Alertas de Seguridad de la Información

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53242] In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list …

In the Linux kernel, the following vulnerability has been resolved: ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams snd_pcm_drain() uses init_waitqueue_entry which does not clear entry.prev/next, and add_wait_queue with a conditional remove_wait_queue that is skipped when to_check is no longer in the group after concurrent UNLINK. The orphaned wait entry remains o…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53244] In the Linux kernel, the following vulnerability has been resolved: VFS: fix possible failure to un…

In the Linux kernel, the following vulnerability has been resolved: VFS: fix possible failure to unlock in nfsd4_create_file() atomic_create() in fs/namei.c drops the reference to the dentry when it returns an error. This behaviour was imported into dentry_create() so that it will drop the reference if an error is returned from atomic_create(), though not if vfs_create() returns an error (in the…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53248] In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix use-after-free…

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Fix use-after-free in metadata dst teardown airoha_metadata_dst_free() runs metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-si…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53250] In the Linux kernel, the following vulnerability has been resolved: xsk: cache csum_start/csum_offs…

In the Linux kernel, the following vulnerability has been resolved: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() The TX metadata area resides in the UMEM buffer which is memory-mapped and concurrently writable by userspace. In xsk_skb_metadata(), csum_start and csum_offset are read from shared memory for bounds validation, then read again for skb assignment. A malicious …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53232] In the Linux kernel, the following vulnerability has been resolved: net: phy: clean the sfp upstrea…

In the Linux kernel, the following vulnerability has been resolved: net: phy: clean the sfp upstream if phy probing fails Sashiko reported that we don't call sfp_bus_del_upstream() in the probe failure path, so let's add it, otherwise the sfp-bus is left with a dangling 'upstream' field, that may be used later on during SFP events. This issue existed before the generic phylib sfp support, back …

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53233] In the Linux kernel, the following vulnerability has been resolved: netdev: fix double-free in netd…

In the Linux kernel, the following vulnerability has been resolved: netdev: fix double-free in netdev_nl_bind_rx_doit() Sashiko flags that genlmsg_reply() always consumes the skb. The error path calls nlmsg_free(rsp) so we can't jump directly to it. Let's not unbind, just propagate the error to the user. This is the typical way of handling genlmsg_reply() failures. They shouldn't happen unless u…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53234] In the Linux kernel, the following vulnerability has been resolved: net: ibm: emac: Fix use-after-f…

In the Linux kernel, the following vulnerability has been resolved: net: ibm: emac: Fix use-after-free during device removal The driver was using devm_register_netdev() which causes unregister_netdev() to be deferred until the devres cleanup phase, which runs after emac_remove() returns. This creates a use-after-free window where: 1. emac_remove() is called, which tears down hardware (cancels w…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53235] In the Linux kernel, the following vulnerability has been resolved: net: add pskb_may_pull() to skb…

In the Linux kernel, the following vulnerability has been resolved: net: add pskb_may_pull() to skb_gro_receive_list() skb_gro_receive_list() calls skb_pull(skb, skb_gro_offset(skb)) without first ensuring the data is in the linear area via pskb_may_pull(). When the skb arrives via napi_gro_frags(), skb_headlen can be 0 (all data in page fragments) while skb_gro_offset is non-zero (after IP+TCP …

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53239] In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-fre…

In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_prune_bin() directly since the lock is already held. The wrapper xfrm_policy_inexact_prune_bin() becomes unused and is removed. Race: C…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53240] In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free…

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload __input_process_payload() stores first_skb into xtfs->ra_newskb under drop_lock when starting partial reassembly, then unlocks and breaks out of the processing loop. The post-loop check reads xtfs->ra_newskb without the lock to decide whether first_skb is st…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53223] In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to r…

In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sockets: outgoing packet taps are also delivered to packet sockets with skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACK…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53229] In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix DMA and xdp…

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure In the XSK branch of mlx5e_xmit_xdp_buff(), when sq->xmit_xdp_frame() returns false (e.g. XDPSQ is full), the function returns without unmapping the DMA address or freeing the xdp_frame allocated by xdp_convert_zc_to_xdp_frame(). The xdpi_fifo push only happens on…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53230] In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bound…

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list mlx5_query_nic_vport_mac_list() sizes its firmware command buffer using the PF's log_max_current_uc/mc_list capabilities. When querying a VF vport with a larger configured max (via devlink), the firmware response can overflow this buffer: BUG: KASAN: slab-out-of…

nvdaltovulnerabilidad CVSS 8.7 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53217] In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: sync RX data at the…

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: sync RX data at the hardware packet offset mvpp2 programs the RX queue packet offset, so hardware writes received data at dma_addr + MVPP2_SKB_HEADROOM. The current CPU sync starts at dma_addr and only covers rx_bytes + MVPP2_MH_SIZE bytes, which syncs the unused headroom and misses the same number of bytes at the pa…

nvdaltovulnerabilidad CVSS 8.6 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53205] In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks f…

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks for firmware log indices Add validation that read and write indices in the firmware log buffer are within valid bounds (< data_size) before using them. If out-of-bounds indices are encountered (from firmware), clamp them to safe values instead of proceeding with invalid offsets. This prevents poten…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53209] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject ove…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Existing advertising instances can already hold the maximum extended advertising payload. When hci_adv_bcast_annoucement() prepends the Broadcast Announcement service data to that payload, the combined data may no longer fit in the temporary buffer used to rebu…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53212] In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling poin…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53198] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a …

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL A deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work on conn->async_requests via setup_async_work(), with cancel_fn = smb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock. When the request is cancelled, the w…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53199] In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: use kmap_local_page …

In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf netvsc_copy_to_send_buf() copies page buffer entries into the VMBus send buffer using phys_to_virt() on the entry PFN. Entries for the RNDIS header and the skb linear data come from kmalloc'd memory and are always in the kernel direct map, but entries for skb fragments re…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53200] In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix handling of…

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX XN has already been extracted from its bitfield position so using FIELD_PREP() on the mask that clears XN[0] is completely broken, having the effect of unconditionally granting execute permissions... Fix the obvious mistake by manipulating the right bit.

nvdaltovulnerabilidad CVSS 8.8 NVD