Skip to content
OpenAdvisories
High WID-SEC-2026-2799 22 CVEs

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Aug 11, 2026 · Updated Nov 12, 2026 · Revision 33 · de

Vendor: amazon Vendor: Debian Vendor: IBM Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Vendor: Ubuntu Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Product: QRadar SIEM Product: Rocky Linux Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, darunter möglicherweise die Ausführung von beliebigem Code, die Offenlegung von Informationen, die Manipulation von Daten oder Denial-of-Service-Zustände.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 22

  • Critical 9.1
    CVE-2026-68431

    ksmbd: validate minimum PDU size for transform requests

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate minimum PDU size for transform requests The receive path applies the minimum SMB2 PDU size check only when ProtocolId is SMB2_PROTO_NUMBER. A packet carrying SMB2_TRANSFORM_PR…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-68432

    vxlan: require CAP_NET_ADMIN in the device netns for changelink

    In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns vxlan->net. They differ once th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.6
    CVE-2026-68433

    libceph: bound get_version reply decode to front len

    In the Linux kernel, the following vulnerability has been resolved: libceph: bound get_version reply decode to front len handle_get_version_reply() uses msg->front_alloc_len as the decode boundary for MON_GET_VERSION_REPLY. That is the size of the reused repl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68440

    net: txgbe: fix heap overflow when reading module EEPROM

    In the Linux kernel, the following vulnerability has been resolved: net: txgbe: fix heap overflow when reading module EEPROM txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes into the caller buffer, which ethtool allocates with exactly 'lengt…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68442

    btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps

    In the Linux kernel, the following vulnerability has been resolved: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps When btrfs_drop_extent_map_range() splits an extent map, the new split maps inherit the original map's flags through a local 'f…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68445

    drm/vc4: Prevent shader BO mappings from becoming writable

    In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4_gem_object_mmap() rejects a writable mapping of a validated shader BO, but leaves VM_MAYWRITE set. Userspace can map the BO read…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-68446

    drm/vmwgfx: Validate vmw_surface_metadata::array_size

    In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmw_surface_metadata::array_size This field comes from userspace and should be validated against specific limits depending on which Shader Model (SM) is available.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2026-68447

    drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size from hardware without bounding it to the allocated…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-68429

    drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()

    In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() A hotplug or link-loss event can tear down the MST topology (setting mgr->mst_state = false and mgr->mst_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-68430

    drm/amdgpu/gfx8: drop unecessary BUG_ON()

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx8: drop unecessary BUG_ON() There's no need to crash the kernel for this case. (cherry picked from commit 4d7c25208ca612b754f3bf39e9f16e725b828891)

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-68434

    serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms

    In the Linux kernel, the following vulnerability has been resolved: serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Commit b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected platforms") replaced the dnv_board setup an…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-68435

    LoongArch: Fix address space mismatch in kexec command line lookup

    In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexec_load(2) path (file_mode == 0) passes the u…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-68436

    drm/amd/display: use kvzalloc to allocate struct dc

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use kvzalloc to allocate struct dc struct dc has grown large over time (most of it the two inlined dc_scratch_space copies) and now sits close to the page allocator's 4 MiB c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-68437

    drm/imagination: Fit paired fragment job in the correct CCCB

    In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fit paired fragment job in the correct CCCB For geometry jobs with a paired fragment job, at the moment, the DRM scheduler's prepare_job() callback: - checks for internal (dr…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-68438

    smp: Make CSD lock acquisition atomic for debug mode

    In the Linux kernel, the following vulnerability has been resolved: smp: Make CSD lock acquisition atomic for debug mode Commit b0473dcd4b1d ("smp: Improve smp_call_function_single() CSD-lock diagnostics") changed smp_call_function_single() so that, when CSD …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-68439

    wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()

    In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() mt76_connac_get_he_phy_cap routine can theoretically return NULL so check cap pointer before dereferencing it.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-68441

    net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains

    In the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains When a TC filter attached to a qdisc filter chain returns TC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an act_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-68443

    hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop

    In the Linux kernel, the following vulnerability has been resolved: hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop Calling hid_hw_stop() does not stop the device IO. This results in a race condition between hid_input_report() and the p…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-68444

    firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()

    In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() ffa_partition_info_get() passes uuid_str directly to uuid_parse() without a NULL check. When a caller passes NULL, uuid_par…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-68448

    ovl: check access to copy_file_range source with src mounter creds

    In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with src mounter creds Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-68449

    ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning

    In the Linux kernel, the following vulnerability has been resolved: ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning The hand-rolled bit-scanning loop in the NCQ completion path has an infinite loop bug. When tag_mask has only high bi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-68450

    btrfs: free mapping node on duplicate reloc root insert

    In the Linux kernel, the following vulnerability has been resolved: btrfs: free mapping node on duplicate reloc root insert __add_reloc_root() allocates a mapping_node before inserting it into rc->reloc_root_tree. If rb_simple_insert() finds an existing entry…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Revision history

  1. #33

    Neue Updates von SUSE aufgenommen

  2. #32

    Neue Updates von SUSE und Red Hat aufgenommen

  3. #31

    Neue Updates von Ubuntu und Red Hat aufgenommen

  4. #30

    Neue Updates von SUSE aufgenommen

  5. #29

    Neue Updates von SUSE aufgenommen

  6. #28

    Neue Updates von IBM und SUSE aufgenommen

  7. #27

    Neue Updates von Debian aufgenommen

  8. #26

    Neue Updates von Oracle Linux aufgenommen

  9. #25

    Neue Updates von Rocky Enterprise Software Foundation und SUSE aufgenommen

  10. #24

    Neue Updates von Red Hat aufgenommen

  11. #23

    Neue Updates von SUSE aufgenommen

  12. #22

    Neue Updates von SUSE, Oracle Linux und openSUSE aufgenommen

  13. #21

    Neue Updates von SUSE aufgenommen

  14. #20

    Neue Updates von SUSE und Oracle Linux aufgenommen

  15. #19

    Neue Updates von Oracle Linux, Ubuntu und SUSE aufgenommen

  16. #18

    Neue Updates von Oracle Linux aufgenommen

  17. #17

    Neue Updates von Red Hat aufgenommen

  18. #16

    Neue Updates von Oracle Linux aufgenommen

  19. #15

    Neue Updates von Ubuntu aufgenommen

  20. #14

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  21. #13

    Neue Updates von Red Hat aufgenommen

  22. #12

    Neue Updates von SUSE aufgenommen

  23. #11

    Neue Updates von openSUSE aufgenommen

  24. #10

    Neue Updates von SUSE aufgenommen

  25. #9

    Neue Updates von SUSE aufgenommen

References