Alertas de Seguridad de la Información

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46288] In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix use-after-fre…

In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix use-after-free in of_unittest_changeset() The variable 'parent' is assigned the value of 'nchangeset' earlier in the function, meaning both point to the same struct device_node. The call to of_node_put(nchangeset) can decrement the reference count to zero and free the node if there are no other holders. After t…

nvdaltovulnerabilidad CVSS 8.4 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46277] In the Linux kernel, the following vulnerability has been resolved: mm/zone_device: do not touch de…

In the Linux kernel, the following vulnerability has been resolved: mm/zone_device: do not touch device folio after calling ->folio_free() The contents of a device folio can immediately change after calling ->folio_free(), as the folio may be reallocated by a driver with a different order. Instead of touching the folio again to extract the pgmap, use the local stack variable when calling percpu…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46279] In the Linux kernel, the following vulnerability has been resolved: mm/alloc_tag: clear codetag for…

In the Linux kernel, the following vulnerability has been resolved: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization Due to initialization ordering, page_ext is allocated and initialized relatively late during boot. Some pages have already been allocated and freed before page_ext becomes available, leaving their codetag uninitialized. A clear example is in init_se…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46280] In the Linux kernel, the following vulnerability has been resolved: lib: test_hmm: evict device pag…

In the Linux kernel, the following vulnerability has been resolved: lib: test_hmm: evict device pages on file close to avoid use-after-free Patch series "Minor hmm_test fixes and cleanups". Two bugfixes a cleanup for the HMM kernel selftests. These were mostly reported by Zenghui Yu with special thanks to Lorenzo for analysing and pointing out the problems. This patch (of 3): When dmirror_f…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46281] In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix buffer overflow in…

In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix buffer overflow in vrealloc_node_align() Commit 4c5d3365882d ("mm/vmalloc: allow to set node and align in vrealloc") added the ability to force a new allocation if the current pointer is on the wrong NUMA node, or if an alignment constraint is not met, even if the user is shrinking the allocation. On this path (nee…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46274] In the Linux kernel, the following vulnerability has been resolved: io-wq: check that the predecess…

In the Linux kernel, the following vulnerability has been resolved: io-wq: check that the predecessor is hashed in io_wq_remove_pending() io_wq_remove_pending() needs to fix up wq->hash_tail[] if the cancelled work was the tail of its hash bucket. When doing this, it checks whether the preceding entry in acct->work_list has the same hash value, but never checks that the predecessor is hashed at …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46275] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs a…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if …

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-11224] Use after free in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attac…

Use after free in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-11170] Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed …

Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to perform OS-level privilege escalation via malicious network traffic. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-11074] Use after free in WebRTC in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker …

Use after free in WebRTC in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-11071] Use after free in Base in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker wh…

Use after free in Base in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-11000] Use after free in Fonts in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker t…

Use after free in Fonts in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10899] Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker w…

Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10891] Use after free in GFX in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to …

Use after free in GFX in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10894] Use after free in Printing in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacke…

Use after free in Printing in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.3 NVD

L Alto vulnerabilidad

03/06/2026

[CVE-2026-46273] In the Linux kernel, the following vulnerability has been resolved: ibmveth: Disable GSO for packet…

In the Linux kernel, the following vulnerability has been resolved: ibmveth: Disable GSO for packets with small MSS Some physical adapters on Power systems do not support segmentation offload when the MSS is less than 224 bytes. Attempting to send such packets causes the adapter to freeze, stopping all traffic until manually reset. Implement ndo_features_check to disable GSO for packets with sm…

nvdaltovulnerabilidad CVSS 8.6 NVD

L Alto vulnerabilidad

03/06/2026

[CVE-2026-46265] In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix WQ_MEM_RECLAIM wa…

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix WQ_MEM_RECLAIM warning When sunrpc is used, if a reset triggered, our wq may lead the following trace: workqueue: WQ_MEM_RECLAIM xprtiod:xprt_rdma_connect_worker [rpcrdma] is flushing !WQ_MEM_RECLAIM hns_roce_irq_workq:flush_work_handle [hns_roce_hw_v2] WARNING: CPU: 0 PID: 8250 at kernel/workqueue.c:2644 check_fl…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

03/06/2026

[CVE-2026-46267] In the Linux kernel, the following vulnerability has been resolved: nfc: hci: shdlc: Stop timers an…

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: shdlc: Stop timers and work before freeing context llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc structure while its timers and state machine work may still be active. Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state and the skb queues. If teardown happens in parallel with a …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

03/06/2026

[CVE-2026-46270] In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: Fix use-…

In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: Fix use-after-free in power_supply_changed() Using the `devm_` variant for requesting IRQ _before_ the `devm_` variant for allocating/registering the `power_supply` handle, means that the `power_supply` handle will be deallocated/unregistered _before_ the interrupt handler (since `devm_` naturally dealloca…

nvdaltovulnerabilidad CVSS 8.4 NVD

L Alto vulnerabilidad

03/06/2026

[CVE-2026-46271] In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: do WoW offloads o…

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: do WoW offloads only on primary link In case of multi-link connection, WCN7850 firmware crashes due to WoW offloads enabled on both primary and secondary links. Change to do it only on primary link to fix it. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1

nvdaltovulnerabilidad CVSS 7.8 NVD