Alertas de Seguridad de la Información

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53162] In the Linux kernel, the following vulnerability has been resolved: memcg: use round-robin victim s…

In the Linux kernel, the following vulnerability has been resolved: memcg: use round-robin victim selection in refill_stock Harry Yoo reported that get_random_u32_below() is not safe to call in the nmi context and memcg charge draining can happen in nmi context. More specifically get_random_u32_below() is neither reentrant- nor NMI-safe: it acquires a per-cpu local_lock via local_lock_irqsave()…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53165] In the Linux kernel, the following vulnerability has been resolved: iomap: avoid potential null fol…

In the Linux kernel, the following vulnerability has been resolved: iomap: avoid potential null folio->mapping deref during error reporting When a buffered read fails, iomap_finish_folio_read() reports the error with fserror_report_io(folio->mapping->host, ...). This is called after ifs->read_bytes_pending has been decremented by the bytes attempted to be read. For a folio split across multiple…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53147] In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain r…

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter t…

nvdaltovulnerabilidad CVSS 8.1 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53148] In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain resp…

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_request() derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A malicious peer can set its length field larger than the declared data_length, causing memcpy to write p…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53149] In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directo…

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size __tb_property_parse_dir() does not check that content_offset + content_len fits within block_len for the root directory case. When rootdir->length equals or exceeds block_len - 2, the entry loop reads past the allocated property block. Add a bounds check after computing co…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53151] In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to ex…

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents o…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53156] In the Linux kernel, the following vulnerability has been resolved: nvmem: core: fix use-after-free…

In the Linux kernel, the following vulnerability has been resolved: nvmem: core: fix use-after-free bugs in error paths Fix several instances of error paths in which we call __nvmem_device_put() - which may end up freeing the underlying memory and other resources - and then keep on using the nvmem structure. Always put the reference to the nvmem device as the last step before returning the error…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53137] In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp HDMI HDC…

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size [Why & How] During HDCP 2.x repeater authentication over HDMI, the driver reads the sink's RxStatus register and extracts a 10-bit message size field (max value 1023). This value is used as the read length for the ReceiverID list without being clamped to the size o…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53138] In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Bound VBIOS re…

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Bound VBIOS record-chain walk loops [Why & How] All record-chain walk loops in bios_parser.c and bios_parser2.c use for(;;) and only terminate on a 0xFF record_type sentinel or zero record_size. A malformed VBIOS image missing the terminator record causes unbounded iteration at probe time, potentially hundreds o…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53143] In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow…

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions use sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct v11_sdma_mqd) (512 bytes), causing a 1536-…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53146] In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain resp…

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain response copy to actual frame size tb_xdomain_copy() copies req->response_size bytes from the received packet buffer regardless of the actual frame size. When a short response arrives, this reads past the valid frame data in the DMA pool buffer into stale contents from previous transactions. Use the …

nvdaltovulnerabilidad CVSS 7.1 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53131] In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC…

In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb…

nvdcriticovulnerabilidad CVSS 9.4 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53132] In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential unb…

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential unbounded skb queue virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc. virtio_transport_recv_enqueue() skips coalescing for packets with VIRTIO_VSOCK_SEQ_EOM. If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM, a very large number of packets can be queued because vvs-…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53133] In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix truncation for b…

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix truncation for block sizes >= 4G When the iommu is used the linearization of the mapping can give a single block that is very large split across multiple SG entries. When __rdma_block_iter_next() reassembles the split SG entries it is overflowing the 32 bit stack values and computed the wrong DMA addresses for bl…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53136] In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp VBIOS HD…

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size [Why & How] The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and Hdmi6GRegNum fields that are used as loop bounds when copying retimer I2C register settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9] and dp*_ext_hdmi_6g_reg_setti…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53129] In the Linux kernel, the following vulnerability has been resolved: fs/mbcache: cancel shrink work …

In the Linux kernel, the following vulnerability has been resolved: fs/mbcache: cancel shrink work before destroying the cache mb_cache_destroy() calls shrinker_free() and then frees all cache entries and the cache itself, but it does not cancel the pending c_shrink_work work item first. If mb_cache_entry_create() schedules c_shrink_work via schedule_work() and the work item is still pending or…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53130] In the Linux kernel, the following vulnerability has been resolved: fs/omfs: reject s_sys_blocksize…

In the Linux kernel, the following vulnerability has been resolved: fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE), but it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440). Later, omfs_make_empty() uses sbi->s_sys_blocksize - OMFS_DIR_START as the length argument to memset(). Since s_sys…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53117] In the Linux kernel, the following vulnerability has been resolved: s390/cio: use generic driver_ov…

In the Linux kernel, the following vulnerability has been resolved: s390/cio: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53118] In the Linux kernel, the following vulnerability has been resolved: vdpa: use generic driver_overri…

In the Linux kernel, the following vulnerability has been resolved: vdpa: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of pro…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53119] In the Linux kernel, the following vulnerability has been resolved: platform/wmi: use generic drive…

In the Linux kernel, the following vulnerability has been resolved: platform/wmi: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking car…

nvdaltovulnerabilidad CVSS 7.8 NVD