Alertas de Seguridad de la Información

G Alto vulnerabilidad

20/07/2026

[CVE-2026-15904] Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker …

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-64191] In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block tra…

In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avoid overrunning the chip->words[256] register array, but does not validate it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the un…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-64206] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pendin…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock l2cap_conn_del() takes conn->lock and then calls cancel_work_sync() for pending_rx_work. process_pending_rx() takes the same mutex, so teardown can deadlock against the worker it is flushing. This issue was found by our static analysis tool and then manually rev…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-64188] In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpo…

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() rmnet_dellink() removes the endpoint from the hash table with hlist_del_init_rcu() and then immediately frees it with kfree(). However, RCU readers on the receive path (rmnet_rx_handler -> __rmnet_map_ingress_handler) may still hold a reference to the endpoint …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-64189] In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race betw…

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the array pointer. These run from netlink_recvmsg() without the nfnl mutex and without an RCU read-side critical section. A …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64178] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read o…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev->name bnep_add_connection() needs to keep holding the bnep_session_sem while reading dev->name (just like bnep_get_connlist() does); otherwise the bnep_session() thread can concurrently free the net_device, which can for example be triggered by a concurrent bnep_del_connection(). (This UAF i…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64181] In the Linux kernel, the following vulnerability has been resolved: mm: fix __vm_normal_page() to h…

In the Linux kernel, the following vulnerability has been resolved: mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special() On x86 32-bit with THP enabled, zap_huge_pmd() is seen to generate a "WARNING: mm/memory.c:735 at __vm_normal_page+0x6a/0x7d", from the VM_WARN_ON_ONCE(is_zero_pfn(pfn) || is_huge_zero_pfn(pfn)); followed by "BUG: Bad rss-counter state"s, then l…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64172] In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Disable AVIC IPI virt…

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235) Hygon Family 18h CPUs are derived from AMD Family 17h (Zen1) silicon and share the same erratum #1235: hardware may read a stale IsRunning=1 bit during ICR write emulation and silently fail to generate an AVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit on …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64175] In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX dur…

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart to true. However, iwl_mld_tx_from_txq() does not check this flag before dequeuing frames from mac80211 and pushing them to the transport lay…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64176] In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-…

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but rather their PLCP value (e.g. 10 for 1 Mbps CCK rate.) While introducing v3 rates, I changed the driver from internally handling v1 rates a…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64151] In the Linux kernel, the following vulnerability has been resolved: iommupt: Check for missing PAGE…

In the Linux kernel, the following vulnerability has been resolved: iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap Sashiko pointed out that the driver could drop PAGE_SIZE from the pgsize_bitmap. That is technically allowed but nothing does it, and such an iommu_domain would not be used with the DMA API today. Still, it is against the design and it is trivial to fix up. Lift the PT_W…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64152] In the Linux kernel, the following vulnerability has been resolved: iommu: Handle unmap error when …

In the Linux kernel, the following vulnerability has been resolved: iommu: Handle unmap error when iommu_debug is enabled Sashiko noticed a latent bug where the map error flow called iommu_unmap() which calls iommu_debug_unmap_begin()/iommu_debug_unmap_end() however since this is an error path the map flow never actually established the original iommu_debug_map() it will malfunction. Lift the u…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64153] In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix iommu_map_sgtable(…

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN Commit "iommu: return full error code from iommu_map_sg[_atomic]()" changed iommu_map_sgtable() to return an ssize_t and negative values in error cases, rather than a size_t and a zero. Store the return value in the appropriate type and in case of error, return …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64158] In the Linux kernel, the following vulnerability has been resolved: netfs: Fix write streaming disa…

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix write streaming disablement if fd open O_RDWR In netfs_perform_write(), "write streaming" (the caching of dirty data in dirty but !uptodate folios) is performed to avoid the need to read data that is just going to get immediately overwritten. However, this is/will be disabled in three circumstances: if the fd is open…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64148] In the Linux kernel, the following vulnerability has been resolved: pds_core: fix error handling in…

In the Linux kernel, the following vulnerability has been resolved: pds_core: fix error handling in pdsc_devcmd_wait Fix two cases where pdsc_devcmd_wait() returns stale success from the completion register instead of an error: 1. FW crash: If firmware stops running, the wait loop breaks early with running=false. The condition "if ((!done || timeout) && running)" is false, so error handli…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64133] In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fix potential OOB…

In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fix potential OOB array access at reading cache find_control() to retrieve a cached info accesses the array with the given index blindly, which may lead to an OOB array access. Add a sanity check for avoiding it.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64134] In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Don't setup bogus io…

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Don't setup bogus iov_iter for silencing At transition to the iov_iter for PCM data transfer, we blindly applied the iov_iter setup also for silencing (i.e. data = NULL), and it leads to a calculation of bogus iov_iter. Fortunately this didn't cause troubles on most of architectures but it goes wrong on RISC-V now, c…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64137] In the Linux kernel, the following vulnerability has been resolved: smb: client: require net admin …

In the Linux kernel, the following vulnerability has been resolved: smb: client: require net admin for CIFS SWN netlink CIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The intended sender is the cifs.witness helper, but the generic-netlink operation currently has no capability flag, so any local process can send RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel wit…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64138] In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent s…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smb_validate_ntsd_sid() helper to safely validate Owner SID and Group SID inside the NT Security Descriptor (smb_ntsd) retrieved from the parent directory.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64140] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer derefer…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in proc_show_files() When a SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSION_LOGOFF, session_fd_check() clears fp->tcon = NULL on the reconnectable file pointer but leaves the fp registered in global_ft.idr until the durable scavenger fires (up to fp->durable_time…

nvdaltovulnerabilidad CVSS 7.5 NVD