Alertas de Seguridad de la Información

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97451] In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in…

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy().

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97452] In the Linux kernel, the following vulnerability has been resolved: ACPICA: Prevent adding invalid …

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Prevent adding invalid references Prevent adding references for local, argument, and debug objects in acpi_ut_copy_simple_object().

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97454] In the Linux kernel, the following vulnerability has been resolved: ACPICA: add boundary checks in …

In the Linux kernel, the following vulnerability has been resolved: ACPICA: add boundary checks in acpi_ps_get_next_field() Add boundary checks in acpi_ps_get_next_field() to prevent out-of-bounds access.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97455] In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in a…

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() Fix use-after-free issue in acpi_ds_terminate_control_method() by clearing references to method locals and arguments.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97442] In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix invalid data …

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields in the header within the ath11k_dp_rx_h_undecap_nwifi() function for the DP_RX_DECAP_TYPE_NATIVE…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97444] In the Linux kernel, the following vulnerability has been resolved: ACPICA: add boundary checks in …

In the Linux kernel, the following vulnerability has been resolved: ACPICA: add boundary checks in two places Add boundary checks in acpi_ps_get_next_namestring() and acpi_ps_peek_opcode() to prevent out-of-bounds access.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97445] In the Linux kernel, the following vulnerability has been resolved: ACPICA: Enhance buffer validati…

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() Enhance buffer validation in acpi_ut_walk_aml_resources() to prevent buffer overflows.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97433] In the Linux kernel, the following vulnerability has been resolved: nvme: validate FDP configuratio…

In the Linux kernel, the following vulnerability has been resolved: nvme: validate FDP configuration descriptor sizes Validate descriptor sizes while walking the FDP configurations log so dsze == 0 or a descriptor past the log end cannot cause unbounded iteration or reads past the buffer.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97437] In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read i…

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() The bounds check in ntfs_dir_emit() compares fname->name_len (a character count) against e->size (a byte count) without accounting for the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME header size: if (fname->name_len + sizeof(struct NTFS_DE) > l…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97438] In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate index entry …

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate index entry key bounds [BUG] A malformed NTFS directory index entry can advertise a key_size larger than the bytes actually present in its NTFS_DE payload. Directory lookup then passes that malformed key to cmp_fnames(), which can read past the end of the kmalloc'ed index buffer. BUG: KASAN: slab-out-of-bound…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97428] In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA pars…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with fru_pia_advance() and fru_pia_copy_field() helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on truncated or malformed FRU data.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97429] In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix UAF race in des…

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix UAF race in destroy_queue_cpsch wait_on_destroy_queue() drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use is_being_destroyed flag to serialize destruction.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97415] In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate n…

In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF ROOT_REF and ROOT_BACKREF items contain a struct btrfs_root_ref followed by the subvolume name. Several readers assume that this layout is already valid and then use the on-disk name length directly. A corrupted item can therefore make those readers address bytes o…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97417] In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: use ge…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() The timestamp-only fast path dereferences the option stream as *(__be32 *)ptr, which assumes 4-byte alignment that the TCP option stream does not guarantee. Use get_unaligned_be32() instead, which reads the value safely and already returns host byte order, so the ht…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97421] In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Be careful about bou…

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() Several corner cases, especially important on 32 bits: - umem->iova is u64, the function argument should pass in u64 or iova will be truncated - Check that the length is not too large for the iova - Check that lengths > 4G don't overflow the GENMASK

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97409] In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not cancel requests…

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: Do not cancel requests in io target before it is initialized A new nvme-fc controller in CONNECTING state sees admin request timeout schedules ctrl->ioerr_work to abort inflight requests. This ends up calling __nvme_fc_abort_outstanding_ios() which aborts requests in both admin and io tagsets. In case fc_ctrl->tag_set w…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

24/09/2026

[CVE-2026-97413] In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer unde…

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in process_read and process_write usr_len is read from a network-supplied message field (le16_to_cpu) and used to compute data_len = off - usr_len without validating that usr_len off causing an integer underflow, resulting in data_len wrappin…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93826] In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF i…

In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF in hidpp_connect_event() If input_register_device() fails, we call input_free_device(), but keep stale pointer to the old device in hidpp->input, which could potentially lead to UAF. Fix that by resetting it to NULL before returning from hidpp_connect_event().

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93827] In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on…

In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling virtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both pointers and returns an error to virtio_fs_probe(). virtio_fs_probe() then drops the last kobject reference, and virtio_fs_ktype_releas…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93830] In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac2: disable RB…

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac2: disable RBUE in default RX interrupt mask Enabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive and can trigger a MAC interrupt storm under heavy RX pressure. When the DMA runs out of RX descriptors it fires RBUE continuously until software refills the ring. However, RBUE is redundant: th…

nvdaltovulnerabilidad CVSS 7.5 NVD