p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Schwachstellen im Stack Betriebssysteme · Seite 75

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für Betriebssysteme: 6579. Davon im KEV-Katalog: 4.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Betriebssysteme

Sicherheitslücken: 160321

  1. CVE-2026-98936

    Nicht bewertetEPSS 0,18%Korrektur verfügbar

    wifi: ath11k: reset ar->num_stations on hardware start

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar->num_stations on hardware start When (multiple) hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'num_stations' in 'struct ath11k' that did not get reset properly in this case. In ath11k_mac_op_start(), it was indeed the only accounting var that did not get reset so let's clear it too. This avoids problems like those: [1248828.088023] WARNING: CPU: 0 PID: 12281 at net/mac80211/util.c:1682 ieee80211_reconfig_stations+0x98/0xc0 [1248828.088115] Call trace: [1248828.088116] ieee80211

    linux linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.10-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-98935

    Nicht bewertetEPSS 0,18%Korrektur verfügbar

    rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak

    In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak The struct rtc_wkalrm has padding holes after the 'pending' member. When returned to userspace via the RTC_WKALRM_RD ioctl, uninitialized kernel stack data residing in these holes may be leaked. Zero-initialize the struct at declaration to eliminate this information leak risk. Fixes smatch warnings: - drivers/rtc/dev.c:392 rtc_dev_ioctl() warn: check that 'alarm' doesn't leak information (struct has a hole after 'pending')

    linux linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-aws-5.4 linux-azure linux-azure-5.3 linux-azure-5.4Betriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.10-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-98934

    Nicht bewertetEPSS 0,18%Korrektur verfügbar

    ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()

    In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() Since commit d58e468b1112 ("flow_dissector: implements flow dissector BPF hook") __skb_flow_dissect() needs a net pointer, either from skb->dev, skb->sk, or since commit 3cbf4ffba5ee ("net: plumb network namespace into __skb_flow_dissect") a caller provided pointer. syzbot was able to reach seg6_make_flowlabel() with an skb having neither skb->dev nor skb->sk set: a TIPC UDP bearer sends a discovery message through an IPv4 route using seg6 encap, while net.ipv6.seg6_flowlabel is set to 1. seg6_make_flowlabel() alre

    linux linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-aws-5.4 linux-azure linux-azure-5.3 linux-azure-5.4Betriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.10-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-98933

    Nicht bewertetEPSS 0,18%Korrektur verfügbar

    usb: hub: use shorter 120ms post resume hold for SS root hubs

    In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and waking up the USB subsystem once a second for some time. Vendors are working on a solution. Disabling USB runtime PM is one way to prevent this issue, but it is also proven that reducing the hold time to 120ms in resume also mitigates it. See Link for more details. Reducing the hold time to 120ms for the USB3 roothub is in itself a valid chang

    linux linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpBetriebssysteme
    • Auf 5.10.273 aktualisieren
    • Auf 5.15.224 aktualisieren
    • Auf 5.5 aktualisieren
    • Auf 6.1.191 aktualisieren
    • Auf 6.12.113 aktualisieren
    • Auf 6.12.113-1 aktualisieren
    • Auf 6.16 aktualisieren
    • Auf 6.6.160 aktualisieren
    • Auf 7.2.10-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-98932

    Hoch · CVSS 7.4EPSS 0,18%Korrektur verfügbar

    EDAC/altera: Fix use-after-free in error paths

    In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altr_edac_a10_device_add() and altr_portb_setup(), the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use altdev(dci->pvt_info) as their data, an IRQ firing between freeing dci and unregistering the IRQs could dereference the freed memory. Release the devres group first so the managed IRQs are unregistered before the dci structure is freed.

    linux linux linux linux linux linux-azure linux-aws-hwe linux-azure linux-gcp linux-hwe linux-hwe-edge linux-oracleBetriebssysteme
    • Auf 7.2.10-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-98931

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    mtd: spinand: fix NULL pointer dereference with no ECC engine

    In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddev_get_ecc_engine() takes the NAND_ECC_ENGINE_TYPE_NONE path and returns success while leaving nand->ecc.engine NULL. The SPI-NAND code nevertheless dereferences it unconditionally to test for a pipelined engine, so probing such a device oopses immediately. Rather than open-coding the test three times, add a nand_ecc_is_pipelined() helper to the NAND core that folds the NULL check into the integration comparison, and use it everywhere. Future callers then cannot reint

    linux linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.10-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. RLSA-2026:88360

    Hoch · CVSS 8.8Korrektur verfügbar

    Important: postgresql18-pgvector security update

    Open-source vector similarity search for Postgres. Supports L2 distance, inner product, and cosine distance Security Fix(es): * pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build (CVE-2026-103484) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    postgresql18-pgvectorBetriebssysteme
    • Auf 0:0.8.7-1.el10_2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. RLSA-2026:88359

    Hoch · CVSS 8.8Korrektur verfügbar

    Important: postgresql16-pgvector security update

    Open-source vector similarity search for Postgres. Supports L2 distance, inner product, and cosine distance Security Fix(es): * pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build (CVE-2026-103484) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    postgresql16-pgvectorBetriebssysteme
    • Auf 0:0.8.7-1.el10_2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. RLSA-2026:88336

    Hoch · CVSS 7.5Korrektur verfügbar

    Important: podman security update

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS sco

    podmanBetriebssysteme
    • Auf 7:5.8.2-11.el10_2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. RLSA-2026:88316

