Alertas de Seguridad de la Información

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46328] In the Linux kernel, the following vulnerability has been resolved: apparmor: fix rlimit for posix …

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix rlimit for posix cpu timers Posix cpu timers requires an additional step beyond setting the rlimit. Refactor the code so its clear when what code is setting the limit and conditionally update the posix cpu timers when appropriate.

nvdaltovulnerabilidad CVSS 7.3 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46330] In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP …

In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The implementation attempts to convert an active TCP socket into an SMC socket by modifying the underlying `struct file`, dentry, and inode in-pla…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46332] In the Linux kernel, the following vulnerability has been resolved: greybus: gb-beagleplay: bound b…

In the Linux kernel, the following vulnerability has been resolved: greybus: gb-beagleplay: bound bootloader receive buffering cc1352_bootloader_rx() appends each serdev chunk into the fixed rx_buffer before parsing bootloader packets. The helper can keep leftover bytes between callbacks and may receive multiple packets in one callback, so a single count value is not constrained by one packet le…

nvdaltovulnerabilidad CVSS 8.0 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46317] In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign nested_mmu…

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign nested_mmus array behind mmu_lock kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which can run at any time. kvm_vcpu_init_nested() reallocates the array and frees the old buffer while holding only kvm->arch.config_…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46319] In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release…

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in act_ct in tcf_ct_flow_table_get(), rhashtable_lookup_fast() internally opens and closes an RCU read critical section before returning ct_ft. The tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero() is invoked on the …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46320] In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths i…

In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value an…

nvdaltovulnerabilidad CVSS 7.4 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46321] In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame r…

In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without freeing the page that vhost_net_build_xdp() allocated for it. tun_sendmsg() discards that -EINVAL and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page; each s…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46322] In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb fai…

In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhost_net_build_xdp() allocated for the frame. As with the short-frame rejection path, tun_sendmsg() discards the per-buffer error …

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46323] In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skb…

In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to anoth…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46324] In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: use list_…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: use list_del_rcu for netlink hooks nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks need to use list_del_rcu(), this list can be walked by concurrent dumpers. Add a new helper and use it consistently.

nvdaltovulnerabilidad CVSS 7.8 NVD

L Crítico vulnerabilidad

09/06/2026

[CVE-2026-46316] In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the …

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's reference on each entry with vgic_put_irq(). It puts the iterated pointer, though, rather than the value returned by xa_erase(). The functi…

nvdcriticovulnerabilidad CVSS 9.3 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46311] In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly. This fixes the security issue of unmap the wptr_obj while a queue creation is in progress and passing other bo at same address. (cherry picked from commit 1fc6c8ab45dbee096469c0…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46304] In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq…

In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the final controller reference through nvmet_cq_put(). If that triggers nvmet_ctrl_free(), the teardown path flushes ctrl->async_event_work on the same nvmet-wq. Call chain: nvmet_tcp_schedule_release_queue() …

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46306] In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect …

In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the flow dissector driver has assumed an uncompressed frame until the blamed commit. During the review process o…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46307] In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access arra…

In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > shown by the UBSAN kernel message: > UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20 > index 4 is out of range for type 'ieee80211_tx_rate [4]' > ... > Call Trace: >

nvdaltovulnerabilidad CVSS 8.3 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46308] In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix use-aft…

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() In scpsys_get_bus_protection_legacy(), of_find_node_with_property() returns a device node with its reference count incremented. The function then calls of_node_put(node) before checking whether syscon_regmap_lookup_by_phandle() returns an error. If an e…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46309] In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PA…

In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Add validation in xe_vm_madvise_ioctl() to reject PAT indices with XE_COH_NONE coherency mode when applied to CPU cached memory. Using coh_none with CPU cached buffers is a security issue. When the kernel clears pages before reallocation, the clear operatio…

nvdaltovulnerabilidad CVSS 7.0 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46299] In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix held lock freed on…

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix held lock freed on hfsplus_fill_super() hfsplus_fill_super() calls hfs_find_init() to initialize a search structure, which acquires tree->tree_lock. If the subsequent call to hfsplus_cat_build_key() fails, the function jumps to the out_put_root error label without releasing the lock. The later cleanup path then free…

nvdaltovulnerabilidad CVSS 7.0 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46301] In the Linux kernel, the following vulnerability has been resolved: spi: topcliff-pch: fix use-afte…

In the Linux kernel, the following vulnerability has been resolved: spi: topcliff-pch: fix use-after-free on unbind Give the driver a chance to flush its queue before releasing the DMA buffers on driver unbind

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46303] In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE c…

In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added c…

nvdaltovulnerabilidad CVSS 8.2 NVD