p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in linux-aws-fips · Seite 42

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für linux-aws-fips: 576. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 7965

  1. CVE-2026-97436

    Nicht bewertetEPSS 0,17%Keine Korrektur veröffentlicht

    dpaa2-switch: rework FDB management on the bridge leave path

    In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: rework FDB management on the bridge leave path On bridge leave, the dpaa2_switch_port_set_fdb() function always allocates a new FDB for the port which is becoming standalone. In case no FDB is found, then the port leaving a bridge will continue to use the current one. The above logic does not cover the case in which there are multiple bridges which have ports from the same DPSW instance. In this case, when the last port leaves bridge #1, it finds an unused FDB to switch to, but the old FDB is not marked as unused. Since the number of FDBs is equal to the numb

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-97435

    Nicht bewertetEPSS 0,17%Keine Korrektur veröffentlicht

    net: dsa: sja1105: flower: reject cross-chip redirect

    In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: flower: reject cross-chip redirect dsa_port_from_netdev() may return a valid port from a different switch chip. Programming another chip's port index into the local hardware causes redirection to the wrong port, or an out-of-bounds access if the index exceeds the local chip's port count. Apply a minimal fix that adds a check to catch this case and adjusts the extack message. When cls->common.skip_sw is not set, the operation could instead redirect to the upstream port and let the software or upstream switch(es) handle the forward, but that is not address

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-97434

    Nicht bewertetEPSS 0,17%Keine Korrektur veröffentlicht

    dpaa2-switch: fix handling of NAPI on the remove path

    In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix handling of NAPI on the remove path All the NAPI instances for a DPSW device are attached to the first switch port's net_device but shared by all ports. The NAPI instances get disabled only once the last port goes down. This causes an issue on the .remove() path where each port is unregistered and freed one at a time, causing the NAPI instances to be deleted even though they are not disabled. In order to avoid this, split up the unregister_netdev() calls from the free_netdev() so that we make sure all ports go down before we attempt a deletion of NAPI in

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-97433

    Hoch · CVSS 8.2EPSS 0,32%Keine Korrektur veröffentlicht

    nvme: validate FDP configuration descriptor sizes

    In the Linux kernel, the following vulnerability has been resolved: nvme: validate FDP configuration descriptor sizes Validate descriptor sizes while walking the FDP configurations log so dsze == 0 or a descriptor past the log end cannot cause unbounded iteration or reads past the buffer.

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-97432

    Mittel · CVSS 4.6EPSS 0,17%Keine Korrektur veröffentlicht

    wifi: iwlwifi: mvm: fix P2P-Device binding handling

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix P2P-Device binding handling Our binding handling for P2P-Device can run into the following scenario, as observed by our testing: - a station interface is connected on some channel - the P2P-Device does a remain-on-channel (ROC) on that channel - the ROC ends, and the P2P-Device is removed from the binding, but the phy_ctxt pointer is left around as a PHY cache so we don't need to recalibrate to the channel again and again in case it's not shared - a binding update by the station interface, even a removal, will re-add the P2P-Device t

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-97431

    Nicht bewertetEPSS 0,15%Keine Korrektur veröffentlicht

    drm/amd/display: Avoid DPMS-on for phantom stream

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid DPMS-on for phantom stream [Why & How] Calling dc_update_planes_and_stream separately for stream and its phantom stream causes a NULL pointer dereference, since the phantom is destroyed on the first call. Skip the call for phantom streams.

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-97430

    Nicht bewertetEPSS 0,17%Keine Korrektur veröffentlicht

    xhci: Prevent queuing new commands if xhci is inaccessible

    In the Linux kernel, the following vulnerability has been resolved: xhci: Prevent queuing new commands if xhci is inaccessible Refuse to queue a new command on the command ring if xHC is marked inaccessible with the HCD_FLAG_HW_ACCESSIBLE. HCD_FLAG_HW_ACCESSIBLE is set and cleared in suspend and resume. Also print a warning if xhci is being suspended with commands still pending on the command ring.

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-97429

    Hoch · CVSS 7.8EPSS 0,13%Keine Korrektur veröffentlicht

    drm/amdkfd: fix UAF race in destroy_queue_cpsch

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix UAF race in destroy_queue_cpsch wait_on_destroy_queue() drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use is_being_destroyed flag to serialize destruction.

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2026-97428

    Hoch · CVSS 7.7EPSS 0,14%Keine Korrektur veröffentlicht

    drm/amdgpu: harden FRU PIA parsing with bounded helpers

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with fru_pia_advance() and fru_pia_copy_field() helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on truncated or malformed FRU data.