    Hoch · CVSS 7.5Korrektur verfügbar

    Important: grafana-pcp security update

    The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), in

    grafana-pcpBetriebssysteme
    • Auf 0:5.3.0-8.el10_2.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. RLSA-2026:88280

    Hoch · CVSS 7.5Korrektur verfügbar

    Important: golang-github-openprinting-ipp-usb security update

    HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For

    golang-github-openprinting-ipp-usbBetriebssysteme
    • Auf 0:0.9.27-7.el10_2.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. RLSA-2026:88262

    Hoch · CVSS 7.5Korrektur verfügbar

    Important: buildah security update

    The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * podman: Arbitrary file write when importing OCI archive (CVE-2025-11395) * net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTING

    buildahBetriebssysteme
    • Auf 2:1.43.1-7.el10_2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. RLSA-2026:88248

    Hoch · CVSS 8.2Korrektur verfügbar

    Important: expat security update

    Expat is a C library for parsing XML documents. Security Fix(es): * expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633) * expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    expatBetriebssysteme
    • Auf 0:2.7.3-1.el10_2.7 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. RLSA-2026:88207

    Hoch · CVSS 7.5Korrektur verfügbar

    Important: iperf3 security update

    Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fix(es): * iperf3: iperf3: Denial of Service via UDP receive worker infinite loop (CVE-2026-102253) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

    iperf3Betriebssysteme
    • Auf 0:3.17.1-6.el10_2.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2026-98930

    Nicht bewertetEPSS 0,19%Korrektur verfügbar

    KVM: s390: Fix IRQ injection with SIGP Stop and Store Status

    In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status When __inject_sigp_stop() is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pending and the status is stored by the thread performing the KVM_RUN IOCTL. If the vCPU is already stopped, the status is stored immediately. Storing the status means writing into userspace, which might fault, and __inject_sigp_stop() is called from do_inject_vcpu() which in turn is always called holding a spinlock, which is obviously an issue. Fix this by returning -EWOULDBLOCK from __

    linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hwe linux-azureBetriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2026-98929

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    macsec: initialize SecY before registering the netdevice

    In the Linux kernel, the following vulnerability has been resolved: macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in rtmsg_ifinfo_build_skb() when IPv4 forwarding is enabled by default. register_netdevice() invokes inetdev_init(), which disables LRO and emits a NETDEV_FEAT_CHANGE notification. This reaches macsec_fill_info() before macsec_add_dev() initializes the SecY. key_len is still zero, so macsec_fill_info() returns -EMSGSIZE and trips the WARN_ON in rtmsg_ifinfo_build_skb(), even though the skb has enough space. Even without the

    linux linux linux linux linux linux-azure linux-aws-hwe linux-azure linux-gcp linux-hwe linux-hwe-edge linux-oracleBetriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2026-98928

    Nicht bewertetEPSS 0,17%Korrektur verfügbar

    KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2 pkvm_init_features_from_host() takes KVM_ARCH_FLAG_GUEST_HAS_SVE and KVM_ARM_VCPU_SVE from the host separately, but pkvm_vcpu_init_sve() tests the bit while vcpu_has_sve() reads the flag. A host that sets the flag without the bit gets a vCPU with a NULL sve_state that the world switch loads the guest's SVE state from. Derive the flag from the bit, and drop the protected path's copy of the host's flag, which is dead code since protected VMs are not allowed SVE.

    linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3 linux-gke-4.15Betriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2026-98927

    Hoch · CVSS 7EPSS 0,15%Korrektur verfügbar

    KVM: arm64: nv: Fix life cycle of the nested_mmus array

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nested_mmus array The nested_mmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPU_INIT for whole guest, which implies that they may have to be relocated as the array grows. Should a VCPU_INIT occur whilst a vcpu is actively running an L2 and that the allocation requires relocation, that vcpu will still be running with a pointer to the previous structure, which will have been freed. Fix this by turning the array of structures to an array of pointers, whic

    linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3Betriebssysteme
    • Auf 6.12.113-1 aktualisieren
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2026-98926

    Nicht bewertetEPSS 0,16%Korrektur verfügbar

    drm/amd/display: Remove sink usage from DPMS

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS [Why] stream->sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream->sink->link, which can be replaced with stream->link, as the two should always be the same. [How] * Replace stream->sink->link in DPMS on/off * Add assert to USB4 BW allocation where sink is required * Avoid inconsistencies in resource access, e.g. don't repeat stream->link after it was already saved to a local variable * Pull out effective VPG calculation to helper gette

    linux linux linux linux linux linux linux-aws linux-azure linux-lts-xenial linux linux-aws linux-aws-hweBetriebssysteme
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2026-98925

    Nicht bewertetEPSS 0,19%Korrektur verfügbar

    bpf, sockmap: Fix self-redirect copied_seq double-counting

    In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copied_seq double-counting When a BPF stream_verdict program redirects an skb back to the same socket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply() calls tcp_eat_skb() which advances tcp_sk->copied_seq. However, the skb is then delivered to the socket's psock ingress queue and later read by tcp_bpf_recvmsg_parser(), which also advances copied_seq via the copied_from_self accounting path. This double-counting causes copied_seq to advance by 2x the actual data length, triggering: TCP recvmsg seq # bug 2: copied BF2E806, seq BF

    linux linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpBetriebssysteme
    • Auf 6.1.189 aktualisieren
    • Auf 6.1.190-1 aktualisieren
    • Auf 6.12.113-1 aktualisieren
    • Auf 6.4 aktualisieren
    • Auf 7.2.9-1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →