https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 04:03:23 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:70459 <p><strong>Affected:</strong> AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core, AlmaLinux:9: kernel-64k-debug-modules-extra and 64 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964) * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894) * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959) * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062) * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823) * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293) * kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157) * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188) * kernel: libceph: refresh auth-&gt;authorizer_buf{,_len} after authorizer update (CVE-2026-68156) * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155) * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391) * kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072) * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* [Intel 9.8 FEAT] ice: Driver Update [almalinux-9.8.z] (JIRA:AlmaLinux-213003) * AlmaLinux 9.8…</p> <p><strong>Affected:</strong> AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core, AlmaLinux:9: kernel-64k-debug-modules-extra and 64 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964) * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894) * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959) * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062) * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823) * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293) * kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157) * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188) * kernel: libceph: refresh auth-&gt;authorizer_buf{,_len} after authorizer update (CVE-2026-68156) * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155) * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391) * kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072) * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* [Intel 9.8 FEAT] ice: Driver Update [almalinux-9.8.z] (JIRA:AlmaLinux-213003) * AlmaLinux 9.8…</p> https://cve.radiocsirt.org/vuln/alsa-2026:70459 https://cve.radiocsirt.org/vuln/bell-cve-2026-72072 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-72072 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1164 certfr-2026-avi-1164 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1164 https://cve.radiocsirt.org/vuln/euvd-2026-353924 EUVD-2026-353924 https://cve.radiocsirt.org/vuln/euvd-2026-353924 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72072 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete</p> <p>When an offloaded MACsec RX SC is deleted, macsec_del_rxsc_ctx() freed the per-SC metadata_dst with metadata_dst_free(), which kfree()s the object unconditionally and ignores the dst reference count. The RX datapath in mlx5e_macsec_offload_handle_rx_skb() looks up the SC under rcu_read_lock() via xa_load(), takes a reference with dst_hold() and attaches the dst to the skb with skb_dst_set(). A reader that already obtained the rx_sc pointer can race with the delete path and operate on freed memory.</p> <p>Fix the owner side by dropping the reference with dst_release() instead of freeing unconditionally, and convert the RX datapath to dst_hold_safe() so a reader racing the SC delete cannot attach a dst whose last reference was just dropped; only attach it when a reference was actually taken.</p> <p>mlx5e_macsec_add_rxsc() also published sc_xarray_element via xa_alloc() before rx_sc-&gt;md_dst was allocated and initialised, so a datapath reader that looked the SC up by fs_id could observe rx_sc with md_dst still NULL or, on weakly-ordered architectures, a non-NULL md_dst pointer whose contents were not yet visible. NULL-check the xa_load() result and md_dst on the datapath, and reorder add_rxsc() so the xa_alloc() publish happens only after md_dst is fully initialised; the xarray RCU publish then pairs with the rcu_read_lock()/xa_load() in the datapath.…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete</p> <p>When an offloaded MACsec RX SC is deleted, macsec_del_rxsc_ctx() freed the per-SC metadata_dst with metadata_dst_free(), which kfree()s the object unconditionally and ignores the dst reference count. The RX datapath in mlx5e_macsec_offload_handle_rx_skb() looks up the SC under rcu_read_lock() via xa_load(), takes a reference with dst_hold() and attaches the dst to the skb with skb_dst_set(). A reader that already obtained the rx_sc pointer can race with the delete path and operate on freed memory.</p> <p>Fix the owner side by dropping the reference with dst_release() instead of freeing unconditionally, and convert the RX datapath to dst_hold_safe() so a reader racing the SC delete cannot attach a dst whose last reference was just dropped; only attach it when a reference was actually taken.</p> <p>mlx5e_macsec_add_rxsc() also published sc_xarray_element via xa_alloc() before rx_sc-&gt;md_dst was allocated and initialised, so a datapath reader that looked the SC up by fs_id could observe rx_sc with md_dst still NULL or, on weakly-ordered architectures, a non-NULL md_dst pointer whose contents were not yet visible. NULL-check the xa_load() result and md_dst on the datapath, and reorder add_rxsc() so the xa_alloc() publish happens only after md_dst is fully initialised; the xarray RCU publish then pairs with the rcu_read_lock()/xa_load() in the datapath.