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2026-97427

    Nicht bewertetEPSS 0,18%Keine Korrektur veröffentlicht

    drm/amd/pm: bound pp_dpm_set_pp_table() memcpy

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: bound pp_dpm_set_pp_table() memcpy The powerplay path allocates hardcode_pp_table once with kmemdup(..., soft_pp_table_size). memcpy(..., size) used the sysfs store count (up to PAGE_SIZE) with no upper bound, causing heap overflow. Reject writes where size exceeds soft_pp_table_size.

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2026-97425

    Nicht bewertetEPSS 0,18%Keine Korrektur veröffentlicht

    drm/amdgpu: fix buffer overflow during vBIOS update

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix buffer overflow during vBIOS update Clamp the buffer postion to write by setting the bin attribute to the maximum buffer size so that VFS layer will block the out-of-bounds accessing.

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2026-97424

    Nicht bewertetEPSS 0,17%Keine Korrektur veröffentlicht

    drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq cp_ecc_error_irq is acquired in amdgpu_gfx_ras_late_init() but released in gfx_v9_0_hw_fini(), so the put site has to query amdgpu_irq_enabled() because the get is skipped on SR-IOV VF. ras_late_init / ras_fini have no suspend counterpart, so move the put to amdgpu_gfx_ras_suspend() / amdgpu_gfx_ras_fini() and add a matching ras_suspend callback that is invoked from amdgpu_ras_suspend() before disable_all_features(). The get and put now sit in the same place and check the same condition (not VF, func

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2026-97423

    Nicht bewertetEPSS 0,15%Keine Korrektur veröffentlicht

    cxl/region: Validate partition index before array access

    In the Linux kernel, the following vulnerability has been resolved: cxl/region: Validate partition index before array access construct_region() reads cxled->part and uses it to index cxlds->part[] without checking for a negative value. If the partition was never resolved, part remains at its initial value of -1, causing an out-of-bounds array access. Add a guard to return -EBUSY when part is negative. The check was dropped during a merge.

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2026-97422

    Mittel · CVSS 4.8EPSS 0,17%Keine Korrektur veröffentlicht

    drm/amdkfd: fix SMI event cross-process information leak

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads. Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers.

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2026-97421

    Hoch · CVSS 7.8EPSS 0,13%Keine Korrektur veröffentlicht

    RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()

    In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() Several corner cases, especially important on 32 bits: - umem->iova is u64, the function argument should pass in u64 or iova will be truncated - Check that the length is not too large for the iova - Check that lengths > 4G don't overflow the GENMASK

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2026-97420

    Nicht bewertetEPSS 0,17%Keine Korrektur veröffentlicht

    bpf: NUL-terminate replaced sysctl value

    In the Linux kernel, the following vulnerability has been resolved: bpf: NUL-terminate replaced sysctl value When writing to sysctls, proc_sys_call_handler() guarantees that the buffer passed to proc handlers is NUL-terminated. If bpf_sysctl_set_new_value() replaces the pending sysctl value, it can hand a replacement buffer directly to proc handlers. However, the helper currently copies only buf_len bytes into that buffer without appending a NUL terminator, leaving downstream parsers vulnerable to out-of-bounds access. Fix this by appending a '\0' after the replaced value to restore the expected sysctl semantics. Since the helper already r

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2026-97419

    Nicht bewertetEPSS 0,17%Keine Korrektur veröffentlicht

    hsr: broadcast netlink notifications in the device's net namespace

    In the Linux kernel, the following vulnerability has been resolved: hsr: broadcast netlink notifications in the device's net namespace The HSR generic netlink family sets .netnsok = true. HSR devices can live in network namespaces other than init_net. Two async notifiers broadcast events with genlmsg_multicast(). They are hsr_nl_ringerror() and hsr_nl_nodedown(). That helper delivers only on the default genl socket in init_net. So the events always land in init_net. The network namespace of the device does not matter. This has two effects. A listener in the device's own namespace never sees its own ring error and node down events. A privi

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2026-97418

    Nicht bewertetEPSS 0,17%Keine Korrektur veröffentlicht

    ALSA: es18xx: check control allocation before private data setup

    In the Linux kernel, the following vulnerability has been resolved: ALSA: es18xx: check control allocation before private data setup snd_es18xx_mixer() creates controls with snd_ctl_new1() and then stores bookkeeping pointers or sets private_free before calling snd_ctl_add(). snd_ctl_new1() can return NULL on allocation failure, so those writes can dereference a NULL control pointer. Check the returned control pointers before using them and return -ENOMEM on allocation failure.

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2026-97417

    Hoch · CVSS 7.5EPSS 0,49%Keine Korrektur veröffentlicht

    netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() The timestamp-only fast path dereferences the option stream as *(__be32 *)ptr, which assumes 4-byte alignment that the TCP option stream does not guarantee. Use get_unaligned_be32() instead, which reads the value safely and already returns host byte order, so the htonl() on the comparison constant can be dropped. This matches the existing get_unaligned_be32() use later in the same function.

    linux-aws-fipsBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →