Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64444] In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB rea…

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each iteration but only guards on i < pkt_len. When a malicious AP sends an AssocResponse whose last IE has only one byte remaining in the frame (the element_id byte lands at pkt_len-1), the loop reads pIE->…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64445] In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP len…

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() OnAuth() has two bugs in the shared-key authentication path. When the Privacy bit is set, rtw_wep_decrypt() is called without verifying that the frame is long enough to contain a valid WEP IV and ICV. Inside rtw_wep_decrypt(), length is computed as: len…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64447] In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix doubl…

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7_isys_init() and ipu7_psys_init(), pdata is allocated and then passed to ipu7_bus_initialize_device(), which stores it in adev->pdata. The ipu7_bus_release() function frees adev->pdata when the device's reference count drops to zero. Two error p…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64448] In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied b…

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc[0] exemption to responses without data area smb2_check_message() has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received ("server can return one byte more due to implied bcc[0]"). This was introduced to accommodate servers tha…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64449] In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave …

In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy 'count' bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without bounding *ppos + count against size_buf. vme_user_write()/vme_user…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-64450] In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in…

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its data area. tipc_get_gap_ack_blks() only verifies that the record's len field is self-consistent with its ugack_cnt/bgack_cnt counts (sz == struct_size(p, gacks, ugack_cnt + bgack_cnt)); it does not che…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64436] In the Linux kernel, the following vulnerability has been resolved: net: af_key: initialize alg_key…

In the Linux kernel, the following vulnerability has been resolved: net: af_key: initialize alg_key_len for IPComp states pfkey_msg2xfrm_state() handles the IPComp (SADB_X_SATYPE_IPCOMP) case by allocating x->calg and copying only the algorithm name: x->calg = kmalloc_obj(*x->calg); if (!x->calg) { err = -ENOMEM; goto out; } strcpy(x->calg->alg_name, a->name); x->props.calgo = sa->sadb…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64437] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a …

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL Commit f580d27e8928 ("ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL") made smb2_cancel() skip a work whose state is KSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But KSMBD_WORK has three states (ACTI…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64438] In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work te…

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state (struct adf_accel_vf_info). Currently, adf_disable_sriov() destroys per-VF mutexes and frees vf_info without stopping new VF2PF work or waiting for in-flight workers…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-64439] In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async…

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and rfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL completion callback and treat any negative return from crypto_aead_{encrypt,decrypt}() as terminal, falling through to kfree_sensitiv…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64440] In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB wri…

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HT_caps_handler() HT_caps_handler() iterates pIE->length bytes and writes into HT_caps.u.HT_cap[], which is a fixed 26-byte array (sizeof struct HT_caps_element). Because pIE->length is a raw u8 from an over-the-air 802.11 AssocResponse frame and is never validated, a malicious AP can set it …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64441] In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB rea…

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() Three IE/attribute parsing functions have missing bounds checks. rtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer without verifying that the header bytes (tag + length) are within the remaining buffer before readi…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64442] In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB rea…

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Two IE parsing loops are missing the header bounds checks before they dereference pIE->length: - issue_assocreq() walks pmlmeinfo->network.ies to build the association request. If the stored IE data ends with only an element_id byte and …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64443] In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB rea…

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The IE parsing loop in update_beacon_info() advances by (pIE->length + 2) each iteration but only guards on i < len. When a malicious AP sends a Beacon whose last IE has only one byte remaining in the frame (the element_id byte lands at len-1), the loop reads pIE->…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64430] In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid calling pci_irq…

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid calling pci_irq_vector() from hardirq context ntb_epf_vec_isr() calls pci_irq_vector() in hardirq context to derive the vector number. pci_irq_vector() calls msi_get_virq() that takes a mutex and can therefore trigger "scheduling while atomic" splats: BUG: scheduling while atomic: kworker/u33:0/55/0x00010001 …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64431] In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling post_write_…

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling post_write_mst_fixup() for invalid index_block ntfs_icx_ib_sync_write() calls post_write_mst_fixup() when ntfs_ib_write() returns an error, intending to restore the buffer after a failed write. However, ntfs_ib_write() returns an error immediately if pre_write_mst_fixup() validation fails. The caller, ntfs_i…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64432] In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page T…

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns In the analysis pass of $LogFile journal replay, log_replay() copies LCNs from each action log record into an existing Dirty Page Table (DPT) entry without bounding the destination index. A crafted NTFS image with DPT entry lcns_follow=1 and an action log recor…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64434] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in ch…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref l2cap_chan_timeout() runs asynchronously and accesses chan->conn. If the connection is torn down while the timer is running or pending, chan->conn can be freed, leading to a use-after-free when the timer worker attempts to lock conn->lock: | BUG: KASAN: slab-use-a…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64435] In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skb_qu…

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skb_queue_len() readers on audit_queue Multiple readers access audit_queue.qlen via skb_queue_len() without holding the queue lock or using READ_ONCE(), while kauditd writes to this field via the skb_dequeue() → __skb_unlink() path with WRITE_ONCE() protected by a spinlock. This constitutes data races. …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64422] In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering…

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid `net.ipv4.tcp_reordering` values before they reach TCP socket state. The sysctl is stored as an `int` but copied into the `u32` `tp->reordering` field for new sockets, so negative writes wrap to large values. With `tcp_mtu_probing=2`, the wrapped v…

nvdaltovulnerabilidad CVSS 7.1 NVD