{"id":183410,"date":"2026-09-20T10:54:15","date_gmt":"2026-09-20T08:54:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/opasnye-uyazvimosti-v-yadre-linux-kvm-exim-unbound-ghostscript-i-suricata"},"modified":"2026-09-20T10:54:15","modified_gmt":"2026-09-20T08:54:15","slug":"serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata","title":{"rendered":"Farliga s\u00e5rbarheter i Linux-k\u00e4rnan, KVM, Exim, Unbound, Ghostscript och Suricata","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Flera nyligen uppt\u00e4ckta farliga s\u00e5rbarheter som till\u00e5ter root-\u00e5tkomst i systemet eller m\u00f6jligg\u00f6r fj\u00e4rrk\u00f6rning av kod.  <\/p>\n<ul>\n<li class=\"l\"> Oavsl\u00f6jade uppgifter om fyra s\u00e5rbarheter i Linux-k\u00e4rnan som g\u00f6r det m\u00f6jligt f\u00f6r en icke-privilegierad lokal anv\u00e4ndare att k\u00f6ra kod med root-r\u00e4ttigheter. Problemen har \u00e5tg\u00e4rdats i uppdateringar av Linux-k\u00e4rnan 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 och 7.2.4. Exploater f\u00f6r alla s\u00e5rbarheterna har tagits fram, och deras funktion har demonstrerats i Fedora 43\/44 och Ubuntu 24.04. F\u00f6r att utnyttja de tre f\u00f6rsta s\u00e5rbarheterna kr\u00e4vs m\u00f6jligheten att skapa anv\u00e4ndarnamnrymder (user namespace) eller r\u00e4ttigheter f\u00f6r CAP_NET_ADMIN, samt aktivering av st\u00f6det f\u00f6r de subsystems d\u00e4r s\u00e5rbarheterna finns (AH6\/XFRM, TUN, PPPoE och SCTP).\n<ul>\n<li class=\"l\"> DirtyAH6 (CVE-2026-80844, exploit) \u2014 en buffert\u00f6mningsattack i IPsec AH (Authentication Header) hanteraren, som uppst\u00e5r p\u00e5 grund av bristen p\u00e5 validering av angivna v\u00e4rden i headers. F\u00f6rutom lokala attacker kan s\u00e5rbarheten, under specifika f\u00f6rh\u00e5llanden, teoretiskt exploateras p\u00e5 distans.\n<li class=\"l\"> TUNderflow (CVE-2026-81000, exploit) \u2014 skrivning utanf\u00f6r den tilldelade bufferten vid tolkning av en felaktigt formaterad TUN-paket.\n<li class=\"l\"> PPPoEject (CVE-2026-68121, exploit) \u2014 \u00e5tkomst till redan frigjord minne i PPPoE-drivrutinen.\n<li class=\"l\"> DiagSpill (CVE-2026-74469, exploit) \u2014 buffert\u00f6mningsattack i SCTP-protokollanalysverktyg. F\u00f6rutom lokala attacker kan s\u00e5rbarheten, under specifika f\u00f6rh\u00e5llanden, teoretiskt exploateras p\u00e5 distans.     <\/ul>\n<li class=\"l\"> S\u00e5rbarhet (CVE-2026-89775) i hypervisorn <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sv\/vps\/abuzoustojchivye-vps\/\" title=\"KVM\" data-wpil-keyword-link=\"linked\">KVM<\/a>, vilket m\u00f6jligg\u00f6r \u00e5tkomst till v\u00e4rdmilj\u00f6n fr\u00e5n g\u00e4stsystemet. Om obeh\u00f6riga anv\u00e4ndare har tillg\u00e5ng till enheten \/dev\/kvm (standard i RHEL) kan s\u00e5rbarheten ocks\u00e5 utnyttjas f\u00f6r att h\u00f6ja sina privilegier i systemet. Problemet uppst\u00e5r endast p\u00e5 system med ARM64-arkitektur n\u00e4r st\u00f6d f\u00f6r inb\u00e4ddad virtualisering \u00e4r aktiverat. S\u00e5rbarheten uppst\u00e5r eftersom storleksber\u00e4kningsproceduren returnerade &#171;0&#187;, vilket antyder att storleken \u00e4r ok\u00e4nd, och funktionen f\u00f6r att frig\u00f6ra minnessidor behandlade &#171;0&#187; som ett faktiskt v\u00e4rde och inte rensade minnessidor.\n<li class=\"l\"> I utg\u00e5van av e-post <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sv\/server\/dts-los-angeles\/\" title=\"servern\" data-wpil-keyword-link=\"linked\">servern<\/a> Exim 4.100.1 har \u00e5tg\u00e4rdat 4 s\u00e5rbarheter: l\u00e4sning av data utanf\u00f6r bufferten och anv\u00e4ndning av oinitialiserade data i implementeringen av Protokollet Proxy; \u00e5tkomst till minne efter frig\u00f6rande i TLS-on-connect vid anv\u00e4ndning av GnuTLS; ins\u00e4ttning av meddelande i n\u00e5gon annans str\u00f6m (SMTP smuggling).