Skip to content
OpenAdvisories
High WID-SEC-2026-1870 20 CVEs

Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service

Published Jun 9, 2026 · Updated Nov 12, 2026 · Revision 72 · de

Vendor: amazon Vendor: Debian Vendor: IBM Vendor: Oracle Vendor: Proxmox Vendor: Red Hat Vendor: RESF Vendor: SUSE Vendor: Ubuntu Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: openshift Product: openSUSE Product: QRadar SIEM Product: Rocky Linux Product: Security Verify Access Product: Virtual Environment Platform: Linux

Summary

Eiin Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder andere, nicht näher bezeichnete Angriffe durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 20

  • Critical 9.8
    CVE-2026-46325

    RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE

    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.3
    CVE-2026-46316 Public exploit

    KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's r…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-46317

    KVM: arm64: Reassign nested_mmus array behind mmu_lock

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign nested_mmus array behind mmu_lock kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unma…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.4
    CVE-2026-46326

    iio: pressure: mprls0025pa: fix spi_transfer struct initialisation

    In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mprls0025pa: fix spi_transfer struct initialisation Make sure that the spi_transfer struct is zeroed out before use.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.0
    CVE-2026-46332

    greybus: gb-beagleplay: bound bootloader receive buffering

    In the Linux kernel, the following vulnerability has been resolved: greybus: gb-beagleplay: bound bootloader receive buffering cc1352_bootloader_rx() appends each serdev chunk into the fixed rx_buffer before parsing bootloader packets. The helper can keep lef…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46319

    net/sched: act_ct: Only release RCU read lock after ct_ft

    In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in act_ct in tcf_ct_flow_table_get(), rhashtable_lookup_fast() internally opens and closes an RCU read c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46323

    net: gro: don't merge zcopy skbs

    In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46324

    netfilter: nf_tables: use list_del_rcu for netlink hooks

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: use list_del_rcu for netlink hooks nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks need to use list_del_rcu(), this list can be walked by concurrent…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46327

    dm: fix unlocked test for dm_suspended_md

    In the Linux kernel, the following vulnerability has been resolved: dm: fix unlocked test for dm_suspended_md The function dm_blk_report_zones tests if the device is suspended with the "dm_suspended_md" call. However, this function is called without holding a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46330

    Revert "net/smc: Introduce TCP ULP support"

    In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The impl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-52907

    media: rockchip: rkcif: fix off by one bugs

    In the Linux kernel, the following vulnerability has been resolved: media: rockchip: rkcif: fix off by one bugs Change these comparisons from > vs >= to avoid accessing one element beyond the end of the arrays. While at it, use ARRAY_SIZE instead of the _MAX …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.7
    CVE-2026-52906

    9p: fix access mode flags being ORed instead of replaced

    In the Linux kernel, the following vulnerability has been resolved: 9p: fix access mode flags being ORed instead of replaced Since commit 1f3e4142c0eb ("9p: convert to the new mount API"), v9fs_apply_options() applies parsed mount flags with |= onto flags alr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.4
    CVE-2026-46320

    tap: free page on error paths in tap_get_user_xdp()

    In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the e…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.3
    CVE-2026-46328

    apparmor: fix rlimit for posix cpu timers

    In the Linux kernel, the following vulnerability has been resolved: apparmor: fix rlimit for posix cpu timers Posix cpu timers requires an additional step beyond setting the rlimit. Refactor the code so its clear when what code is setting the limit and condit…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2026-46321

    tun: free page on short-frame rejection in tun_xdp_one()

    In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without freeing the page that vhost_net_build_xdp() allocated for it. t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-46322

    tun: free page on build_skb failure in tun_xdp_one()

    In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the pa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-46318

    Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare"

    In the Linux kernel, the following vulnerability has been resolved: Revert "mm/hugetlbfs: update hugetlbfs to use mmap_prepare" This reverts commit ea52cb24cd3f ("mm/hugetlbfs: update hugetlbfs to use mmap_prepare") with conflict resolution to account for cha…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-46329

    erofs: handle end of filesystem properly for file-backed mounts

    In the Linux kernel, the following vulnerability has been resolved: erofs: handle end of filesystem properly for file-backed mounts I/O requests beyond the end of the filesystem should be zeroed out, similar to loopback devices and that is what we expect.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-52904

    drm/nouveau: fix nvkm_device leak on aperture removal failure

    In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix nvkm_device leak on aperture removal failure When aperture_remove_conflicting_pci_devices() fails during probe, the error path returns directly without unwinding the nvkm_dev…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-52905

    mm/damon/core: disallow non-power of two min_region_sz on damon_start()

    In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: disallow non-power of two min_region_sz on damon_start() Commit d8f867fa0825 ("mm/damon: add damon_ctx->min_sz_region") introduced a bug that allows unaligned DAMON region addr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Revision history

  1. #72

    Neue Updates von Debian aufgenommen

  2. #71

    Neue Updates von Red Hat aufgenommen

  3. #70

    Neue Updates von Red Hat aufgenommen

  4. #69

    Neue Updates von Ubuntu aufgenommen

  5. #68

    Neue Updates von IBM aufgenommen

  6. #67

    Neue Updates von Debian aufgenommen

  7. #66

    Neue Updates von Oracle Linux und Rocky Enterprise Software Foundation aufgenommen

  8. #65

    Neue Updates von Red Hat und Oracle Linux aufgenommen

  9. #64

    Neue Updates von Oracle Linux aufgenommen

  10. #63

    Neue Updates von Red Hat aufgenommen

  11. #62

    Neue Updates von Ubuntu aufgenommen

  12. #61

    Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen

  13. #60

    Neue Updates von IBM aufgenommen

  14. #59

    Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen

  15. #58

    Neue Updates von Red Hat aufgenommen

  16. #57

    Neue Updates von Oracle Linux aufgenommen

  17. #56

    Neue Updates von Red Hat aufgenommen

  18. #55

    Neue Updates von Ubuntu aufgenommen

  19. #54

    Neue Updates von Ubuntu aufgenommen

  20. #53

    Neue Updates von Ubuntu aufgenommen

  21. #52

    Neue Updates von SUSE aufgenommen

  22. #51

    Neue Updates von SUSE und Rocky Enterprise Software Foundation aufgenommen

  23. #50

    Neue Updates von Oracle Linux aufgenommen

  24. #49

    Neue Updates von SUSE und Red Hat aufgenommen

  25. #48

    Neue Updates von Ubuntu aufgenommen

References