Alertas de Seguridad de la Información

M Alto vulnerabilidad

24/09/2026

[CVE-2026-94606] authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik …

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An actor who knows a target user's password can substitute an attacker-controlled address, receive the on…

nvdaltovulnerabilidad CVSS 8.9 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-94609] authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account…

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate those privileges. Group hierarchy checks do not consistently account for superuser status inherited from …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-94611] authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik …

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets. Affected configurations include one-time code delivery by mail or SMS, outbound provisioning targets, …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-94612] authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authent…

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that Source. The SAML Source also does not record already accepted assertions, allowing replay. An unauthent…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-94613] authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthe…

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling /application/saml/* or /source/saml/*, causing the requests assigned to that worker to fail. Worker process termin…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93826] In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF i…

In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF in hidpp_connect_event() If input_register_device() fails, we call input_free_device(), but keep stale pointer to the old device in hidpp->input, which could potentially lead to UAF. Fix that by resetting it to NULL before returning from hidpp_connect_event().

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93827] In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on…

In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling virtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both pointers and returns an error to virtio_fs_probe(). virtio_fs_probe() then drops the last kobject reference, and virtio_fs_ktype_releas…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93830] In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac2: disable RB…

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac2: disable RBUE in default RX interrupt mask Enabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive and can trigger a MAC interrupt storm under heavy RX pressure. When the DMA runs out of RX descriptors it fires RBUE continuously until software refills the ring. However, RBUE is redundant: th…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93816] In the Linux kernel, the following vulnerability has been resolved: f2fs: validate inline dentry na…

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate inline dentry name lengths before conversion Inline dentry conversion copies names out of the inline dentry area before checking that each recorded name length fits in the available filename slots. A corrupted image can therefore make the conversion path read past the inline filename storage while building the re…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93817] In the Linux kernel, the following vulnerability has been resolved: perf: Fix addr_filter_ranges li…

In the Linux kernel, the following vulnerability has been resolved: perf: Fix addr_filter_ranges lifetime Lee Jia Jie reported that since event::addr_filter_ranges is used under RCU, it should be RCU freed.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93810] In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double fput Fi…

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double fput Fix a double fput() in error handling in cachefiles_create_tmpfile().

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93813] In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate I…

In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate INODE_REF's namelen [BUG] A crafted btrfs image can trigger the following crash: BUG: unable to handle page fault for address: ffffd1dc42884000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page CPU: 9 UID: 0 PID: 1034 Comm: poc Not tainted 7.1.0-rc4-cust…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93801] In the Linux kernel, the following vulnerability has been resolved: smb/client: zero-initialize sta…

In the Linux kernel, the following vulnerability has been resolved: smb/client: zero-initialize stack-allocated cifs_open_info_data Stack-allocated cifs_open_info_data may contain random data. This can make some fields have wrong value if they are not set later.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93806] In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate assoc …

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate assoc response length before status and IE access cfg80211_rx_assoc_resp() initialises the status and response-IE fields of cfg80211_connect_resp_params from the management frame before proving that the frame is long enough for those offsets. S1G and regular association responses also have different IE o…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93793] In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate TX…

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate TX_CMD response layout TX_CMD parsing uses frame_count to walk status entries and then read the trailing SCD SSN. Make the minimum-length check follow that exact runtime layout calculation before parsing the payload. For new TX API, reject TX_CMD responses with frame_count != 1 and warn/return in th…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93796] In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: null RX po…

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: null RX pointers after free When iwl_pcie_tx_init() fails after RX init, nic init unwinds via iwl_pcie_rx_free(). The freed RX members stayed non-NULL on the live transport object, so later teardown or retry could touch stale RX state. Set rx_pool, global_table, rxq, and alloc_page to NULL after free to mak…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93798] In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reloc root cleanup i…

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reloc root cleanup in merge_reloc_roots() If the root we got has zero root refs in its root item, we are resetting the root's ->reloc_root without using barriers like we do everywhere else. Sashiko complained about this while reviewing another patch, and it's correct (see the Link tag below). Also, we should not clea…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93799] In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate st…

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate sta_id in BA window status notif BA_WINDOW_STATUS_NOTIFICATION_ID extracts a 5-bit sta_id from the firmware notification and uses it to index fw_id_to_mac_id[] without bounds checking. Validate sta_id before array access to prevent out-of-bounds indexing.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93786] In the Linux kernel, the following vulnerability has been resolved: ksmbd: preserve VFS inherited P…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: preserve VFS inherited POSIX ACL mask The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and default ACLs afterwards. This preserves restrictive ACL_MASK entries and prevents SMB object creation f…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93787] In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name …

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifs_filldir cifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST / FIND_NEXT response using a length (de.namelen) supplied by the server. The kmalloc'd SMB response buffer is bounded, but nothing checks that de.name + de.namelen still lies inside tha…

nvdaltovulnerabilidad CVSS 8.1 NVD