Alertas de Seguridad de la Información

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63919] In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during …

In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must stay valid until the deferred callback runs. Take a netns reference when queueing deferred reinjection work and drop it after the callbac…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63920] In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header…

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting the on-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length. The length was validated only at parse time (ipv6_parse_hopopts(), …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63921] In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vt…

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) for the collision lookup. For a tunnel moved through IFLA_NET_NS_FD, dev_net(dev) is the new netns, not t->net. SIOCCHGTUNNEL on a migrate…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63922] In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after…

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6_dest_hao() returns so any trailing pa…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63923] In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pci…

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/ octeontx2/af/rvu_rep.c queues a sender-controlled REP_EVENT_NOTIFY request body verbatim, and rvu_rep_up_notify() then forwards event->pcifunc (the nested body field, distinct from the AF-…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63924] In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh point…

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess things up.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63925] In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection a…

In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If next_pn_halves.lower is also in the upper half, pn_same_half(pn, lower) is true and the XPN else-if does not fire either, leaving next_pn_halves unchanged. An attacker th…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63926] In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment…

In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data When bpf_msg_push_data() inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment. The right fragment offset is page-local, but the code advances it with `start`, which is the message-global insertion poi…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63912] In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined sin…

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate currently checks skb->data_len and tailen separately, but the tail code allocates a single destination frag from the combined…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63913] In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do n…

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ ca…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63914] In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notificatio…

In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate() in net/key/af_key.c both hardcode &init_net for the multicast that announces a successful XFRM_MSG_MIGRATE / SADB_X_MIGRATE. XFRM_MSG_MIGRATE arrives on a per-netns NETLINK_XFRM socket, and the rest of the xf…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63915] In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds rea…

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfc_hci_recv_from_llc() and nci_hci_data_received_cb() read packet->header from skb->data at function entry without first checking that the buffer holds at least one byte. A malicious NFC peer can send a 0-byte HCP frame that passes through the SHDLC layer and reaches t…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63916] In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wa…

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacom_hid_set_device_mode() wacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE usage is always located in the first field (field[0]) of the feature report. However, a device can specify HID_DG_INPUTMODE in a different field. If HID_DG_INPUTMODE is in a field other than the first…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63917] In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vt…

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9 ip netns del ns2 ip netns del ns1 [ 132.495484] ------------[ cut here ]----…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63918] In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcount_inc_not_zero…

In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname A reader in l2tp_session_get_by_ifname() can return a pointer to a session whose refcount has reached zero. The getter takes its reference with plain refcount_inc(), but every other session getter in the same file (l2tp_v2_session_get, l2tp_v3_session_get, and the cor…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63906] In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-af…

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in omap2430_probe() In omap2430_probe(), of_node_put(np) is called prematurely before the last access to np, leading to a use-after-free if the node's reference count drops to zero. Move the of_node_put() calls after the last use of np in both the success and error paths.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63909] In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in s…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops Commit d07b26f39246 ("ksmbd: require minimum ACE size in smb_check_perm_dacl()") introduced a transposed bounds check: if (offsetof(struct smb_ace, sid) + aces_size < CIFS_SID_BASE_SIZE) Since offsetof(..sid) is 8 and CIFS_SID_BASE_SIZE is 8, this evaluates…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63910] In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dma_buf_fd(…

In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dma_buf_fd() tracepoint Once FD_ADD() returns, the fd is live in the file descriptor table and a thread sharing that table can close() it before DMA_BUF_TRACE() runs. The close drops the last reference, __fput() frees the dma_buf, and the tracepoint then dereferences dmabuf to take dmabuf->name_lock -- slab-u…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63911] In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: reset runtime stat…

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: reset runtime state when cloning SAs iptfs_clone_state() clones the IPTFS mode data with kmemdup(). This copies runtime objects which must not be shared with the original SA, including the embedded sk_buff_head, hrtimers, spinlock, and in-flight reassembly/reorder state. If xfrm_state_migrate() fails after clone_st…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63889] In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen …

In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the generic FC transport. This is not a local userspace or IP network path; the attacker must be able to inject fabric traffic…

nvdaltovulnerabilidad CVSS 8.1 NVD