Alertas de Seguridad de la Información

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63828] In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit …

In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and write(2): it opens the connection in the SYN. apparmor_socket_sendmsg() only checks AA_MAY_SEND, so a profile that grants send but denies connect lets a confined task open an outbound TCP/MPTCP …

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63829] In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_AD…

In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the device is created in or moved to a netns other than the one the request runs in. The rtnl changelink path checks CAP_NET_ADMIN only against…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63831] In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skb_cow_d…

In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skb_cow_data() before in-place crypto llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(), llsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform in-place cryptographic transformations on skb data. They build a scatterlist with sg_init_one() pointing into the skb's linear data area and then pass…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63832] In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish ch…

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76_sta_add Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add to avoid reinitializing the wcid->poll_list. Found dev->sta_poll_list corruption when using mt7925 and 7.1-rc4. According to the corruption information, prev->next was changed to itself. wlan0: disconne…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63833] In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace …

In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace writes to reserved $LX* xattrs NTFS3 uses $LXUID, $LXGID, $LXMOD and $LXDEV as internal WSL permission metadata and reloads them into i_uid, i_gid and i_mode from ntfs_get_wsl_perm(). Because the empty-prefix xattr handler also lets file owners call setxattr() on these names directly, an unprivile…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63823] In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payl…

In the Linux kernel, the following vulnerability has been resolved: keys: Pin request_key_auth payload in instantiate paths A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ ========================= create auth key store rka in auth key wait for helper get auth key load rka from auth key copy user payloa…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63824] In the Linux kernel, the following vulnerability has been resolved: KEYS: fix overflow in keyctl_pk…

In the Linux kernel, the following vulnerability has been resolved: KEYS: fix overflow in keyctl_pkey_params_get_2() The length for the internal output buffer is calculated incorrectly, which can result overflow when a too small buffer is provided. Fix the bug by allocating internal output with the size of the maximum length of the cryptographic primitive instead of caller provided size.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63827] In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in…

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix use-after-free in rawdata dedup loop aa_replace_profiles() walks ns->rawdata_list to dedup the incoming policy blob against entries already attached to existing profiles. Per the kernel-doc on struct aa_loaddata, list membership does not hold a reference: profiles hold pcount, and when the last pcount drops, do_plo…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63812] In the Linux kernel, the following vulnerability has been resolved: f2fs: fix incorrect FI_NO_EXTEN…

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() When __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does not reset the length of the largest extent to 0 and update the inode folio. Since modifications to the extent tree are disallowed afterward, the cached largest extent may become stale. This …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63813] In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: remove non-uptoda…

In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: remove non-uptodate folio from the page cache in move_data_block" This reverts commit 9609dd704725a40cd63d915f2ab6c44248a44598. The kernel panics are keeping to be reported especially when the f2fs partition get almost full. By investigation, we find that the reason is one f2fs page got freed to buddy without bein…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63814] In the Linux kernel, the following vulnerability has been resolved: f2fs: validate ACL entry sizes …

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate ACL entry sizes in f2fs_acl_from_disk() f2fs_acl_count() only validates the aggregate ACL xattr length. A malformed ACL can still place ACL_USER or ACL_GROUP in a slot that only contains struct f2fs_acl_entry_short bytes, and f2fs_acl_from_disk() then reads entry->e_id before verifying that a full entry fits. Req…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63815] In the Linux kernel, the following vulnerability has been resolved: f2fs: bound i_inline_xattr_size…

In the Linux kernel, the following vulnerability has been resolved: f2fs: bound i_inline_xattr_size for non-inline-xattr inodes When the flexible_inline_xattr feature is enabled, do_read_inode() loads the on-disk i_inline_xattr_size unconditionally: if (f2fs_sb_has_flexible_inline_xattr(sbi)) fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size); but sanity_check_inode() only range…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63816] In the Linux kernel, the following vulnerability has been resolved: f2fs: atomic: fix UAF issue on …

In the Linux kernel, the following vulnerability has been resolved: f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode - ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) - shrink - f2fs_gc - gc_data_segment - ra_data_block(cow_inode) - mapping = F2FS_I(inode)->atomic_inode->i_mapping : f2fs_is_cow_file(cow_inode) is true - f2fs_evict_inode(atomic_inode) - clear_inode_…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63817] In the Linux kernel, the following vulnerability has been resolved: f2fs: validate compress cache i…

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate compress cache inode only when enabled F2FS_COMPRESS_INO() uses NM_I(sbi)->max_nid as the synthetic inode number for the compressed page cache inode. That inode only exists when the compress_cache mount option is enabled. When compress_cache is disabled, max_nid is outside the valid inode range. A corrupted direc…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63818] In the Linux kernel, the following vulnerability has been resolved: f2fs: validate orphan inode ent…

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate orphan inode entry count f2fs_recover_orphan_inodes() trusts the orphan block entry_count when replaying orphan inodes from the checkpoint pack. A corrupted entry_count larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the ino[] array and interpret footer or following data as inode numbers. On …

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63819] In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on…

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on f2fs_get_node_folio_ra() kernel BUG at fs/f2fs/file.c:845! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:f2fs_do_trunc…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-63804] In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs…

In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2_qd_dealloc gfs2_qd_dealloc(), called as an RCU callback from gfs2_qd_dispose(), accesses the superblock object sdp through qd->qd_sbd after freeing qd. It does so to decrement sd_quota_count and wake up sd_kill_wait. However, by the time the RCU callback runs, gfs2_put_super() may have already f…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-63805] In the Linux kernel, the following vulnerability has been resolved: crypto: nx - fix nx_crypto_ctx_…

In the Linux kernel, the following vulnerability has been resolved: crypto: nx - fix nx_crypto_ctx_exit argument nx_crypto_ctx_shash_exit calls nx_crypto_ctx_exit with crypto_shash_ctx(...) but crypto_shash_ctx gives a nx_crypto_ctx *, not a crypto_tfm *. Fix the type in nx_crypto_ctx_exit and drop the bogus crypto_tfm_ctx call. This fixes the following oops: BUG: Unable to handle kernel da…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-63806] In the Linux kernel, the following vulnerability has been resolved: KVM: Replace guest-triggerable …

In the Linux kernel, the following vulnerability has been resolved: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Drop a BUG_ON() that has been reachable since it was first added, way back in 2009, and instead use get_unaligned() to perform potentially-unaligned accesses. For a given store, KVM x86's emulator tracks the entire value in the destination opera…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-63807] In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage i…

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in the shadow MMU, verify that the base gfn of the shadow page is actually contained within the target memslot, *before* querying the max mapping level given the shadow page's gfn. Failure to pre-check the validity of the gfn…

nvdaltovulnerabilidad CVSS 8.8 NVD