p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in linux-hwe-7.0 · Seite 197

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für linux-hwe-7.0: 843. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 6356

  1. CVE-2026-72280

    Hoch · CVSS 7.1EPSS 0,19%Korrektur verfügbar

    KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2 It is entirely possible for a guest to write to the ZCR_EL2 sysreg alias while in a nested context, as it is expected if FEAT_NV2 is advertised to the L1 hypervisor. Get rid of the bogus WARN which, since the hyp vectors were installed at this point, has the effect of a hyp_panic...

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-72279

    Kritisch · CVSS 9EPSS 0,19%Korrektur verfügbar

    KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR KVM currently maps the L1 VNCR into the host stage-1 by relying entirely on the permissions of the guest stage-1. At the same time, it is entirely possible that the backing PFN is read-only (e.g. RO memslot), meaning that the L1 VNCR should use at most a read-only mapping. Cache the writability of the PFN in the VNCR TLB and use it to constrain the resulting fixmap permissions. Promote VNCR permission faults to an SEA in the case where the guest attempts to write to a read-only endpoint. Conveniently, this also plu

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-34.34~24.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-72278

    Kritisch · CVSS 9.3EPSS 0,19%Korrektur verfügbar

    KVM: arm64: nv: Re-translate VNCR before injecting abort

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Re-translate VNCR before injecting abort KVM faults in the VNCR page with FOLL_WRITE whenever the guest aborts for a write, similar to how a regular stage-2 mapping is handled. It is entirely possible that the guest reads from the VNCR before writing to it, in which case the PFN could only be read-only. Invalidate the VNCR TLB and re-fetch the translation upon taking a VNCR abort, allowing the host mapping to be faulted in for write the second time around. Interestingly enough, this also satisfies the ordering requirements of FEAT_ETS2/3 between descriptor

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-34.34~24.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-72277

    Kritisch · CVSS 9.3EPSS 0,19%Korrektur verfügbar

    KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory When constructing an L1 VNCR mapping, KVM unconditionally uses cacheable memory attributes, even if the underlying PFN isn't memory. This gets particularly hairy if the endpoint doesn't support cacheable memory attributes, potentially throwing an SError on writeback... While KVM does permit cacheable memory attributes on certain PFNMAP VMAs, kvm_translate_vncr() isn't currently grabbing the VMA. So do the simpler thing for now and just reject everything that isn't memory.

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-34.34~24.04.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-72276

    Nicht bewertetEPSS 0,21%Korrektur verfügbar

    fbdev: metronomefb: fix potential memory leak in metronomefb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: metronomefb: fix potential memory leak in metronomefb_probe() The memory allocated for pagerefs in fb_deferred_io_init() is not freed on the error path. Fix it by calling fb_deferred_io_cleanup().

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-72275

    Nicht bewertetEPSS 0,21%Korrektur verfügbar

    fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() The memory allocated for pagerefs in fb_deferred_io_init() is not freed on the error path. Fix it by calling fb_deferred_io_cleanup().

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-72274

    Nicht bewertetEPSS 0,21%Korrektur verfügbar

    fbdev: hecubafb: fix potential memory leak in hecubafb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: hecubafb: fix potential memory leak in hecubafb_probe() The memory allocated for pagerefs in fb_deferred_io_init() is not freed on the error path. Fix it by calling fb_deferred_io_cleanup().

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-72273

    Nicht bewertetEPSS 0,21%Korrektur verfügbar

    fbdev: efifb: fix memory leak in efifb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: efifb: fix memory leak in efifb_probe() Since commit 73ce73c30ba9 ("fbdev: Transfer video= option strings to caller; clarify ownership") the string returned from fb_get_options() is expected to be freed by the caller, but the string is not freed in efifb_probe(). Fix that by freeing the option string after setup.

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2026-72272

    Nicht bewertetEPSS 0,22%Korrektur verfügbar

    fbdev: radeon: fix potential memory leak in radeonfb_pci_register()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: radeon: fix potential memory leak in radeonfb_pci_register() The function radeonfb_pci_register() allocates memory for modelist (by calling radeon_check_modes() which calls fb_add_videomode()). The memory is appended to info->modelist, but is not freed in subsequent error paths. Fix this by calling fb_destroy_modelist().

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2026-72271

    Nicht bewertetEPSS 0,22%Korrektur verfügbar

    fbdev: i740fb: fix potential memory leak in i740fb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: i740fb: fix potential memory leak in i740fb_probe() In i740fb_probe(), the memory allocated in fb_videomode_to_modelist() for modelist is not freed in the error paths. Fix that by calling fb_destroy_modelist().

