Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97528] In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Unlink NVMe unso…

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error qla_nvme_xmt_ls_rsp() obtains uctx, which was linked into fcport->unsol_ctx_head by qla2xxx_process_purls_iocb() and is still linked when the NVMe transport calls back to transmit the LS response. On the error (out:) path the function frees uctx with kfree() …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97520] In the Linux kernel, the following vulnerability has been resolved: gfs2: move quota_init qc iterat…

In the Linux kernel, the following vulnerability has been resolved: gfs2: move quota_init qc iterator increment Move qc++ from the loop body into the for-loop increment expression in gfs2_quota_init(). This keeps iterator progression explicit and avoids mixing pointer advance with duplicate-slot handling in the loop body.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97513] In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Rele…

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2m_ctx after Instance Removed from List Possible use after free if IRQ thread manages to obtain spinlock between m2m_ctx release and wave5_release function removing stream instance from list of active instances. The IRQ thread looks for the m2m_ctx which is freed so null pointer dereference oc…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97508] In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Set tb->root_switc…

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Set tb->root_switch to NULL when domain is stopped Similarly what we do with the firmware connection manager. This makes tb_xdp_handle_request() return error to the remote host. However, we need to make sure we keep the uuid alive so that we can reply until the whole domain is released.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97509] In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep XDomain refer…

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep XDomain reference during the lifetime of a service This is needed because we release the service ID in tb_service_release() and the ID array is owned by the parent XDomain.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97496] In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix OOB memory expo…

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix OOB memory exposure in get_wave_state() The get_wave_state() function for v9 trusts cp_hqd_cntl_stack_size and cp_hqd_cntl_stack_offset values read directly from the MQD, which are written by GPU microcode and fully attacker-controlled on the CRIU-restore path (via AMDKFD_IOC_RESTORE_PROCESS with H3). this leads…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97497] In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for al…

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id allocate_sdma_queue has an option where the sdma queue id can be specified (used by CRIU). We weren't bounds-checking that value. Confirm it's less than the maximum number of queues.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97478] In the Linux kernel, the following vulnerability has been resolved: virt: acrn: Fix irqfd use-after…

In the Linux kernel, the following vulnerability has been resolved: virt: acrn: Fix irqfd use-after-free during eventfd shutdown acrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free the same struct hsm_irqfd: CPU0 CPU1 ---- ---- eventfd_release() wake_up_poll(EPOLLHUP) hsm_irqfd_wakeup() q…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97474] In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: purge async…

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: purge async notifications upon nic error This fixes a kernel panic in reconfig failure: 1. we have a BSS connection 2. we have a NAN connection 3. FW error occurs 4. reconfig restores the BSS connection 5. however, restoring the NAN connection fails due to a FW error. 6. erroneously, ieee80211_handle_reconfi…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97448] In the Linux kernel, the following vulnerability has been resolved: ACPICA: Add validation for node…

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Add validation for node in acpi_ns_build_normalized_path() Add validation for node in acpi_ns_build_normalized_path() to prevent use-after-free vulnerabilities.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97450] In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object…

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object type in two places ACPICA: validate handler object type in acpi_ev_has_default_handler() and acpi_ev_find_region_handler().

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97451] In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in…

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy().

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97452] In the Linux kernel, the following vulnerability has been resolved: ACPICA: Prevent adding invalid …

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Prevent adding invalid references Prevent adding references for local, argument, and debug objects in acpi_ut_copy_simple_object().

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97454] In the Linux kernel, the following vulnerability has been resolved: ACPICA: add boundary checks in …

In the Linux kernel, the following vulnerability has been resolved: ACPICA: add boundary checks in acpi_ps_get_next_field() Add boundary checks in acpi_ps_get_next_field() to prevent out-of-bounds access.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97455] In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in a…

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() Fix use-after-free issue in acpi_ds_terminate_control_method() by clearing references to method locals and arguments.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97442] In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix invalid data …

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields in the header within the ath11k_dp_rx_h_undecap_nwifi() function for the DP_RX_DECAP_TYPE_NATIVE…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97444] In the Linux kernel, the following vulnerability has been resolved: ACPICA: add boundary checks in …

In the Linux kernel, the following vulnerability has been resolved: ACPICA: add boundary checks in two places Add boundary checks in acpi_ps_get_next_namestring() and acpi_ps_peek_opcode() to prevent out-of-bounds access.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97445] In the Linux kernel, the following vulnerability has been resolved: ACPICA: Enhance buffer validati…

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() Enhance buffer validation in acpi_ut_walk_aml_resources() to prevent buffer overflows.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97433] In the Linux kernel, the following vulnerability has been resolved: nvme: validate FDP configuratio…

In the Linux kernel, the following vulnerability has been resolved: nvme: validate FDP configuration descriptor sizes Validate descriptor sizes while walking the FDP configurations log so dsze == 0 or a descriptor past the log end cannot cause unbounded iteration or reads past the buffer.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97437] In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read i…

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() The bounds check in ntfs_dir_emit() compares fname->name_len (a character count) against e->size (a byte count) without accounting for the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME header size: if (fname->name_len + sizeof(struct NTFS_DE) > l…

nvdaltovulnerabilidad CVSS 7.1 NVD