Alertas de Seguridad de la Información

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53119] In the Linux kernel, the following vulnerability has been resolved: platform/wmi: use generic drive…

In the Linux kernel, the following vulnerability has been resolved: platform/wmi: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking car…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53120] In the Linux kernel, the following vulnerability has been resolved: PCI: use generic driver_overrid…

In the Linux kernel, the following vulnerability has been resolved: PCI: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of prop…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53109] In the Linux kernel, the following vulnerability has been resolved: powerpc/pgtable-frag: Fix bad p…

In the Linux kernel, the following vulnerability has been resolved: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy powerpc uses pt_frag_refcount as a reference counter for tracking it's pte and pmd page table fragments. For PTE table, in case of Hash with 64K pagesize, we have 16 fragments of 4K size in one 64K page. Patch series [1] "mm: free retracted page table by RCU" added pt…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53112] In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix possibl…

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet The irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and scheduled when RTL_IMR_BCNINT interrupt is triggered by hardware. But it is never killed in rtl_pci_deinit(). When the rtlwifi card probe fails or is being detached, the ie…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53115] In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: use generic driver…

In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53116] In the Linux kernel, the following vulnerability has been resolved: s390/ap: use generic driver_ove…

In the Linux kernel, the following vulnerability has been resolved: s390/ap: use generic driver_override infrastructure When the AP masks are updated via apmask_store() or aqmask_store(), ap_bus_revise_bindings() is called after ap_attr_mutex has been released. This calls __ap_revise_reserved(), which accesses the driver_override field without holding any lock, racing against a concurrent drive…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53098] In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix use-aft…

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() When the mt7915 pci chip is detaching, the mt7915_crash_data is released in mt7915_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7915_ma…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53089] In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in offl…

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in offloaded map/prog info fill When querying info for an offloaded BPF map or program, bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() obtain the network namespace with get_net(dev_net(offmap->netdev)). However, the associated netdev's netns may be racing with teardown during netns des…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53097] In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix use-aft…

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() When the mt7996 pci chip is detaching, the mt7996_crash_data is released in mt7996_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7996_ma…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53085] In the Linux kernel, the following vulnerability has been resolved: bpf: fix mm lifecycle in open-c…

In the Linux kernel, the following vulnerability has been resolved: bpf: fix mm lifecycle in open-coded task_vma iterator The open-coded task_vma iterator reads task->mm locklessly and acquires mmap_read_trylock() but never calls mmget(). If the task exits concurrently, the mm_struct can be freed as it is not SLAB_TYPESAFE_BY_RCU, resulting in a use-after-free. Safely read task->mm with a trylo…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53071] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing c…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list whil…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53040] In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate bg_bits during …

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate bg_bits during freefrag scan [BUG] A crafted filesystem can trigger an out-of-bounds bitmap walk when OCFS2_IOC_INFO is issued with OCFS2_INFO_FL_NON_COHERENT. BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: use-after-free in _test_bit include/asm-generic…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53033] In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Take state lock f…

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Take state lock for af_unix iter When a BPF iterator program updates a sockmap, there is a race condition in unix_stream_bpf_update_proto() where the `peer` pointer can become stale[1] during a state transition TCP_ESTABLISHED -> TCP_CLOSE. CPU0 bpf CPU1 close -------- …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53024] In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-fre…

In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free if write is called after disconnect If a user writes to the chardev after disconnect has been called, the kernel panics with the following trace (with CONFIG_INIT_ON_FREE_DEFAULT_ON=y): BUG: kernel NULL pointer dereference, address: 0000000000000218 ... Call Trace: …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53025] In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-fre…

In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free on cdev close This addresses a use-after-free bug when a raw bundle is disconnected but its chardev is still opened by an application. When the application releases the cdev, it causes the following panic when init on free is enabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y): refcount_t: underf…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53009] In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf …

In the Linux kernel, the following vulnerability has been resolved: ice: fix double-free of tx_buf skb If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid (ICE_TX_BUF_SKB). 'next_to_use' remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53011] In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: fix use-afte…

In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch In advance_sched(), when should_change_schedules() returns true, switch_schedules() is called to promote the admin schedule to oper. switch_schedules() queues the old oper schedule for RCU freeing via call_rcu(), but 'next' still points into an entry of …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53005] In the Linux kernel, the following vulnerability has been resolved: af_unix: Drop all SCM attribute…

In the Linux kernel, the following vulnerability has been resolved: af_unix: Drop all SCM attributes for SOCKMAP. SOCKMAP can hide inflight fd from AF_UNIX GC. When a socket in SOCKMAP receives skb with inflight fd, sk_psock_verdict_data_ready() looks up the mapped socket and enqueue skb to its psock->ingress_skb. Since neither the old nor the new GC can inspect the psock queue, the hidden skb…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52976] In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix error cleanup in xe…

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() Two error handling issues exist in xe_exec_queue_create_ioctl(): 1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps to put_exec_queue which skips xe_exec_queue_kill(). If the VM is in preempt fence mode, xe_vm_add_compute_exec_queue() has alrea…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52971] In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Fix potential us…

In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Fix potential use-after-free in get_timestamp Move the phc->active check and resp pointer assignment to after acquiring the spinlock. Previously, phc->active was checked without holding the lock, and resp was cached from ena_dev->phc.virt_addr before the lock was acquired. If ena_com_phc_destroy() runs between th…

nvdaltovulnerabilidad CVSS 7.8 NVD