Linux Kernel Flaw, CVSS 5.9, Multiple Versions
Summary
CERT-Bund published security advisory WID-SEC-2026-1265 reporting a vulnerability in the Linux Kernel with a CVSS Base Score of 5.9 (medium) and Temporal Score of 5.2. The flaw affects kernel versions prior to 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0. A local attacker can exploit this vulnerability to execute arbitrary code, manipulate memory contents, or cause a denial-of-service condition. A mitigation measure is available and the vulnerability is not remotely exploitable.
“Ein lokaler Angreifer kann eine Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, einschließlich der Ausführung von beliebigem Code, der Manipulation von Speicherinhalten oder der Verursachung eines Denial-of-Service-Zustands.”
Organisations running Linux systems should inventory kernel versions against the affected version list and prioritise patching given the arbitrary code execution capability. Local access controls are the compensating control since remote exploitation is not possible — this reduces urgency for internet-facing systems but remains critical for multi-user or shared Linux environments.
About this source
CERT-Bund is the German federal cybersecurity agency's incident response team, run by the BSI. Their advisory feed publishes vulnerability disclosures and active exploitation warnings for software in widespread enterprise use: VPN appliances, email servers, file transfer products, ERP systems, browsers, hypervisors. Around 280 advisories a month, each with a CVSS score, affected versions, and remediation guidance. The advisories are written in German but cover the same vulnerabilities that show up in CISA, NCSC-UK, and JPCERT bulletins, often hours earlier. Watch this if you patch enterprise software, run a SOC, or write detection rules. GovPing publishes each advisory with the affected vendor, CVSS score, and original CERT-Bund link.
What changed
CERT-Bund issued advisory WID-SEC-2026-1265 describing a vulnerability in multiple Linux Kernel versions spanning branches 5.x through 7.0. The vulnerability carries a CVSS Base Score of 5.9 (medium) and enables local attackers to execute arbitrary code, manipulate memory, or cause denial of service. A mitigation is available and remote attack is not possible.
Organisations running affected Linux Kernel versions should identify their current kernel version, apply available patches or mitigations promptly, and review local access controls given that the attack vector requires local access. The broad affected version range across multiple kernel branches means this likely applies to a wide range of Linux distributions and embedded systems.
Archived snapshot
Apr 24, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
[WID-SEC-2026-1265] Linux Kernel: Schwachstelle ermöglicht nicht spezifizierten Angriff CVSS Base Score 5.9 (mittel) CVSS Temporal Score 5.2 (mittel) Remoteangriff nein Datum 23.04.2026 Stand 24.04.2026 Mitigation ja
Betroffene Systeme
Betriebssystem
- Linux
Produktbeschreibung
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Produkte
23.04.2026
- Open Source Linux Kernel <5.15.203
Open Source Linux Kernel <6.1.169
Open Source Linux Kernel <6.6.135
Open Source Linux Kernel <6.12.82
Open Source Linux Kernel <6.18.23
Open Source Linux Kernel <6.19.13
Open Source Linux Kernel <7.0
Angriff
Angriff
Ein lokaler Angreifer kann eine Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, einschließlich der Ausführung von beliebigem Code, der Manipulation von Speicherinhalten oder der Verursachung eines Denial-of-Service-Zustands. CVE Informationen Versionshistorie Feedback zum Advisory geben
Related changes
Get daily alerts for CERT-Bund Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CERT-Bund.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-Bund Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.