Alertas de Seguridad de la Información

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53396] In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak and ig…

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak and ignored error in nfsd4_create_file nfsd4_create_file() has two bugs in its ACL handling: The return value of nfsd4_acl_to_attr() is silently discarded. When the NFSv4-to-POSIX ACL conversion fails (e.g., -EINVAL for unsupported ACE types), the file is created without any ACL and the client receives…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53397] In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak on SET…

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix posix_acl leak on SETACL decode failure nfsaclsvc_decode_setaclargs() and nfs3svc_decode_setaclargs() each call nfs_stream_decode_acl() twice, first for NFS_ACL and then for NFS_DFACL. Each successful call transfers ownership of a freshly allocated posix_acl into argp->acl_access or argp->acl_default. If the first ca…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53383] In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2_check_user_session() takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work->sess (the session bound by the first operation) and validates only the SessionId, then returns "valid". It never re-checks work->sess->state == SMB2_…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53386] In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: add bound…

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: add bounds check to pga_settings index ads1298_pga_settings has 7 elements but ADS1298_MASK_CH_PGA can yield values 0-7. If it yields a value >= 7, this causes an out-of-bounds array access. Add a bounds check and return -EINVAL if the index is out of range. Note that the remaining value b111 is reserved s…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53387] In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6075: add bound…

In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6075: add bounds check to veml6075_it_ms index veml6075_it_ms has 5 elements but VEML6075_CONF_IT can yield values 0-7. If it returns a value >= 5, this causes an out-of-bounds array access. Add a bounds check and return -EINVAL if the index is out of range. The problem values are reserved so should never be rea…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53388] In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before re…

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end the request and free the fuse_io_args (eg fuse_readpages_end()) while the subsequent copy chain logic after fuse_try_move_folio() accesses th…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53389] In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free …

In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of key in del_async path In tcp_ao_delete_key(), the del_async path skips the current_key and rnext_key validity checks present in the synchronous path, assuming these pointers are always NULL on LISTEN sockets. However, if a key was added with set_current=1/set_rnext=1 while the socket was in CLO…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53381] In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount u…

In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput() called from fuse_release_end() can Oops if the super block has already been destroyed. Normally this is prevented by waiting for num_waiting to go down to zero before commencing with super block shutdown. This only works, however, for the last submount instance, as the wait counter i…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53380] In the Linux kernel, the following vulnerability has been resolved: media: rzv2h-ivc: Fix concurren…

In the Linux kernel, the following vulnerability has been resolved: media: rzv2h-ivc: Fix concurrent buffer list access The list of buffers (`rzv2h_ivc::buffers.queue`) is protected by a spinlock (`rzv2h_ivc::buffers.lock`). However, in `rzv2h_ivc_transfer_buffer()`, which runs in a separate workqueue, the `list_del()` call is executed without holding the spinlock, which makes it possible for th…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53373] In the Linux kernel, the following vulnerability has been resolved: mm/vma: do not try to unmap a V…

In the Linux kernel, the following vulnerability has been resolved: mm/vma: do not try to unmap a VMA if mmap_prepare() invoked from mmap() The mmap_prepare hook functionality includes the ability to invoke mmap_prepare() from the mmap() hook of existing 'stacked' drivers, that is ones which are capable of calling the mmap hooks of other drivers/file systems (e.g. overlayfs, shm). As part of t…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53374] In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GAR…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: zero-initialize GART table on allocation GART TLB is flushed after unmapping but not after mapping. Since amdgpu_bo_create_kernel() does not zero-initialize the buffer, when a single PTE is written the TLB may speculatively load other uninitialized entries from the same cacheline. Those garbage entries can appear val…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53375] In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In the case that only one of lo/hi is valid, the patching could result in a bad address written to in FW.

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53369] In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with ov…

In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udf_read_tagged() skips CRC verification when descCRCLength + sizeof(struct tag) exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC validation entirely; the descriptor is then accepted based solely on the 8-bit tag checksum, whi…

nvdaltovulnerabilidad CVSS 8.4 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53368] In the Linux kernel, the following vulnerability has been resolved: f2fs: fix fsck inconsistency ca…

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage f2fs_need_dentry_mark() reads nat_entry flags without mutual exclusion with the checkpoint path, which can result in an incorrect inode block marking state. The scenario is as follows: create & write & fsync 'file A' write checkpoint - f2fs_do…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

16/07/2026

[CVE-2026-53366] In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on th…

In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_data(), when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap, but the fraggap bytes carried over from the previous skb ar…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

04/07/2026

[CVE-2026-53361] In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to …

In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() …

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

04/07/2026

[CVE-2026-53362] In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on th…

In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length +…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

04/07/2026

[CVE-2026-53359] In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use…

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. Th…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

04/07/2026

[CVE-2026-53360] In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Require in-GHCB scrat…

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use As per the GHCB spec, when using GHCB v2+ require the software scratch area to reside in the GHCB's shared buffer. Note, things like Page State Change (PSC) requests _rely_ on this behavior, as the guest can't provide a length when making the request, i.e. the size of…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

02/07/2026

[CVE-2026-53357] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2cap_soc…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() bt_accept_dequeue() unlinks a not-yet-accepted child from the parent accept queue and release_sock()s it before returning, so the returned sk has no caller reference and is unlocked. l2cap_sock_cleanup_listen() walks these children on listening-socket close. …

nvdaltovulnerabilidad CVSS 8.0 NVD