Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64423] In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast gr…

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ip_mc_destroy_dev() iterates through the multicast list and calls ip_ma_put() on each membership, scheduling them for RCU reclamation. However, they are not unlinked from the device's multicast hash table (mc_hash). S…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64413] In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chain…

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpu_possible_mask lead to an uninitialized pointer free? If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible, but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64414] In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable fr…

In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko reports: When an skb with unreadable fragments (such as from devmem TCP, where skb_frags_readable(skb) returns false) is processed by the u32 module, skb_copy_bits() will safely return a negative error code [..] xt_u32: bail out with hotdrop in this case. gather_frags: return -1, ju…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64418] In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix shrinker_info…

In the Linux kernel, the following vulnerability has been resolved: mm: shrinker: fix shrinker_info teardown race with expansion expand_shrinker_info() iterates all visible memcgs under shrinker_mutex, including memcgs that have not finished ->css_online() yet. Once pn->shrinker_info has been published, teardown must stay serialized with expand_shrinker_info() until that memcg is either fully o…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64420] In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drv…

In the Linux kernel, the following vulnerability has been resolved: mfd: cros_ec: Delay dev_set_drvdata() until probe success If ec_device_probe() fails, cros_ec_class_release releases memory for the cros_ec_dev structure. However, because the drvdata was already set, sub-drivers like cros_ec_typec can still retrieve the stale pointer via the platform device. This leads to a use-after-free when …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64406] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept_dequeue() bt_accept_get() takes a temporary reference before dropping the accept queue lock. bt_accept_dequeue() currently drops that reference before bt_accept_unlink(), leaving only the queue reference. bt_accept_unlink() drops the queue reference. The subsequent sock_hold() therefore accesses …

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64408] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP conn…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64411] In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate …

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before find_table_lock() update_counters() and compat_update_counters() forward a user-supplied 32-byte table name to find_table_lock() without NUL-terminating it. On a lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s", "ebtable_", name), and vsnprintf() reads pas…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64412] In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module nam…

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated We need to explicitly check the length, else we may pass non-null terminated string to request_module().

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64396] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct file_l…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into the connection's async_requests list via setup_async_work(). The cancel callback smb2_remove_blocked_lock() holds a reference to…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64398] In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check f…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTL_SET_ZERO_DATA FSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via ksmbd_vfs_zero_data() -> vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after checking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no per-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES still y…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64400] In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal b…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal bypass by restricting caseless retry ksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path resolution within the share root. When a crafted path attempts to escape the share boundary using parent-directory components ('..'), vfs_path_parent_lookup() detects this and immediately fails, ret…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64401] In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon f…

In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifs_swn_notify() looks up a witness registration by id under cifs_swnreg_idr_mutex, drops the mutex, and then uses the registration's cached tcon pointer. That pointer is not a lifetime reference, and it is not a stable representative once cifs_get_swn_reg() lets multiple t…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64402] In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OO…

In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() When the SMB sink is used as a perf AUX sink, smb_update_buffer() calls smb_sync_perf_buffer() to copy hardware trace data into the perf AUX ring buffer pages. It derives pg_idx = head >> PAGE_SHIFT from @head, which is handle->head, and indexes dst_pages[pg_idx]. …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64403] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate opti…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2cap_get_conf_opt() derives the option length from the attacker-controlled opt->len field and immediately dereferences opt->val (as u8, get_unaligned_le16() or get_unaligned_le32(), or a raw pointer for the default case) before any caller has confirmed that …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64388] In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp wit…

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership (chown) and group (chgrp) modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were also explicitly set. Fix this by checking for posix_extensions in cifs_setattr_nounix() when updating UI…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64389] In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbd_auth_ntlmv2() derives the NTLMv2 session key into sess->sess_key before it verifies the NTLMv2 response. ksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even when ksmbd_auth_ntlmv2() failed. With SMB3 multichannel binding, the failed authentication o…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64390] In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection own…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2_LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths, however, remove the connection list entry while holding fp->conn->llist_lock. With SMB3 multichanne…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64394] In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITE_DAC/WRITE_OW…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY commit cc57232cae23 ("ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE") added a fp->daccess gate to fsctl_set_sparse and noted that "similar handle-level checks exist in other functions but are missing here." The SMB2 SET_INFO…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64395] In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read acce…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to vfs_clone_file_range() or vfs_copy_file_range() without checking the SMB access mask granted to the source handle. A handle opened with attribute access can consequently be used to copy file contents into an…

nvdaltovulnerabilidad CVSS 7.5 NVD