\n<li class=\"l\"> I paketet Ghostscript 10.08.0 har en s\u00e5rbarhet (CVE-2026-39919) \u00e5tg\u00e4rdats, orsakad av en buffert\u00f6verskridning i koden f\u00f6r att analysera JPEG 2000-formatet n\u00e4r ogiltiga sub-samplingv\u00e4rden anges. Problemet kan leda till fj\u00e4rrkodexekvering vid hantering av speciellt utformade PDF-filer med integrerade JPEG 2000-bilder i Ghostscript. S\u00e5rbarhetens risk f\u00f6rst\u00e4rks av att Ghostscript anropas under skapandet av miniatyrbilder p\u00e5 skrivbordet, vid bakgrundsindexering av data och vid konvertering av bilder. F\u00f6r att framg\u00e5ngsrikt utnyttja attacken kr\u00e4vs i m\u00e5nga fall bara att en fil med exploiten laddas upp eller en katalog med den visas i Nautilus. S\u00e5rbarheter i Ghostscript kan ocks\u00e5 utnyttjas genom bildhanterare baserade p\u00e5 paketen ImageMagick och GraphicsMagick, genom att \u00f6verf\u00f6ra en JPEG- eller PNG-fil d\u00e4r PostScript-kod finns ist\u00e4llet f\u00f6r en bild (s\u00e5dana filer kommer att behandlas i Ghostscript, eftersom MIME-typen identifieras utifr\u00e5n inneh\u00e5llet, inte baserat p\u00e5 fil\u00e4ndelsen). Problemet har l\u00f6sts i Ghostscript 10.08.0.\n<li class=\"l\"> I DNS-servern Unbound 1.26.1 har 9 s\u00e5rbarheter \u00e5tg\u00e4rdats, inklusive problemet CVE-2026-81642, som leder till buffert\u00f6verskridning vid hantering av vissa DNSKEY. S\u00e5rbarheten kan utnyttjas f\u00f6r fj\u00e4rrkodexekvering p\u00e5 <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sv\/server\/dts-dronten\/\" title=\"servern\" data-wpil-keyword-link=\"linked\">servern<\/a>. Andra \u00e5tg\u00e4rder inkluderar: buffert\u00f6verskridning i koden f\u00f6r DNSSEC, minneskorruption i CNAME-hanteraren, och \u00e5tkomst till redan frigjord minne i DoQ- och DoH-koden.\n<li class=\"l\"> I intr\u00e5ngsdetekterings- och f\u00f6rebyggandesystemet Suricata 8.0.7 har 67 s\u00e5rbarheter \u00e5tg\u00e4rdats, varav tv\u00e5 klassificeras som kritiska. Detaljer om problemen \u00e4r \u00e4nnu inte offentliggjorda, men med tanke p\u00e5 s\u00e5rbarheternas allvar tyder det p\u00e5 att de kan till\u00e5ta fj\u00e4rrkodexekvering vid hantering av s\u00e4rskilt utformat trafik.  <\/ul>\n<p>K\u00e4lla: <a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66310\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430. \u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0447\u0435\u0442\u044b\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 \u044f\u0434\u0440\u0435 Linux, \u0434\u0430\u044e\u0449\u0438\u0445 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 \u044f\u0434\u0440\u0430 Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50 \u0438 7.2.4. \u0414\u043b\u044f \u0432\u0441\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u044b \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b, \u0440\u0430\u0431\u043e\u0442\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183410","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/news\/serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u043f\u0430\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, KVM, Exim, Unbound, Ghostscript \u0438 Suricata | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/news\/serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-20T08:54:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-20T08:54:15+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Farliga s\u00e5rbarheter i Linux-k\u00e4rnan, KVM, Exim, Unbound, Ghostscript och Suricata | ProHoster","description":"Flera nyligen uppt\u00e4ckta farliga s\u00e5rbarheter som till\u00e5ter root-\u00e5tkomst i systemet eller m\u00f6jligg\u00f6r fj\u00e4rrk\u00f6rning av kod.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0430\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u044f\u0434\u0440\u0435 Linux, KVM, Exim, Unbound, Ghostscript \u0438 Suricata | ProHoster","og:description":"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043b\u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/serious-vulnerabilities-in-the-linux-kernel-kvm-exim-unbound-ghostscript-and-suricata","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-09-20T08:54:15+00:00","article:modified_time":"2026-09-20T08:54:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"183410","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-09-22 16:20:59","updated":"2026-09-22 16:20:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/183410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=183410"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/183410\/revisions"}],"predecessor-version":[{"id":183425,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/183410\/revisions\/183425"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=183410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=183410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=183410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}