Skip to content
OpenAdvisories
Medium WID-SEC-2026-2659 16 CVEs

Linux Kernel: Mehrere Schwachstellen

Published Aug 4, 2026 · Updated Nov 12, 2026 · Revision 41 · de

Vendor: amazon Vendor: Debian Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Vendor: Ubuntu Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Product: Rocky Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um den Speicher zu beschädigen, einen Denial-of-Service-Zustand auszulösen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 16

  • Critical 9.8
    CVE-2026-64566

    xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()

    In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags() When iptfs_skb_add_frags() copies frag references from the source frag walk into a new SKB, it increments the page reference …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.2
    CVE-2026-64578

    ksmbd: validate compound request size before reading StructureSize2

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound (chained) SMB2 request, ksmbd_smb2_check_message() reads pdu->StructureSize2 without first …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64567

    btrfs: reject free space cache with more entries than pages

    In the Linux kernel, the following vulnerability has been resolved: btrfs: reject free space cache with more entries than pages When loading a v1 free space cache, __load_free_space_cache() takes num_entries and num_bitmaps straight from the on-disk btrfs_fre…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64568

    wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure ieee80211_set_unsol_bcast_probe_resp() calls kfree_rcu() on the old template before allocating the replacement. If the …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64570

    wifi: mac80211: fix fils_discovery double free on alloc failure

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix fils_discovery double free on alloc failure ieee80211_set_fils_discovery() calls kfree_rcu() on the old template before allocating the replacement. If the kzalloc() then f…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64574

    wifi: mac80211: tear down new links on vif update error path

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update error path When ieee80211_vif_update_links() adds new links it allocates a link container for each and calls ieee80211_link_init() (which reg…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64575

    bpf: tcp: fix double sock release on batch realloc

    In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpf_iter_tcp_batch() releases the current batch via bpf_iter_tcp_put_batch(), which drops the socket refs and rewrites each slot with the so…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-64580

    xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()

    In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() On the error path where in6_dev_get(dev) returns NULL, xfrm6_fill_dst() releases the device reference with netdev_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-64581

    xfrm: fix sk_dst_cache double-free in xfrm_user_policy()

    In the Linux kernel, the following vulnerability has been resolved: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() xfrm_user_policy() clears the socket dst cache with __sk_dst_reset(), i.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cach…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-64577

    gtp: check skb_pull_data() return in gtp1u_send_echo_resp()

    In the Linux kernel, the following vulnerability has been resolved: gtp: check skb_pull_data() return in gtp1u_send_echo_resp() gtp1u_send_echo_resp() ignores skb_pull_data()'s return value. Its caller gtp1u_udp_encap_recv() only guarantees 16 bytes (udphdr +…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2026-64576

    nexthop: initialize extack in nh_res_bucket_migrate()

    In the Linux kernel, the following vulnerability has been resolved: nexthop: initialize extack in nh_res_bucket_migrate() nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to call_nexthop_res_bucket_notifiers(). When nh_notifier_res_bucket_info_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-64569

    mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n

    In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed attribute table itself instead of calling ip_valid_fib_d…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-64571

    wifi: p54: validate RX frame length in p54_rx_eeprom_readback()

    In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54_rx_eeprom_readback() p54_rx_eeprom_readback() copies the requested EEPROM slice out of a device-supplied readback frame without checking that the sk…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-64572

    ipv4: fib: free fib_alias with kfree_rcu() on insert error path

    In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fib_alias with kfree_rcu() on insert error path fib_table_insert() publishes new_fa into the leaf's fa_list with fib_insert_alias() before calling the fib entry notifiers. Whe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-64573

    Bluetooth: qca: fix NVM tag length underflow in TLV parser

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLV_TYPE_NVM branch of qca_tlv_check_data() the tag loop bound is "while (idx < length - sizeof(struct tlv_type_nvm))". "leng…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-64579

    xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

    In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert xfrm_hash_rebuild()'s first loop preallocates the bins/chains the reinsert loop needs, so the reinsert (after hlist_de…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

Revision history

  1. #41

    Neue Updates von SUSE aufgenommen

  2. #40

    Neue Updates von Ubuntu aufgenommen

  3. #39

    Neue Updates von SUSE aufgenommen

  4. #38

    Neue Updates von SUSE aufgenommen

  5. #37

    Neue Updates von SUSE aufgenommen

  6. #36

    Neue Updates von Ubuntu aufgenommen

  7. #35

    Neue Updates von Oracle Linux aufgenommen

  8. #34

    Neue Updates von Oracle Linux aufgenommen

  9. #33

    Neue Updates von Oracle Linux aufgenommen

  10. #32

    Neue Updates von SUSE und Oracle Linux aufgenommen

  11. #31

    Neue Updates von SUSE und Rocky Enterprise Software Foundation aufgenommen

  12. #30

    Neue Updates von Rocky Enterprise Software Foundation und Red Hat aufgenommen

  13. #29

    Neue Updates von Red Hat aufgenommen

  14. #28

    Neue Updates von SUSE und Red Hat aufgenommen

  15. #27

    Neue Updates von Oracle Linux, openSUSE und SUSE aufgenommen

  16. #26

    Neue Updates von SUSE aufgenommen

  17. #25

    Neue Updates von SUSE und Oracle Linux aufgenommen

  18. #24

    Neue Updates von Ubuntu und SUSE aufgenommen

  19. #23

    Neue Updates von Oracle Linux aufgenommen

  20. #22

    Neue Updates von SUSE aufgenommen

  21. #21

    Neue Updates von Oracle Linux aufgenommen

  22. #20

    Neue Updates von Ubuntu aufgenommen

  23. #19

    Neue Updates von Ubuntu aufgenommen

  24. #18

    Neue Updates von SUSE aufgenommen

  25. #17

    Neue Updates von SUSE aufgenommen

References