Alertas de Seguridad de la Información

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-87799] Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixe…

Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write attacker-controlled files to arbitrary paths on the target host as root, leading to full host compromise. T…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-85185] Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.1…

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full …

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-85526] Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authen…

Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

25/09/2026

[CVE-2026-100075] In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srpt_alloc_rw_ct…

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/09/2026

[CVE-2026-97413] In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer unde…

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write usr_len is read from a network-supplied message field (le16_to_cpu) and used to compute data_len = off - usr_len without validating that usr_len off causing an integer underflow, resulting in data_len wrappin…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/09/2026

[CVE-2026-93228] In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chu…

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write/Reply chunks with segcount 0 A peer can send a Write or Reply chunk whose segcount field is zero. xdr_check_write_chunk() only rejects segcount > rc_maxpages, so zero passes the range check, and xdr_inline_decode(stream, 0) returns the current (non-NULL) cursor without advancing. The function returns true a…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/09/2026

[CVE-2026-93207] In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpc_gss_wire_cred …

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry svcauth_gss_decode_credbody() writes the caller's rpc_gss_wire_cred field by field and assigns gc_ctx.len only on the success tail. The caller storage is svcdata->clcred, which lives in the per-svc_rqst gss_svc_data and is reused across requests. Early decod…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-65113] NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause us…

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/09/2026

[CVE-2026-58491] Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpg…

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by warpgate-protocol-http/src/api/sso_provider_list.rs. A victim who follows a crafted link and completes …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

21/09/2026

[CVE-2026-79920] Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user …

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin construct a pip package specification from unvalidated name and version fields, and the task worker invokes…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90048] In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bound…

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() ni_create_attr_list() allocates a fixed buffer of al_aligned(record_size) (== record_size) bytes and then walks every attribute of the primary MFT record, writing one ATTR_LIST_ENTRY per attribute and advancing the cursor by le_size(name_len), with no check against …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90049] In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skb_tx_error…

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() skb_zerocopy() copies frags from @from into @to. On an skb_orphan_frags() failure it calls skb_tx_error(@from), a destructive operation on the source skb the copy helper does not own. That completes @from's zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, including t…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90038] In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-…

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4_revoke_export_states() has the same use-after-free as nfsd4_revoke_states(): it drops nn->client_lock across revoke_one_stid() and the following read of clp->cl_minorversion, but the stateid reference it holds does not pin the client. A teardown racing the…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90042] In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filename…

In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc() buffers The fscrypt subsystem uses the scatterlist crypto API, inheriting its requirement that any buffers are in the linear mapping region. However, the messenger client uses kvmalloc() to create buffers for messages, which will occasionally place those buffers in the vmalloc() regi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90036] In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-…

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn->blocked_locks_lru -- holds a raw pointer to its nfs4_client but no reference keeping the client alive. When the per-net laundromat reaps such a lock, freeing the nbl drops the owner reference he…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90037] In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-…

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during close_lru reaping An nfs4_openowner left on nn->close_lru after its final CLOSE keeps its last closed stateid in oo_last_closed_stid, holding only a raw pointer to its nfs4_client. The laundromat reaps timed-out entries, drops nn->client_lock, and calls nfs4_put_stid(), which dereferenc…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90011] In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a …

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS bytes. Since iscsit_get_login_rx() receives payload_length + padding…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90012] In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership …

In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, __spi_map_msg() unmaps TX but leaves tx_sg_mapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers remain active. In both cases, cur_{tx,rx}_dma_dev have not yet been updated because they are …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-89990] In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in ceph_mds_ch…

In the Linux kernel, the following vulnerability has been resolved: ceph: lock mutex in ceph_mds_check_access() MDS session OPEN handling replaces mdsc->s_cap_auths under mdsc->mutex, freeing the previous array and its strings. ceph_mds_check_access() traverses this array without holding the mutex. A concurrent session reopen can therefore free the array while it is being inspected, resulting …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-89969] In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds wr…

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmet_tcp_try_recv_pdu() reads a PDU header into the fixed 128-byte queue->pdu union, then computes the remaining payload length as queue->left = hdr->hlen - queue->offset + hdgst; and reads that many more bytes into &queue->pdu + queue->offset, without ever b…

nvdcriticovulnerabilidad CVSS 9.8 NVD