Skip to content
OpenAdvisories
Medium WID-SEC-2026-3412 19 CVEs

Linux Kernel: Mehrere Schwachstellen

Published Sep 15, 2026 · Updated Nov 12, 2026 · Revision 32 · de

Vendor: Debian Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Vendor: Ubuntu Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: openSUSE Product: Rocky Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Speicher zu beschädigen oder offenzulegen, den Kernel oder den Systemzustand zu manipulieren oder Denial-of-Service-Zustände, einschließlich Kernel-Abstürzen, zu verursachen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 19

  • Critical 9.8
    CVE-2026-89778

    isofs: fix out-of-bounds page array access on empty zisofs block

    In the Linux kernel, the following vulnerability has been resolved: isofs: fix out-of-bounds page array access on empty zisofs block zisofs_uncompress_block()'s empty-block fast path returns pcount << PAGE_SHIFT, ignoring the incoming poffset, unlike the deco…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-89783

    xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full

    In the Linux kernel, the following vulnerability has been resolved: xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full The depth check in xfrm6_input_addr() is off by one: if (1 + sp->len == XFRM_MAX_DEPTH) goto drop; ... sp->xvec[sp->l…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2026-89788

    ksmbd: fix tree connection use-after-free in smb2_tree_connect()

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2_tree_connect() ksmbd_tree_conn_connect() publishes a new tree connection in sess->tree_conns with a single reference and returns its pointer …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.3
    CVE-2026-89775

    KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation Computing the effects of a TLB invalidation involves looking at the size of the mapping cached by the TLB. For S1 mappin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.1
    CVE-2026-89779

    fs/ntfs3: validate ef->size covers the record's name and value

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate ef->size covers the record's name and value When an EA record has a non-zero ef->size, ntfs_read_ea() only checks that the record fits in the remaining buffer (ea_size > by…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-89786

    ext4: fix out-of-bounds read in ext4_read_inline_dir()

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix out-of-bounds read in ext4_read_inline_dir() ext4_read_inline_dir() can read a dirent header past the end of its inline buffer, triggering a slab-out-of-bounds read during getdents6…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-89774

    Bluetooth: SCO: hold sk properly in sco_conn_ready

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in sco_conn_ready sk deref in sco_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk and parent sk is…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2026-89777

    vfio/pci: clear vdev->msi_perm after freeing it on init failure

    In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily allocates the per-device MSI permission table: vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KER…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.4
    CVE-2026-89781

    fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() read_log_rec_buf() copies a log record into a caller buffer starting at u32 off = lsn_to_page_off(log, lsn) + log->record_header_len; lo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.4
    CVE-2026-89782

    fs/ntfs3: reject restart table growth beyond U16_MAX entries

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject restart table growth beyond U16_MAX entries During $LogFile replay, log_replay() indexes the transaction table by the transact_id taken from the log record header. check_log_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-89789

    gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free

    In the Linux kernel, the following vulnerability has been resolved: gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free gtp_newlink()'s error path frees tid_hash and addr_hash without waiting for an RCU grace period after clearing…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-89791

    perf: Fix use-after-free when perf mmap() revival races with the last munmap()

    In the Linux kernel, the following vulnerability has been resolved: perf: Fix use-after-free when perf mmap() revival races with the last munmap() perf_mmap_close() drops rb->mmap_count *without* holding event->mmap_mutex (the refcount_dec_and_test() right be…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2026-89792

    ksmbd: prevent out-of-bounds reads in share config responses

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent out-of-bounds reads in share config responses Validate IPC share configuration payload sizes before consuming variable-length fields. Bound veto list parsing and account for th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-89776

    vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes

    In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address attributes as NLA_BINARY with only a maximum length, so v…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-89780

    net: qualcomm: rmnet: restore skb->dev on deaggregated frames

    In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: restore skb->dev on deaggregated frames rmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and leaves skb->dev NULL. __rmnet_map_ingress_handler() assigns…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-89784

    SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6

    In the Linux kernel, the following vulnerability has been resolved: SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 rpcb_register_inet4() and rpcb_register_inet6() store the result of rpc_sockaddr2uaddr() into map->r_addr without chec…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-89785

    fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init ntfs_reparse_init() and ntfs_objid_init() parse the index root of the $Extend/$Reparse and $Extend/$ObjId metafiles (the I…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-89787

    ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()

    In the Linux kernel, the following vulnerability has been resolved: ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() For casefolded encrypted directories ext4 stores an 8-byte hash trailer after the name (EXT4_DIRENT_HASHES()), …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-89790

    ipv6: avoid divide by zero in rt6_multipath_rebalance

    In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid divide by zero in rt6_multipath_rebalance rt6_multipath_rebalance() calculates the total eligible nexthop weight in one pass and programs upper bounds in a second pass. Since RTM_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Revision history

  1. #32

    Neue Updates von SUSE aufgenommen

  2. #31

    Neue Updates von SUSE und Red Hat aufgenommen

  3. #30

    Neue Updates von Red Hat und Ubuntu aufgenommen

  4. #29

    Neue Updates von SUSE und Red Hat aufgenommen

  5. #28

    Neue Updates von Red Hat aufgenommen

  6. #27

    Neue Updates von SUSE aufgenommen

  7. #26

    Neue Updates von SUSE aufgenommen

  8. #25

    Neue Updates von Debian aufgenommen

  9. #24

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  10. #23

    Neue Updates von SUSE aufgenommen

  11. #22

    Neue Updates von Oracle Linux aufgenommen

  12. #21

    Neue Updates von Red Hat und Oracle Linux aufgenommen

  13. #20

    Neue Updates von SUSE, Red Hat und Oracle Linux aufgenommen

  14. #19

    Neue Updates von Rocky Enterprise Software Foundation, SUSE und openSUSE aufgenommen

  15. #18

    Neue Updates von Rocky Enterprise Software Foundation und Red Hat aufgenommen

  16. #17

    Neue Updates von Red Hat aufgenommen

  17. #16

    Neue Updates von SUSE aufgenommen

  18. #15

    Neue Updates von Oracle Linux, openSUSE, SUSE und Debian aufgenommen

  19. #14

    Neue Updates von SUSE aufgenommen

  20. #13

    Neue Updates von Oracle Linux aufgenommen

  21. #12

    Neue Updates von Ubuntu und SUSE aufgenommen

  22. #11

    Neue Updates von Oracle Linux aufgenommen

  23. #10

    Neue Updates von Ubuntu aufgenommen

  24. #9

    Neue Updates von Oracle Linux aufgenommen

  25. #8

    Neue Updates von Ubuntu aufgenommen

References