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2026-72270

    Nicht bewertetEPSS 0,22%Korrektur verfügbar

    fbdev: s3fb: fix potential memory leak in s3_pci_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: s3fb: fix potential memory leak in s3_pci_probe() In s3_pci_probe(), the memory allocated for modelist using fb_videomode_to_modelist() is not freed in subsequent error paths. Fix that by calling fb_destroy_modelist()

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2026-72269

    Nicht bewertetEPSS 0,22%Korrektur verfügbar

    fbdev: uvesafb: fix potential memory leak in uvesafb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: fix potential memory leak in uvesafb_probe() Due to an incorrect goto label, memory allocated for modedb and modelist in uvesafb_vbe_init() is not freed in some error paths. Fix this by updating the goto label.

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2026-72268

    Nicht bewertetEPSS 0,22%Korrektur verfügbar

    fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() In tdfxfb_probe(), the memory allocated for modelist using fb_videomode_to_modelist() when CONFIG_FB_3DFX_I2C is defined, is not freed in the subsequent error paths. Fix that by calling fb_destroy_modelist().

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2026-72267

    Nicht bewertetEPSS 0,22%Korrektur verfügbar

    fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() The memory allocated for modelist in fb_videomode_to_modelist() is not freed in the subsequent error path. Fix that by calling fb_destroy_modelist()

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2026-72266

    Nicht bewertetEPSS 0,21%Korrektur verfügbar

    fbdev: vesafb: fix memory leak in vesafb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: vesafb: fix memory leak in vesafb_probe() Since commit 73ce73c30ba9 ("fbdev: Transfer video= option strings to caller; clarify ownership") the string returned from fb_get_options() is expected to be freed by the caller. But the string is not freed in vesafb_probe(). Fix that by freeing the option string after setup.

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2026-72265

    Nicht bewertetEPSS 0,22%Korrektur verfügbar

    fbdev: nvidia: fix potential memory leak in nvidiafb_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: nvidia: fix potential memory leak in nvidiafb_probe() In nvidiafb_probe(), the memory allocated for modelist in nvidia_set_fbinfo() is not freed in the subsequent error paths. Fix that by calling fb_destroy_modelist().

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2026-72264

    Nicht bewertetEPSS 0,22%Korrektur verfügbar

    fbdev: tridentfb: fix potential memory leak in trident_pci_probe()

    In the Linux kernel, the following vulnerability has been resolved: fbdev: tridentfb: fix potential memory leak in trident_pci_probe() In trident_pci_probe(), the memory allocated for modelist using fb_videomode_to_modelist() is not freed in subsequent error paths. Fix that by calling fb_destroy_modelist().

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2026-72263

    Nicht bewertetEPSS 0,2%Korrektur verfügbar

    ASoC: SOF: topology: fix memory leak in snd_sof_load_topology

    In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: topology: fix memory leak in snd_sof_load_topology When the topology filename contains "dummy" and tplg_cnt is 0, the function returns -EINVAL directly without freeing the tplg_files allocated by kcalloc() at line 2497. This leaks memory on every such topology load attempt. Fix this by setting ret = -EINVAL and jumping to the out: label, which already handles the kfree(tplg_files) cleanup.

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2026-72262

    Hoch · CVSS 7.8EPSS 0,18%Korrektur verfügbar

    ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

    In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get The ipc_control_data buffer is allocated as kzalloc(max_size), where max_size covers the entire struct sof_ipc_ctrl_data including its flexible array payload. However, the bounds checks in bytes_ext_put and _bytes_ext_get compared user data lengths against max_size directly, ignoring that cdata->data sits at an offset of sizeof(struct sof_ipc_ctrl_data) bytes into the allocation. This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past the end of the heap buffer from unprivileged userspace via th

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2026-72261

    Hoch · CVSS 7.8EPSS 0,17%Korrektur verfügbar

    ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control

    In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control In snd_sof_update_control(), firmware-provided cdata->num_elems is checked against local_cdata->data->size but never against the actual allocation size. If local_cdata->data->size was previously set to an inconsistent value, the memcpy could write past the allocated buffer. Add a bounds check to ensure num_elems fits within the available space in the ipc_control_data allocation before copying.

    linux-hwe-7.0Betriebssysteme
    • Auf 7.0.0-38.38~24.04.4 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →