Alertas de Seguridad de la Información

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64108] In the Linux kernel, the following vulnerability has been resolved: cifs: Fix busy dentry used afte…

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix busy dentry used after unmounting Since commit 340cea84f691c ("cifs: open files should not hold ref on superblock"), cifs file only holds the dentry ref_cnt, the cifs file close work(cfile->deferred) could be executed after unmounting, which will trigger a warning in generic_shutdown_super: BUG: Dentry 00000000a14a684…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64109] In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix UAF read of tail->…

In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() unix_stream_data_wait() does skb_peek_tail(&sk->sk_receive_queue) without holding any lock that prevents SKBs on that queue from being dequeued and freed. This has been the case since commit 79f632c71bea ("unix/stream: fix peeking with an offset larger than data in qu…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64111] In the Linux kernel, the following vulnerability has been resolved: lsm: hold cred_guard_mutex for …

In the Linux kernel, the following vulnerability has been resolved: lsm: hold cred_guard_mutex for lsm_set_self_attr() Just as proc_pid_attr_write() already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptraced and if so, whether to allow the transition.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64112] In the Linux kernel, the following vulnerability has been resolved: rbd: eliminate a race in lock_d…

In the Linux kernel, the following vulnerability has been resolved: rbd: eliminate a race in lock_dwork draining on unmap Given how rbd_lock_add_request() and rbd_img_exclusive_lock() are written, lock_dwork may be (re)queued more than it's actually needed: for example in case a new I/O request comes in while we are in the middle of rbd_acquire_lock() on behalf of another I/O request. This is e…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64114] In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IP_HDRINCL pa…

In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 raw_send_hdrinc() validates that the caller-supplied IPv4 header fits within the message length: iphlen = iph->ihl * 4; err = -EINVAL; if (iphlen > length) goto error_free; if (iphlen >= sizeof(*iph)) { /* fix up saddr, tot_len, id, csum, transpo…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64115] In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer r…

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64104] In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Explicitly lea…

In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Explicitly leak pages in unknown state When set_memory_{encrypted,decrypted}() fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state from the point of view of the caller. Since the pages may be left in an unencrypted state, they are not suitable for g…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64093] In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: directly …

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: directly shut down timer on cleanup batadv_tp_sender_cleanup() was calling timer_delete_sync() followed by timer_delete() to guard against the timer handler re-arming itself between the two calls. This double-deletion hack relied on the sending status being set to 0 to suppress re-arming. Replace both call…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64095] In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double d…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double decrement of bla.num_requests The bla.num_requests is increased when no request_sent was in progress. And it is decremented in various places (announcement was received, backbone is purged, periodic work). But the check if the request_sent is actually set to a specific state and the atomic_dec/_inc …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64096] In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: fix use-afte…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: fix use-after-free in orig_node RCU release batadv_mcast_purge_orig() removes entries from RCU-protected hlists but does not wait for an RCU grace period before returning. Concurrent RCU readers may still accesses references to those entries at the point of removal. RCU-protected readers trying to operate on e…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64097] In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate GPIO …

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate GPIO pin LUT table size before iterating [Why&How] The GPIO pin table parsers in get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() derive an element count from the VBIOS table_header.structuresize field, then iterate over gpio_pin[] entries. However, GET_IMAGE() only validates that the table heade…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64098] In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible…

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible resv lock for plane updates virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and ignore its return value. The function can fail with -EINTR from dma_resv_lock_interruptible() (signal during lock wait) or with -ENOM…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64099] In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of …

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and performance query arrays after v3d_job_cleanup(), which drops the job's last reference and frees cpu_job. Reading cpu_job at that point is a use-after-free. Also, on the early v3d_job_init() …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64084] In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) cap PDIO…

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR adm1266_gpio_get_multiple() iterates the PDIO portion of the caller-supplied mask using for_each_set_bit_from(gpio_nr, mask, ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) { ... } where ADM1266_PDIO_STATUS is the PMBus command code (0xE9, i.e. 233), n…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64086] In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) include …

In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer adm1266_pmbus_block_xfer() sets up the read transaction with .buf = data->read_buf, .len = ADM1266_PMBUS_BLOCK_MAX + 2, but read_buf in struct adm1266_data is declared as u8 read_buf[ADM1266_PMBUS_BLOCK_MAX + 1]; For a max-length block response (lengt…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64088] In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative tt…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative tt_buff_len batadv_orig_node::tt_buff_len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to s32. The incorrectly …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64074] In the Linux kernel, the following vulnerability has been resolved: fs/statmount: fix slab out-of-b…

In the Linux kernel, the following vulnerability has been resolved: fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap statmount_mnt_idmap() writes one mapping with seq_printf() and then manually advances seq->count to include the NUL separator. If seq_printf() overflows, seq_set_overflow() sets seq->count to seq->size. The manual seq->count++ changes this to seq->size + 1. seq_h…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64076] In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: eb_tables: c…

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: eb_tables: close module init race sashiko reports for unrelated patch: Does the core ebtables initialization in ebtables.c suffer from a similar race? Once nf_register_sockopt() completes, the sockopts are exposed globally. sockopt has to be registered last, just like in ip/ip6/arptables.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64077] In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: move to tw…

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: move to two-stage removal scheme Like previous patches for x_tables, follow same pattern in ebtables. We can't reuse xt helpers: ebt_table struct layout is incompatible. table->ops assignment is now done while still holding the ebt mutex to make sure we never expose partially-filled table struct.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64078] In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: add and us…

In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: add and use xtables_unregister_table_exit Previous change added xtables_unregister_table_pre_exit to detach the table from the packetpath and to unlink it from the active table list. In case of rmmod, userspace that is doing set/getsockopt for this table will not be able to re-instantiate the table: 1. The …

nvdaltovulnerabilidad CVSS 7.8 NVD