Skip to content
OpenAdvisories
Medium WID-SEC-2026-3588 14 CVEs

Linux Kernel: Mehrere Schwachstellen

Published Sep 27, 2026 · Updated Nov 12, 2026 · Revision 19 · de

Vendor: Debian Vendor: Oracle Vendor: SUSE Vendor: Ubuntu Product: Linux Product: Linux Product: Linux Product: Linux Product: openSUSE Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Informationen offenzulegen, Ressourcen- oder Speicherverwaltungsfehler zu verursachen, Denial-of-Service-Zustände auszulösen oder andere, nicht näher spezifizierte Angriffe durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 14

  • Critical 9.8
    CVE-2026-100075

    RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters

    In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-98163

    cgroup: Avoid iteration of dying tasks with zero refcount

    In the Linux kernel, the following vulnerability has been resolved: cgroup: Avoid iteration of dying tasks with zero refcount The commit 260fbcb92bbea ("cgroup: Move dying_tasks cleanup from cgroup_task_release() to cgroup_task_free()") extended the lifetime …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-100070

    netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet sashiko says: If map_addr() changes the packet length, such as when the public NAT IP string is shorter or longer than the int…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-100071

    net: hsr: free learned nodes on device setup failure

    In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before the failable slave B and …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-100072

    ACPI: platform: Use acpi_bus_get_primary_device()

    In the Linux kernel, the following vulnerability has been resolved: ACPI: platform: Use acpi_bus_get_primary_device() The acpi_get_first_physical_node() usage in acpi_platform_fill_resource() and acpi_create_platform_device() is generally unsafe because in th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-100073

    ext4: fix transaction overflow during writeback

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix transaction overflow during writeback Commit 95ad8ee45cdb ("ext4: correct the reserved credits for extent conversion") was correct to note that we need to reserve enough credits for…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-100074

    bpf: Mark bpf_refcount field as unique

    In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpf_refcount field as unique BPF_REFCOUNT is not marked as a unique field, while it should be. Fix this oversight.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-100076

    staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths

    In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths issue_beacon(), issue_probersp() and issue_asocrsp() obtain a management xmit_frame together with its xmit_buf from…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-100077

    drm/msm: Recover HW before retire hung submit

    In the Linux kernel, the following vulnerability has been resolved: drm/msm: Recover HW before retire hung submit During recovery, it is not safe to retire the hung submit before we recover the GPU. Retiring the submit triggers BO free and that can result in …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-100078

    wifi: iwlwifi: mei: pass correct argument to function

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: pass correct argument to function The first argument to iwl_mei_write_cyclic_buf() should be the cldev but the q_head pointer is passed instead. Fix it.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-100079

    usb: typec: ucsi: unregister debugfs entries on teardown

    In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: unregister debugfs entries on teardown ucsi_register() creates per-instance debugfs entries, but ucsi_unregister() keeps them around until ucsi_destroy(). Drivers like ucsi_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-98160

    staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()

    In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() padapter->HalData is allocated via vzalloc(), but incorrectly freed using kfree() in the rtw_sdio_if1_init() error pa…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2026-98161

    nvdimm: pmem: keep PREFLUSH before data writes

    In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the bio data and can later overwrite the error with a successful REQ_FUA f…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-98162

    smb/server: fix tree connection leak in smb2_tree_connect()

    In the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree connection leak in smb2_tree_connect() See the procedure below: smb2_tree_connect ksmbd_tree_conn_connect xa_store(&sess->tree_conns, tree_conn->id, tree_conn) ksmbd_coun…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

Revision history

  1. #19

    Neue Updates von SUSE aufgenommen

  2. #18

    Neue Updates von SUSE aufgenommen

  3. #17

    Neue Updates von Ubuntu aufgenommen

  4. #16

    Neue Updates von SUSE aufgenommen

  5. #15

    Neue Updates von SUSE aufgenommen

  6. #14

    Neue Updates von SUSE aufgenommen

  7. #13

    Neue Updates von Debian aufgenommen

  8. #12

    Neue Updates von SUSE aufgenommen

  9. #11

    Neue Updates von Debian aufgenommen

  10. #10

    Neue Updates von SUSE und openSUSE aufgenommen

  11. #9

    Neue Updates von openSUSE, Debian, Oracle Linux und SUSE aufgenommen

  12. #8

    Neue Updates von SUSE aufgenommen

  13. #7

    Neue Updates von SUSE und Oracle Linux aufgenommen

  14. #6

    Neue Updates von SUSE aufgenommen

  15. #5

    Neue Updates von Oracle Linux aufgenommen

  16. #4

    Neue Updates von Debian aufgenommen

  17. #3

    Neue Updates von openSUSE aufgenommen

  18. #2

    Neue Updates von Debian aufgenommen

  19. #1

    Initiale Fassung

References