…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-72072 https://cve.radiocsirt.org/vuln/ghsa-5679-rjmw-gc7q <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete</p> <p>When an offloaded MACsec RX SC is deleted, macsec_del_rxsc_ctx() freed the per-SC metadata_dst with metadata_dst_free(), which kfree()s the object unconditionally and ignores the dst reference count. The RX datapath in mlx5e_macsec_offload_handle_rx_skb() looks up the SC under rcu_read_lock() via xa_load(), takes a reference with dst_hold() and attaches the dst to the skb with skb_dst_set(). A reader that already obtained the rx_sc pointer can race with the delete path and operate on freed memory.</p> <p>Fix the owner side by dropping the reference with dst_release() instead of freeing unconditionally, and convert the RX datapath to dst_hold_safe() so a reader racing the SC delete cannot attach a dst whose last reference was just dropped; only attach it when a reference was actually taken.</p> <p>mlx5e_macsec_add_rxsc() also published sc_xarray_element via xa_alloc() before rx_sc-&gt;md_dst was allocated and initialised, so a datapath reader that looked the SC up by fs_id could observe rx_sc with md_dst still NULL or, on weakly-ordered architectures, a non-NULL md_dst pointer whose contents were not yet visible. NULL-check the xa_load() result and md_dst on the datapath, and reorder add_rxsc() so the xa_alloc() publish happens only after md_dst is fully initialised; the xarray RCU publish then pairs with the rcu_read_lock()/xa_load() in the datapath.…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete</p> <p>When an offloaded MACsec RX SC is deleted, macsec_del_rxsc_ctx() freed the per-SC metadata_dst with metadata_dst_free(), which kfree()s the object unconditionally and ignores the dst reference count. The RX datapath in mlx5e_macsec_offload_handle_rx_skb() looks up the SC under rcu_read_lock() via xa_load(), takes a reference with dst_hold() and attaches the dst to the skb with skb_dst_set(). A reader that already obtained the rx_sc pointer can race with the delete path and operate on freed memory.</p> <p>Fix the owner side by dropping the reference with dst_release() instead of freeing unconditionally, and convert the RX datapath to dst_hold_safe() so a reader racing the SC delete cannot attach a dst whose last reference was just dropped; only attach it when a reference was actually taken.</p> <p>mlx5e_macsec_add_rxsc() also published sc_xarray_element via xa_alloc() before rx_sc-&gt;md_dst was allocated and initialised, so a datapath reader that looked the SC up by fs_id could observe rx_sc with md_dst still NULL or, on weakly-ordered architectures, a non-NULL md_dst pointer whose contents were not yet visible. NULL-check the xa_load() result and md_dst on the datapath, and reorder add_rxsc() so the xa_alloc() publish happens only after md_dst is fully initialised; the xarray RCU publish then pairs with the rcu_read_lock()/xa_load() in the datapath.…</p> https://cve.radiocsirt.org/vuln/ghsa-5679-rjmw-gc7q https://cve.radiocsirt.org/vuln/oesa-2026-3703 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ASoC: qcom: Fix sc7280 lpass potential buffer overflow</p> <p>Case values introduced in commit 5f78e1fb7a3e (&amp;quot;ASoC: qcom: Add driver support for audioreach solution&amp;quot;) cause out of bounds access in arrays of sc7280 driver data (e.g. in case of RX_CODEC_DMA_RX_0 in sc7280_snd_hw_params()).</p> <p>Redefine LPASS_MAX_PORTS to consider the maximum possible port id for q6dsp as sc7280 driver utilizes some of those values.</p> <p>Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37979)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization</p> <p>Syzbot reported shift-out-of-bounds exception on MDIO bus initialization.</p> <p>The PHY address should be masked to 5 bits (0-31). Without this mask, invalid PHY addresses could be used, potentially causing issues with MDIO bus operations.</p> <p>Fix this by masking the PHY address with 0x1f (31 decimal) to ensure it stays within the valid range.(CVE-2025-38736)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl</p> <p>When page reassignment was added to af_alg_pull_tsgl the original loop wasn&amp;apos;t updated so it may try to reassign one more page than necessary.</p> <p>Add the check to the reassignment so that this does not happen.</p> <p>Also u…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es):</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ASoC: qcom: Fix sc7280 lpass potential buffer overflow</p> <p>Case values introduced in commit 5f78e1fb7a3e (&amp;quot;ASoC: qcom: Add driver support for audioreach solution&amp;quot;) cause out of bounds access in arrays of sc7280 driver data (e.g. in case of RX_CODEC_DMA_RX_0 in sc7280_snd_hw_params()).</p> <p>Redefine LPASS_MAX_PORTS to consider the maximum possible port id for q6dsp as sc7280 driver utilizes some of those values.</p> <p>Found by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2025-37979)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization</p> <p>Syzbot reported shift-out-of-bounds exception on MDIO bus initialization.</p> <p>The PHY address should be masked to 5 bits (0-31). Without this mask, invalid PHY addresses could be used, potentially causing issues with MDIO bus operations.</p> <p>Fix this by masking the PHY address with 0x1f (31 decimal) to ensure it stays within the valid range.(CVE-2025-38736)</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl</p> <p>When page reassignment was added to af_alg_pull_tsgl the original loop wasn&amp;apos;t updated so it may try to reassign one more page than necessary.</p> <p>Add the check to the reassignment so that this does not happen.</p> <p>Also u…</p> https://cve.radiocsirt.org/vuln/oesa-2026-3703 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21910-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21910-1 https://cve.radiocsirt.org/vuln/rlsa-2026:70459 <p><strong>Affected:</strong> Rocky Linux:9: kernel</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)</p> <p>* kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)</p> <p>* kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)</p> <p>* kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)</p> <p>* kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)</p> <p>* kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)</p> <p>* kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157)</p> <p>* kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)</p> <p>* kernel: libceph: refresh auth-&gt;authorizer_buf{,_len} after authorizer update (CVE-2026-68156)</p> <p>* kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)</p> <p>* kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)</p> <p>* kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072)</p> <p>* kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* [Intel 9.8 FEAT] ice: Driver Update [rhel-9.8.z] (JIRA:Rocky Linux-213003)</p> <p>* Rocky Linux 9.8: Multiuser Kerberized DF…</p> <p><strong>Affected:</strong> Rocky Linux:9: kernel</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)</p> <p>* kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)</p> <p>* kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959)</p> <p>* kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)</p> <p>* kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)</p> <p>* kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)</p> <p>* kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157)</p> <p>* kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)</p> <p>* kernel: libceph: refresh auth-&gt;authorizer_buf{,_len} after authorizer update (CVE-2026-68156)</p> <p>* kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)</p> <p>* kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)</p> <p>* kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072)</p> <p>* kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* [Intel 9.8 FEAT] ice: Driver Update [rhel-9.8.z] (JIRA:Rocky Linux-213003)</p> <p>* Rocky Linux 9.8: Multiuser Kerberized DF…</p> https://cve.radiocsirt.org/vuln/rlsa-2026:70459 https://cve.radiocsirt.org/vuln/suse-su-2026:23477-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23477-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-72072 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 154 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete When an offloaded MACsec RX SC is deleted, macsec_del_rxsc_ctx() freed the per-SC metadata_dst with metadata_dst_free(), which kfree()s the object unconditionally and ignores the dst reference count. The RX datapath in mlx5e_macsec_offload_handle_rx_skb() looks up the SC under rcu_read_lock() via xa_load(), takes a reference with dst_hold() and attaches the dst to the skb with skb_dst_set(). A reader that already obtained the rx_sc pointer can race with the delete path and operate on freed memory. Fix the owner side by dropping the reference with dst_release() instead of freeing unconditionally, and convert the RX datapath to dst_hold_safe() so a reader racing the SC delete cannot attach a dst whose last reference was just dropped; only attach it when a reference was actually taken. mlx5e_macsec_add_rxsc() also published sc_xarray_element via xa_alloc() before rx_sc-&gt;md_dst was allocated and initialised, so a datapath reader that looked the SC up by fs_id could observe rx_sc with md_dst still NULL or, on weakly-ordered architectures, a non-NULL md_dst pointer whose contents were not yet visible. NULL-check the xa_load() result and md_dst on the datapath, and reorder add_rxsc() so the xa_alloc() publish happens only after md_dst is fully initialised; the xarray RCU publish then pairs with the rcu_read_lock()/xa_load() in the datapath. Note:…</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 154 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete When an offloaded MACsec RX SC is deleted, macsec_del_rxsc_ctx() freed the per-SC metadata_dst with metadata_dst_free(), which kfree()s the object unconditionally and ignores the dst reference count. The RX datapath in mlx5e_macsec_offload_handle_rx_skb() looks up the SC under rcu_read_lock() via xa_load(), takes a reference with dst_hold() and attaches the dst to the skb with skb_dst_set(). A reader that already obtained the rx_sc pointer can race with the delete path and operate on freed memory. Fix the owner side by dropping the reference with dst_release() instead of freeing unconditionally, and convert the RX datapath to dst_hold_safe() so a reader racing the SC delete cannot attach a dst whose last reference was just dropped; only attach it when a reference was actually taken. mlx5e_macsec_add_rxsc() also published sc_xarray_element via xa_alloc() before rx_sc-&gt;md_dst was allocated and initialised, so a datapath reader that looked the SC up by fs_id could observe rx_sc with md_dst still NULL or, on weakly-ordered architectures, a non-NULL md_dst pointer whose contents were not yet visible. NULL-check the xa_load() result and md_dst on the datapath, and reorder add_rxsc() so the xa_alloc() publish happens only after md_dst is fully initialised; the xarray RCU publish then pairs with the rcu_read_lock()/xa_load() in the datapath. Note:…</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-72072 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2852 <p>Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um root Rechte zu erlangen, um einen Denial of Service herbeizuführen oder einen nicht näher spezifizierten Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um root Rechte zu erlangen, um einen Denial of Service herbeizuführen oder einen nicht näher spezifizierten Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2852