Alertas de Seguridad de la Información

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53234] In the Linux kernel, the following vulnerability has been resolved: net: ibm: emac: Fix use-after-f…

In the Linux kernel, the following vulnerability has been resolved: net: ibm: emac: Fix use-after-free during device removal The driver was using devm_register_netdev() which causes unregister_netdev() to be deferred until the devres cleanup phase, which runs after emac_remove() returns. This creates a use-after-free window where: 1. emac_remove() is called, which tears down hardware (cancels w…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53235] In the Linux kernel, the following vulnerability has been resolved: net: add pskb_may_pull() to skb…

In the Linux kernel, the following vulnerability has been resolved: net: add pskb_may_pull() to skb_gro_receive_list() skb_gro_receive_list() calls skb_pull(skb, skb_gro_offset(skb)) without first ensuring the data is in the linear area via pskb_may_pull(). When the skb arrives via napi_gro_frags(), skb_headlen can be 0 (all data in page fragments) while skb_gro_offset is non-zero (after IP+TCP …

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53239] In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-fre…

In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_prune_bin() directly since the lock is already held. The wrapper xfrm_policy_inexact_prune_bin() becomes unused and is removed. Race: C…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53240] In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free…

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload __input_process_payload() stores first_skb into xtfs->ra_newskb under drop_lock when starting partial reassembly, then unlocks and breaks out of the processing loop. The post-loop check reads xtfs->ra_newskb without the lock to decide whether first_skb is st…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53223] In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to r…

In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sockets: outgoing packet taps are also delivered to packet sockets with skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACK…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53229] In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix DMA and xdp…

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure In the XSK branch of mlx5e_xmit_xdp_buff(), when sq->xmit_xdp_frame() returns false (e.g. XDPSQ is full), the function returns without unmapping the DMA address or freeing the xdp_frame allocated by xdp_convert_zc_to_xdp_frame(). The xdpi_fifo push only happens on…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53230] In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bound…

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list mlx5_query_nic_vport_mac_list() sizes its firmware command buffer using the PF's log_max_current_uc/mc_list capabilities. When querying a VF vport with a larger configured max (via devlink), the firmware response can overflow this buffer: BUG: KASAN: slab-out-of…

nvdaltovulnerabilidad CVSS 8.7 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53217] In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: sync RX data at the…

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: sync RX data at the hardware packet offset mvpp2 programs the RX queue packet offset, so hardware writes received data at dma_addr + MVPP2_SKB_HEADROOM. The current CPU sync starts at dma_addr and only covers rx_bytes + MVPP2_MH_SIZE bytes, which syncs the unused headroom and misses the same number of bytes at the pa…

nvdaltovulnerabilidad CVSS 8.6 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53205] In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks f…

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks for firmware log indices Add validation that read and write indices in the firmware log buffer are within valid bounds (< data_size) before using them. If out-of-bounds indices are encountered (from firmware), clamp them to safe values instead of proceeding with invalid offsets. This prevents poten…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53209] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject ove…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Existing advertising instances can already hold the maximum extended advertising payload. When hci_adv_bcast_annoucement() prepends the Broadcast Announcement service data to that payload, the combined data may no longer fit in the temporary buffer used to rebu…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53212] In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling poin…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53198] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a …

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL A deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work on conn->async_requests via setup_async_work(), with cancel_fn = smb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock. When the request is cancelled, the w…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53199] In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: use kmap_local_page …

In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf netvsc_copy_to_send_buf() copies page buffer entries into the VMBus send buffer using phys_to_virt() on the entry PFN. Entries for the RNDIS header and the skb linear data come from kmalloc'd memory and are always in the kernel direct map, but entries for skb fragments re…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53200] In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix handling of…

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX XN has already been extracted from its bitfield position so using FIELD_PREP() on the mask that clears XN[0] is completely broken, having the effect of unconditionally granting execute permissions... Fix the obvious mistake by manipulating the right bit.

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53201] In the Linux kernel, the following vulnerability has been resolved: Revert "drm/xe: Skip exec queue…

In the Linux kernel, the following vulnerability has been resolved: Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend" This reverts commit 8533051ce92015e9cc6f75e0d52119b9d91610b6. The idle-skip optimization bypasses GuC suspend, so the GPU may not perform the context switch that flushes TLB entries for invalidated userptr VMAs. In LR/preempt-fence VM mode, this ca…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53202] In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer …

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware-supplied data_size is cast to signed int before being used in min_t(). Large unsigned values (>= 0x80000000) become negative, causing unsigned wraparound and oversized memcpy operations that can overflow the stack buffer. Chang…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53203] In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add buffer overflow…

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add buffer overflow check in MS get_info_ioctl Add validation that the info size returned from the metric stream info query is not exceeded when checked against the allocated buffer size. If the firmware returns a size larger than the buffer, reject the operation with -EOVERFLOW instead of proceeding with an incorrec…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53187] In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate cpu_id agai…

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate cpu_id against nr_cpu_ids in DMAH alloc The cpu_id attribute supplied by user space through UVERBS_ATTR_ALLOC_DMAH_CPU_ID is passed directly to cpumask_test_cpu() without first verifying that the value is within the valid CPU range. Passing such untrusted data to cpumask_test_cpu() may lead to an out-of-boun…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53188] In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate the passed …

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Validate the passed in fops for ib_get_ucaps() Sashiko pointed out it is not safe to rely only on the devt because char/block alias so if the user finds a block device with the same dev_t it can masquerade as a ucap cdev fd. Test the f_ops to only accept authentic cdevs.

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53189] In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: update file PMD…

In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: update file PMD counter before folio_put() __split_huge_pmd_locked() updates the file/shmem RSS counter after dropping the PMD mapping's folio reference. If folio_put() drops the last reference, mm_counter_file() can later read freed folio state via folio_test_swapbacked(). Move the counter update before folio_…

nvdaltovulnerabilidad CVSS 7.8 NVD