - CVE-2026-59995: sftp: a malicious server could change the the location of downloaded files (bsc#1271044). - CVE-2026-59996: scp: a malicious server could write files to the parent directory of the intended target directory (bsc#1271046). - CVE-2026-59997: sshd: internal-sftp command lines are silently truncated after the 9th argument (bsc#1271048). - CVE-2026-59998: sshd: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory (bsc#1271049). - CVE-2026-59999: sshd: DisableForwarding=yes didn't override PermitTunnel=yes (bsc#1271052). - CVE-2026-600

    opensshBetriebssysteme Netzwerkdienste
    • Auf 9.6p1-slfo.1.1_7.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2026-98916

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    wifi: nl80211: check link is beaconing for color change

    In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with an invalid link.

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 7.2.6-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2026-98915

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    media: video-i2c: use vb2_video_unregister_device on driver removal

    In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2_video_unregister_device on driver removal The driver uses vb2_fop_release() as its file release operation, so vb2_video_unregister_device() should be used instead of video_unregister_device() during driver removal. This ensures that the vb2 queue is properly disconnected before the video device is unregistered.

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.1.190-1 aktualisieren
    • Auf 6.12.111-1 aktualisieren
    • Auf 7.2.6-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2026-98914

    Nicht bewertetEPSS 0,16%Korrektur verfügbar

    drm/amdgpu: cap ATOM command table nesting depth

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: cap ATOM command table nesting depth Cap nesting at 32 levels with execute_depth and return -ELOOP when exceeded.

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 7.2.6-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2026-98913

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    net: thunderx: fix PTP device ref leak in nicvf_probe()

    In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvf_probe() cavium_ptp_get() acquires a reference to the PTP PCI device through pci_get_device(). If any initialization step fails after cavium_ptp_get(), the PTP PCI device reference is leaked. Add a common error path to release the PTP reference before returning from probe failures.

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 6.1.190-1 aktualisieren
    • Auf 6.12.111-1 aktualisieren
    • Auf 7.2.6-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →