p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости linux-azure-fde-6.8 · Страница 161

За последние 30 дней в linux-azure-fde-6.8 опубликовано уязвимостей: 796; в каталоге KEV: 0.

RSS ↗ JSON ↗
Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 7435

  1. CVE-2026-68432

    Высокий · CVSS 8.8EPSS 0,15%Нет опубликованного исправления

    vxlan: require CAP_NET_ADMIN in the device netns for changelink

    In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns vxlan->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a caller privileged there but not in vxlan->net can rewrite a vxlan device whose underlay lives in vxlan->net. vxlan_changelink() validates and applies the new configuration against vxlan->net (vxlan_config_validate(vxlan->net, .

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  2. CVE-2026-68431

    Критический · CVSS 9.1EPSS 0,37%Нет опубликованного исправления

    ksmbd: validate minimum PDU size for transform requests

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate minimum PDU size for transform requests The receive path applies the minimum SMB2 PDU size check only when ProtocolId is SMB2_PROTO_NUMBER. A packet carrying SMB2_TRANSFORM_PROTO_NUM bypasses the check even when the negotiated dialect does not provide transform handling. On an SMB 2.1 connection, a short transform packet therefore reaches init_smb2_rsp_hdr(), which interprets the request as a full SMB2 header and reads beyond the request allocation. The copied fields can then be returned to the unauthenticated client. Compression transforms are converted t

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  3. CVE-2026-68430

    Без оценкиEPSS 0,18%Нет опубликованного исправления

    drm/amdgpu/gfx8: drop unecessary BUG_ON()

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx8: drop unecessary BUG_ON() There's no need to crash the kernel for this case. (cherry picked from commit 4d7c25208ca612b754f3bf39e9f16e725b828891)

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  4. CVE-2026-68429

    Без оценкиEPSS 0,17%Нет опубликованного исправления

    drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()

    In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() A hotplug or link-loss event can tear down the MST topology (setting mgr->mst_state = false and mgr->mst_primary = NULL) concurrently with a caller invoking drm_dp_mst_topology_queue_probe(). Since the check is already performed under mgr->lock, the condition is not a programming error but a valid race -- the topology was valid when the caller decided to call this function, but was torn down before the lock was acquired. Replace the drm_WARN_ON() with a graceful early return. This elimina

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  5. CVE-2026-68428

    Без оценкиEPSS 0,17%Нет опубликованного исправления

    KVM: x86/mmu: Fix use-after-free on vendor module reload

    In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Fix use-after-free on vendor module reload mmu_destroy_caches() destroys pte_list_desc_cache and mmu_page_header_cache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor module is unloaded while kvm.ko remains loaded. If creation of pte_list_desc_cache fails during a subsequent vendor module load, its assignment sets pte_list_desc_cache to NULL and the error path calls mmu_destroy_caches(). mmu_page_header_cache still points to the cache destroyed during the preceding vendor module unload. Passing that sta

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  6. CVE-2026-68427

    Высокий · CVSS 7.8EPSS 0,13%Нет опубликованного исправления

    gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

    In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings __host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cache local variable instead.

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  7. CVE-2026-68426

    Критический · CVSS 9.8EPSS 0,5%Нет опубликованного исправления

    xfrm: fix stale skb->prev after async crypto steals a GSO segment

    In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list() relies on when it sets its tail pointer (tail = skb->prev). When validate_xmit_xfrm() walks a GSO list and some segments are stolen by async crypto (->xmit() returns -EINPROGRESS), those segments are unlinked from the list but the head ->prev is never updated. If the last segment is the one stolen, the returned head still has ->prev pointing at it, even though it is now owned by the

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  8. CVE-2026-68425

    Высокий · CVSS 7.1EPSS 0,26%Нет опубликованного исправления

    IB/mad: Drop unmatched RMPP responses before reassembly

    In the Linux kernel, the following vulnerability has been resolved: IB/mad: Drop unmatched RMPP responses before reassembly Kernel-handled RMPP receive processing starts reassembly for active DATA responses before the response is matched to an outstanding send. The normal match happens later, after ib_process_rmpp_recv_wc() has either assembled a complete message or consumed the segment. That ordering lets an unsolicited response that routes to a kernel RMPP agent by the high TID bits allocate or extend RMPP receive state before the full TID and source address are checked against a real request. A reordered burst can therefore reach the re

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  9. CVE-2026-68422

    Без оценкиEPSS 0,21%Нет опубликованного исправления

    btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() If we have an unexpected reloc_root for our root, we jump to the out label but never drop the reference we obtained for root, resulting in a leak. Add a missing btrfs_put_root() call.

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  10. CVE-2026-68419

    Высокий · CVSS 7.8EPSS 0,13%Нет опубликованного исправления

    RDMA/irdma: Prevent rereg_mr for non-mem regions

    In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent rereg_mr for non-mem regions When a QP/CQ/SRQ is created, a two step process is used where the buffer is allocated in userspace and explicitly registered with the normal reg_mr mechanism prior to creating the actual QP/CQ/SRQ object. These special registrations are indicated via an ABI field so the driver knows that they do not have a valid mkey and to skip the actual CQP command submission. Since these are real MR objects from the core's perspective, it is possible for a user application to invoke rereg_mr on them and cause a real CQP op to be emitted

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  11. CVE-2026-68418

    Средний · CVSS 6.8EPSS 0,16%Нет опубликованного исправления

    RDMA/irdma: Prevent user-triggered null deref on QP create

    In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.user_wqe_bufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdma_setup_virt_qp. While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.user_wqe_bufs was non-zero. The end result is that a user could send a zero user_wqe_bufs value and trigger a null ptr deref. Fix this by unconditionally calling irdma_get_pbl and bailing if it fail

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  12. CVE-2026-68417

    Высокий · CVSS 7.8EPSS 0,1%Нет опубликованного исправления

    RDMA/siw: publish QP after initialization

    In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siw_create_qp() currently calls siw_qp_add() before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being constructed. Move siw_qp_add() to the end of siw_create_qp(), after QP initialization and before adding the QP to the siw device list.

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  13. CVE-2026-68416

    Без оценкиEPSS 0,16%Нет опубликованного исправления

    mtd: fix double free and WARN_ON in add_mtd_device() error paths

    In the Linux kernel, the following vulnerability has been resolved: mtd: fix double free and WARN_ON in add_mtd_device() error paths When device_register() or mtd_nvmem_add() fails inside add_mtd_device() for a partition, the error handling triggers mtd_release() via put_device() or device_unregister(). mtd_release() calls release_mtd_partition() which frees the mtd_info structure. However, callers such as mtd_add_partition() and add_mtd_partitions() also call free_partition() in their error paths, resulting in a double free. Additionally, release_mtd_partition() hits WARN_ON(!list_empty( &mtd->part.node)) because the partition node is sti

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  14. CVE-2026-68414

    Высокий · CVSS 7.5EPSS 0,23%Нет опубликованного исправления

    wifi: cfg80211: cancel sched scan results work on unregister

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel sched scan results work on unregister cfg80211_sched_scan_results() can queue rdev->sched_scan_res_wk from a driver result notification while a scheduled scan request is present. The work callback recovers the containing cfg80211_registered_device and then locks the wiphy and walks the scheduled-scan request list. wiphy_unregister() already makes the wiphy unreachable and drains rdev work items before cfg80211_dev_free() can release the object, but it does not drain sched_scan_res_wk. A queued or running result work item can therefore cross the unreg

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  15. CVE-2026-68413

    Без оценкиEPSS 0,2%Нет опубликованного исправления

    wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()

    In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() The memory allocated in the ipw2100_alloc_device() function is not freed in some of the error paths in ipw2100_pci_init_one(). Fix that by converting the direct return into a goto to the error path return. The error path when pci_enable_device() fails cannot jump to fail, since at this point priv is not set, so perform error handling inline.

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  16. CVE-2026-68412

    Средний · CVSS 6.7EPSS 0,2%Нет опубликованного исправления

    wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() If the test against IEEE80211_MAX_SSID_LEN fails, then 'creq' leaks. Use the existing error handling path to fix it.

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  17. CVE-2026-68411

    Без оценкиEPSS 0,18%Нет опубликованного исправления

    wifi: mac80211_hwsim: clamp virtio RX length before skb_put

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: clamp virtio RX length before skb_put hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by the device straight to skb_put() on a fixed-size receive skb. A backend reporting a length larger than the skb tailroom drives skb_put() past the buffer end and hits skb_over_panic() -- a host-triggerable guest panic (denial of service). Clamp the length to the skb's available room before skb_put(). A conforming device never reports more than the posted buffer size, so valid frames are unaffected; a truncated over-report then fails the length

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  18. CVE-2026-68410

    Без оценкиEPSS 0,22%Нет опубликованного исправления

    wifi: libertas: fix memory leak in helper_firmware_cb()

    In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in helper_firmware_cb() helper_firmware_cb() neglects to free the single-stage firmware image after a successful async load, leading to a memory leak in the USB firmware-download path. Fix this memory leak by calling release_firmware() immediately after lbs_fw_loaded() returns. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present i

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  19. CVE-2026-68409

    Высокий · CVSS 8.8EPSS 0,26%Нет опубликованного исправления

    wifi: mac80211: defer link RX stats percpu free to RCU

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: defer link RX stats percpu free to RCU sta_remove_link() frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU: sta_info_free_link(&alloc->info); kfree_rcu(alloc, rcu_head); The RX fast path reads link_sta under rcu_read_lock and writes the percpu stats. A reader that resolved link_sta before the removal keeps the pointer. The container stays alive from the kfree_rcu, so the read still works. But the percpu block it points to is already freed. This needs uses_rss. That is when pcpu_rx_stats exists. The f

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  20. CVE-2026-68408

    Без оценкиEPSS 0,17%Нет опубликованного исправления

    wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock When a netlink socket that owns a PMSR session is closed, cfg80211_release_pmsr() clears the request's nl_portid and queues pmsr_free_wk to call cfg80211_pmsr_process_abort() asynchronously. If the interface tears down concurrently, cfg80211_pmsr_wdev_down() is called under wiphy_lock and calls cancel_work_sync(&pmsr_free_wk) to wait for any running work. The work function acquires wiphy_lock via guard(wiphy) before calling process_abort. This is a deadlock: wdev_down holds wiphy_lock and blocks inside can

    linux-azure-fde-6.8Операционные системы
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →