Alertas de Seguridad de la Información

M Alto vulnerabilidad

29/07/2026

[CVE-2026-64560] In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF c…

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() posix_cpu_timer_del() // Observes old leader p = pid_task(pid, pid_type); de_thread() switch_leader(); release…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-64556] In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups …

In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the context with DETACH_EXIT only. This can leave inconsistent group state when a removed event is a group leader and the group contains siblings w…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-64557] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after release_sock(parent). Once the parent lock is dropped the newly enqueued child socket sk is reachable via the accept queue, so another task can accept and free it before the callback dereference…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64552] In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in re…

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padde…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64554] In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale pr…

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() br_ip6_fragment() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb skb_checksum_help() reallocates the head via pskb_expand_head(), leaving prevhdr dangling. It is later dereferenced in ip6_f…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64555] In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSR_EL2 re…

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() kvm_hyp_handle_mops() resets the single-step state machine as part of rewinding state for a MOPS exception by modifying vcpu_cpsr() and writing the result directly into hardware. In the case of nested virtualization, vcpu_cpsr() is a synthetic value such that the res…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64545] In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL…

In the Linux kernel, the following vulnerability has been resolved: net, bpf: check master for NULL in xdp_master_redirect() xdp_master_redirect() dereferences the result of netdev_master_upper_dev_get_rcu() without a NULL check, but that helper returns NULL when the receiving device has no upper-master adjacency. The reach guard only checks netif_is_bond_slave(). On bond slave release bond_upp…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64546] In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drm_p…

In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix OOB read in drm_parse_tiled_block() drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile->topology_id[7] without checking block->num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a t…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64547] In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate pac…

In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packet_len before pad-byte access in rx_fixup For an even packet_len, net1080_rx_fixup() reads the pad byte at skb->data[packet_len] before the skb->len != packet_len check further down, and packet_len is only bounded against NC_MAX_PACKET. A malicious NetChip 1080 device can send a short frame advert…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64548] In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowin…

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() When the scatterlist ring is full or nearly full, bpf_msg_push_data() enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING and both are u32, a crafted len can wrap the sum to a sm…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64550] In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate …

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes the skb straight to __rmnet_map_ingress_handler(), skipping the length validation that rmnet_map_deaggregate() performs on the aggregated path. The parser then dereferences the MAP hea…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64539] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB w…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix stack OOB write when prepending the Flags AD eir_create_adv_data() builds the advertising data into a fixed-size buffer ("size", 31 for the legacy path). It may prepend a 3-byte "Flags" AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies the per-instance data without checking that it still …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64540] In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-boun…

In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() genelink_rx_fixup() splits an aggregated RX frame into its individual packets, using a per-packet length taken from device-supplied data. That length is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared against how many bytes were actually received. A ma…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64543] In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the…

In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rcv() still dereferences b->disc in RX softirq under rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv). L2 bearers are safe thanks to the synchronize_net() in tipc_disabl…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-24252] NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A s…

NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, data tampering, escalation of privileges and information disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-17523] A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user …

A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation (LPE). This allows the attacker to gain root privileges and take full control of the affected system.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64531] In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversi…

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guar…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64532] In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.da…

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove destination is `Add2Ptr(e, le16_to_cpu(e->view.data_off))`, where e->view.data_off comes from an on-disk NTFS_DE inside an INDEX_ROOT or …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64533] In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow …

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables. During this conversion, the memmove() length is derived directly from the on-disk lcns_follow field: memmove(&dp->vcn, &dp0->vcn_low, 2 * sizeof(u64) + …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64536] In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB rea…

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop The loop in is_ap_in_tkip() iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE->element_id and pIE->length are read without checking that i + sizeof(*pIE)

nvdaltovulnerabilidad CVSS 8.1 NVD