Alertas de Seguridad de la Información

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52959] In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Do not use hos…

In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Do not use host-controlled page order in cleanup path When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST), get_ext_report() allocates a buffer to retrieve a certificate blob from the host, keeping track of its size in report_req->certs_len. However, the host may return SNP_GUEST_VMM_ERR_INVAL…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52960] In the Linux kernel, the following vulnerability has been resolved: ceph: put folios not suitable f…

In the Linux kernel, the following vulnerability has been resolved: ceph: put folios not suitable for writeback The batch holds references to the folios (see `filemap_get_folios`, `folio_batch_release`), so we need to `folio_put` the folios we remove. Tested on v6.18.

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52962] In the Linux kernel, the following vulnerability has been resolved: ceph: fix a buffer leak in __ce…

In the Linux kernel, the following vulnerability has been resolved: ceph: fix a buffer leak in __ceph_setxattr() The old_blob in __ceph_setxattr() can store ci->i_xattrs.prealloc_blob value during the retry. However, it is never called the ceph_buffer_put() for the old_blob object. This patch fixes the issue of the buffer leak.

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52950] In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: fix UAF with re…

In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: fix UAF with retry loop Retry doesn't work here, since bo will be freed on error, leading to UAF. However, now that we do the alloc & init before the attach, we can now combine this as one unit and have the init do the alloc for us. This should make the retry safe. Reported by Sashiko. v2: Fix up the error unwi…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52951] In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: handle empty bo…

In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: handle empty bo and UAF races There look to be some nasty races here when triggering the invalidate_mappings hook: 1) We do xe_bo_alloc() followed by the attach, before the actual full bo init step in xe_dma_buf_init_obj(). However the bo is visible on the attachments list after the attach. This is bad si…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52952] In the Linux kernel, the following vulnerability has been resolved: iommu: Fix WARN_ON in __iommu_g…

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset In __iommu_group_set_domain_internal(), concurrent domain attachments are rejected when any device in the group is recovering. This is necessary to fence concurrent attachments to a multi-device group where devices might share the same RID due to PCI DMA alias …

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52953] In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix oops due to out…

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix oops due to out of scope access Below oops triggers when kill QEMU process: Oops: general protection fault, probably for non-canonical address 0x7fffffff844eaaa7: 0000 [#1] SMP NOPTI Call Trace: do_raw_spin_lock+0xaa/0xc0 _raw_spin_lock_irqsave+0x21/0x40 domain_remove_dev_pasid+0x52/0x160 …

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52954] In the Linux kernel, the following vulnerability has been resolved: libceph: handle rbtree insertio…

In the Linux kernel, the following vulnerability has been resolved: libceph: handle rbtree insertion error in decode_choose_args() A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. The received CRUSH map may optionally contain choose_args that get decoded in decode_choose_args(). In this function, num_choose_arg_maps is read from the message, and a correspo…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52956] In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-b…

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() In __ceph_x_decrypt(), a part of the buffer p is interpreted as a ceph_x_encrypt_header, and the magic field of this struct is accessed. This happens without any guarantee that the buffer is large enough to hold this struct. The function parameter ciphertext_len r…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52957] In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr…

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr-deref in decode_choose_args() A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. When decoding this CRUSH map in crush_decode(), an array of max_buckets CRUSH buckets is decoded, where some indices may not refer to actual buckets and are therefore set to NULL.…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52945] In the Linux kernel, the following vulnerability has been resolved: Revert "wireguard: device: enab…

In the Linux kernel, the following vulnerability has been resolved: Revert "wireguard: device: enable threaded NAPI" This reverts commit 933466fc50a8e4eb167acbd0d8ec96a078462e9c which is commit db9ae3b6b43c79b1ba87eea849fd65efa05b4b2e upstream. We have had three independent production user reports in combination with Cilium utilizing WireGuard as encryption underneath that k8s Pod E/W traffic t…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52946] In the Linux kernel, the following vulnerability has been resolved: fs/fcntl: fix SOFTIRQ-unsafe lo…

In the Linux kernel, the following vulnerability has been resolved: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling A SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in send_sigio() and send_sigurg() when a process group receives a signal. When FASYNC is configured for a process group (PIDTYPE_PGID), both functions use read_lock(&tasklist_lock) to traverse the task list…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52947] In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturat…

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove In qrtr_port_remove(), the socket reference count is decremented via __sock_put() before the port is removed from the qrtr_ports XArray and before the RCU grace period elapses. This breaks the fundamental RCU update paradigm. It exposes a race window where…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-49269] Apple M1 GPUs retain register file data between compute shader dispatches from different processes. …

Apple M1 GPUs retain register file data between compute shader dispatches from different processes. A sandboxed Metal attacker app can run a GPU reader shader that reads stale register values left by a separate sandboxed victim app. In the proof of concept, GPUVictim.app generates a fresh random 128-bit secret using SecRandomCopyBytes and loads it into GPU registers. GPUAttacker.app, a separate sa…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-11877] An unauthorized user can modify configuration through API calls that affects the OpenText Access Man…

An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3.

nvdaltovulnerabilidad CVSS 7.5 NVD

J Alto vulnerabilidad

24/06/2026

[CVE-2026-57301] Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rathe…

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

nvdaltovulnerabilidad CVSS 8.8 NVD

J Alto vulnerabilidad

24/06/2026

[CVE-2026-57303] Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external en…

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-57296] Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences…

Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences in the custom workspace path provided to the exwsAllocate Pipeline step, allowing attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, which can lead to remote code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

J Alto vulnerabilidad

24/06/2026

[CVE-2026-57281] Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformat…

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.

nvdaltovulnerabilidad CVSS 7.5 NVD

J Alto vulnerabilidad

24/06/2026

[CVE-2026-57280] Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type c…

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type casts applied to the elements of typed for-each loops in sandboxed Groovy scripts, allowing attackers able to provide such scripts to invoke arbitrary constructors and bypass the sandbox protection.

nvdaltovulnerabilidad CVSS 8.8 NVD