Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97991] In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_blk: reject out-of-ran…

In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_blk: reject out-of-range sector starts vdpasim_blk_check_range() logs an invalid start sector but continues validating the request. The subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offset reach the data path. The invalid offset is used by three request paths. VIRTIO_BLK_T_OUT …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97971] In the Linux kernel, the following vulnerability has been resolved: nstree: check listing permissio…

In the Linux kernel, the following vulnerability has been resolved: nstree: check listing permission before taking a namespace reference legitimize_ns() takes a reference on the candidate namespace before may_list_ns() has decided whether the caller may see it. The __free(ns_put) cleanup on the denied path can drop the last reference to a mount namespace while we still hold the rcu read lock, an…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97957] In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix mailbox segment…

In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix mailbox segment buffer overflow check_mbox_seq_id_and_seg_len() validates that seq_id does not exceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed MBOX_SEG_LEN (48). However, this allows the last segment (seq_id=42) to carry a full 48-byte payload, writing to offset 42*48=2016 for 48 bytes (ending at byte 206…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97953] In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor …

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmac_tso_xmit() estimates the number of free TX descriptors required by a TSO skb as: (skb->len - proto_hdr_len) / TSO_MAX_BUFF_SIZE + 1 which assumes the payload is split into TSO_MAX_BUFF_SIZE chunks. This underestimates the descriptors actually consumed by…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97937] In the Linux kernel, the following vulnerability has been resolved: ftrace: fork: Initialize functi…

In the Linux kernel, the following vulnerability has been resolved: ftrace: fork: Initialize function graph state before copy_exec_state() dup_task_struct() copies the parent's task_struct, including ret_stack. ftrace_graph_init_task() clears the copied function graph state, but it currently runs after copy_exec_state(). For non-CLONE_VM forks, copy_exec_state() allocates a new task_exec_state.…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97940] In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on se…

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6_route_iter_active() treats a walker in FWS_U at the table root as already unlinked. fib6_del_route() can move a still-linked walker into that same state when the current leaf is the last route at the root, so ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq private objec…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97941] In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n->list_lock in _…

In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race Commit ba7425312607 ("mm, slab: add an optimistic __slab_try_return_freelist()") incorrectly assumed that nobody has freed an object to the slab as long as slab->freelist is NULL and cmpxchg succeeds. However, as reported by Hyunwoo Kim [1], other CPUs mig…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97931] In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upg…

In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VM_MAYWRITE set on mappings created with PROT_READ. A process that can open the hwdep node O_RDWR can later use mprotect() to make the mapping writable. The read allocation begins w…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97926] In the Linux kernel, the following vulnerability has been resolved: ufs: validate cylinder group me…

In the Linux kernel, the following vulnerability has been resolved: ufs: validate cylinder group metadata before caching it ufs_read_cylinder() copies the cylinder group index and the rotor positions straight from the on-disk group and caches them without any check: ucpi->c_cgx = fs32_to_cpu(sb, ucg->cg_cgx); ucpi->c_rotor = fs32_to_cpu(sb, ucg->cg_rotor); ucpi->c_frotor = fs32_to_cpu(sb…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97911] In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM regi…

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM region size matches job It is possible for userspace to set the job SRAM size to 0, but then still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register is skipped and a stale base address from a prior job is used. Check the region size against the job…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97903] In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to threa…

In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to thread_pid across proc_flush_pid Commit 0a36bad01731 ("release_task: kill the no longer needed get/put_pid(thread_pid)") removed the reference around proc_flush_pid(). It assumed that free_pids(post.pids) at the end of release_task() would keep thread_pid alive until then. That assumption is wrong. __…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97910] In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress b…

In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress buffer sizes against fixed allocations sprd_platform_compr_open() allocates the stage 0 IRAM buffer (32K data area) and the stage 1 DDR buffer (2M data area) with fixed sizes, but sprd_platform_compr_copy() derives all copy lengths from the user controlled runtime->fragment_size and the write() coun…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97611] In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after…

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tbl_mask_array_realloc() retires the old mask_array before it stops being reachable: old = ovsl_dereference(tbl->mask_array); if (old) { ... call_rcu(&old->rcu, mask_array_rcu_cb); } rcu_assign_pointer(tbl->mask_array, new); call_rcu() only waits for re…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97612] In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear inner_protocol…

In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear inner_protocol when the last label is popped skb_mpls_push() records the pre-encapsulation network header once, gated on !skb->inner_protocol. skb_mpls_pop() never clears that record, so it outlives the encapsulation it describes. Open vSwitch can then re-push MPLS onto a packet whose inner_network_header still…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97608] In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: unregister l…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: unregister loggers before per-net teardown nf_log_syslog and nfnetlink_log unregister their per-network namespace operations before unregistering their global logger backends. This leaves a window where a sysctl or netlink writer can rebind the still- registered logger after the per-net pre-exit callback clear…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97609] In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: prevent U…

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: prevent UAF during module unload nf_ct_set_timeout() protects the timeout hook dereference and policy lookup with rcu_read_lock(). cttimeout_exit(), however, unregisters the per-net operations before it clears the hook. This allows the following interleaving: CPU 0 CPU 1 c…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97602] In the Linux kernel, the following vulnerability has been resolved: inet: frags: invalidate queues …

In the Linux kernel, the following vulnerability has been resolved: inet: frags: invalidate queues before flushing them fqdir_pre_exit() flushes the skbs from incomplete queues without changing their completion state. A fragment which found a queue before high_thresh was cleared can then acquire the queue lock and reuse stale reassembly metadata. A queue concurrently killed after fqdir->dead is …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97589] In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix wrong return c…

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix wrong return code to engine in asynch callbacks When crypto_finalize_hash_request() or crypto_finalize_skcipher_request() explicitly completes a request, the do_one_request callback must return 0 to indicate successful handling. Returning a negative error code causes the crypto engine to assume the driver failed…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97594] In the Linux kernel, the following vulnerability has been resolved: landlock: Fix use-after-free of…

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix use-after-free of the source's parent directory current_check_refer_path() reads old_dentry->d_parent without holding a reference nor a lock on it, and then dereferences it in collect_domain_accesses() and in the audit record. A reference on a child does not pin its parent: __d_move() reassigns dentry->d_parent an…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97595] In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free o…

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee802154_subif_frame() queues received beacon and MAC-command frames onto local->rx_beacon_list / rx_mac_cmd_list and schedules a process-context worker, storing a raw mac_pkt->sdata (and skb->dev == sdata->dev) with neither a reference nor any…

nvdaltovulnerabilidad CVSS 7.5 NVD