Skip to content
OpenAdvisories
Medium WID-SEC-2026-3822 10 CVEs

Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Oct 8, 2026 · Updated Nov 12, 2026 · Revision 9 · de

Vendor: Debian Vendor: Oracle Vendor: SUSE Vendor: Ubuntu Product: Linux Product: Linux Product: Linux Product: Linux Product: openSUSE Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 10

  • High 7.8
    CVE-2026-98376

    bpf: Use array_map_meta_equal for percpu array inner map replacement

    In the Linux kernel, the following vulnerability has been resolved: bpf: Use array_map_meta_equal for percpu array inner map replacement percpu_array_map_ops.map_meta_equal points to the generic bpf_map_meta_equal(), which does not compare max_entries. When a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-98378

    bpf: Skip unsettled links in link iterator

    In the Linux kernel, the following vulnerability has been resolved: bpf: Skip unsettled links in link iterator bpf_link_prime() inserts a link into link_idr before anon_inode_getfile() succeeds and before bpf_link_settle() publishes the ID in link->id. bpf_li…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-98381

    veth: manage XDP program pointers during channel resize

    In the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize veth_set_channels() tears down XDP resources for removed RX queues without clearing rq->xdp_prog. If the program is then detached or re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-98382

    bpf: Reject dev-bound-only programs on other devices

    In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices __bpf_offload_dev_match() falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL o…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-98383

    bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL

    In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL An LWT_SEG6LOCAL program can invalidate its cached SRH with bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter may rea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-98375

    xen/netfront: drop RX packets with a short Ethernet header

    In the Linux kernel, the following vulnerability has been resolved: xen/netfront: drop RX packets with a short Ethernet header handle_incoming_queue() pulls pull_to bytes into the head before calling eth_type_trans(). pull_to is the length of the first RX slo…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-98377

    vlan: require the MAC header to be present in __vlan_insert_inner_tag()

    In the Linux kernel, the following vulnerability has been resolved: vlan: require the MAC header to be present in __vlan_insert_inner_tag() __vlan_insert_inner_tag() only guarantees head room via skb_cow_head(), never that mac_len bytes of MAC header are pres…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-98379

    netfilter: ip6t_rpfilter: reject routes without inet6_dev

    In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rpfilter: reject routes without inet6_dev ip6_route_lookup() can return an error-free route whose rt6i_idev is NULL. Lowering an external nexthop device's MTU below IPV6_MIN_M…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-98380

    net/sched: reject IDR error pointers when deleting actions

    In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcf_action_delete() drops the reference held by its lookup before calling tcf_idr_delete_index() with the saved action index. An unl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-98384

    bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()

    In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() sk_protocol lives in struct sock, not in struct sock_common. A timewait or request sock handed to bpf_sock_destroy() by the tc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

Revision history

  1. #9

    Neue Updates von SUSE aufgenommen

  2. #8

    Neue Updates von SUSE aufgenommen

  3. #7

    Neue Updates von Ubuntu aufgenommen

  4. #6

    Neue Updates von Ubuntu aufgenommen

  5. #5

    Neue Updates von Oracle Linux aufgenommen

  6. #4

    Neue Updates von openSUSE aufgenommen

  7. #3

    Neue Updates von Debian aufgenommen

  8. #2

    Neue Updates von Debian aufgenommen

  9. #1

    Initiale Fassung

References