Alertas de Seguridad de la Información

L Alto vulnerabilidad

19/07/2026

[CVE-2026-63803] In the Linux kernel, the following vulnerability has been resolved: hdlc_ppp: sync per-proto timers…

In the Linux kernel, the following vulnerability has been resolved: hdlc_ppp: sync per-proto timers before freeing hdlc state Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp registers a timer via timer_setup(). That struct ppp is the hdlc->state allocation, which detach_hdlc_protocol() frees with kfree() in both teardown paths: unregister_hdlc_device() and the re-attach inside…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Crítico vulnerabilidad

19/07/2026

[CVE-2026-53399] In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on se…

In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid directly with kmem_cache_free() without ever calling i…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53400] In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registra…

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2c_get_adapter() which takes a reference to the embedded struct device. Make sure that the adapter (including its struct device) has been initialised before adding it to the IDR to avoid accessing uninitialised data which could, for exam…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53401] In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-fre…

In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfb_mmap omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that can lead to use-after-free: The fb_mmap() entry point holds mm_lock but not lock (fb_info->lock), while ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_lock. This allows concurrent execution. In oma…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53402] In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: fix out-of-bounds…

In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() When fbcon_do_set_font() fails (e.g., due to a memory allocation failure inside vc_resize() under heavy memory pressure), it jumps to the `err_out` label to roll back the console state. However, the current rollback logic forgets to restore the `hi_font` stat…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-63793] In the Linux kernel, the following vulnerability has been resolved: ntfs: serialize volume label ac…

In the Linux kernel, the following vulnerability has been resolved: ntfs: serialize volume label accesses Protect vol->volume_label with a mutex and snaphost the label before copy_to_user. This prevent a use-after-free when FS_IOC_SETFSLABEL replaces the vol->volume_label and FS_IOC_GETTSLABEL reads it concurrently.

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-63794] In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in …

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path In sev_dbg_crypt(), the per-iteration transfer length is bounded by the source page offset (PAGE_SIZE - s_off) but not by the destination page offset (PAGE_SIZE - d_off). When d_off > s_off, the encrypt path (__sev_dbg_encrypt_user) performs a read-modify-write usi…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Crítico vulnerabilidad

19/07/2026

[CVE-2026-63795] In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_…

In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_client_walk() error path When p9_client_walk() is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunk_fid, which currently calls p9_fid_put(fid) unconditionally. This drops a reference to oldfid even thou…

nvdcriticovulnerabilidad CVSS 10.0 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53390] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds read i…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds read in smb_check_perm_dacl() The permission-check ACE walk in smb_check_perm_dacl() validates the ACE header size and caps sid.num_subauth at SID_MAX_SUB_AUTHORITIES, but it never checks that ace->size is actually large enough to contain num_subauth sub-authorities before compare_sids() dereferences the…

nvdaltovulnerabilidad CVSS 8.1 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53391] In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length …

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr nfs4_decode_mp_ds_addr() decodes the r_netid and r_addr opaques of a netaddr4 from a GETDEVICEINFO multipath-DS body, then immediately calls strrchr(buf, '.') to locate the port separator. Both decodes use xdr_stream_decode_string_dup(), and the current code checks …

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53392] In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero fi…

In the Linux kernel, the following vulnerability has been resolved: NFSv4/flexfiles: reject zero filehandle version count ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL. A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even t…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53394] In the Linux kernel, the following vulnerability has been resolved: nfsd: avoid leaking pre-allocat…

In the Linux kernel, the following vulnerability has been resolved: nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race When find_or_alloc_open_stateowner() encounters an unconfirmed owner, it calls release_openowner() and sets oo = NULL. Control then falls through past the `if (oo)` guard -- which would have freed any pre-allocated `new` -- and unconditionally executes `new = …

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53395] In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict gua…

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix dead ACL conflict guard in nfsd4_create nfsd4_create() steals create->cr_dpacl/cr_pacl into the local nfsd_attrs via the designated initializer, then immediately sets the source pointers to NULL. The subsequent conflict guard tests the already-nilled source fields, making it permanently dead code: if (create->cr_a…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53396] In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak and ig…

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak and ignored error in nfsd4_create_file nfsd4_create_file() has two bugs in its ACL handling: The return value of nfsd4_acl_to_attr() is silently discarded. When the NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for unsupported ACE types), the file is created without any ACL and the client receives…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53397] In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak on SET…

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak on SETACL decode failure nfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each call nfs_stream_decode_acl() twice, first for NFS_ACL and then for NFS_DFACL. Each successful call transfers ownership of a freshly allocated posix_acl into argp->acl_access or argp->acl_default. If the first ca…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Crítico vulnerabilidad

19/07/2026

[CVE-2026-53398] In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decod…

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix SECINFO_NO_NAME decode error cleanup nfsd4_decode_secinfo_no_name() currently initializes sin_exp after decoding sin_style. If the XDR stream is truncated, the decoder returns nfserr_bad_xdr before sin_exp is initialized. Since commit 3fdc54646234 ("NFSD: Reduce amount of struct nfsd4_compoundargs that needs clearing"…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53383] In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2_…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Crítico vulnerabilidad

19/07/2026

[CVE-2026-53384] In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dw: unregister 825…

In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails dw8250_probe() registers the 8250 port via serial8250_register_8250_port() and then, if the device has a clock, registers a clock notifier. If clk_notifier_register() fails, probe returns the error but leaves the 8250 port registered. The matching serial8250_…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53386] In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: add bound…

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: add bounds check to pga_settings index ads1298_pga_settings has 7 elements but ADS1298_MASK_CH_PGA can yield values 0-7. If it yields a value >= 7, this causes an out-of-bounds array access. Add a bounds check and return -EINVAL if the index is out of range. Note that the remaining value b111 is reserved s…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53387] In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6075: add bound…

In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6075: add bounds check to veml6075_it_ms index veml6075_it_ms has 5 elements but VEML6075_CONF_IT can yield values 0-7. If it returns a value >= 5, this causes an out-of-bounds array access. Add a bounds check and return -EINVAL if the index is out of range. The problem values are reserved so should never be rea…

nvdaltovulnerabilidad CVSS 7.1 NVD