Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64261] In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-fre…

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues fuse_uring_async_stop_queues() might run when the last reference on ring->queue_refs was already dropped. In order to avoid an early destruction a reference on struct fuse_conn is now taken before starting fuse_uring_async_stop_queues() and that reference is only …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64265] In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_…

In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req When fuse_resend() moves a request from fpq->processing back to fiq->pending, it sets FR_PENDING and clears FR_SENT but does not remove the requests intr_entry from fiq->interrupts. If the request had FR_INTERRUPTED set from a prior signal, intr_entry remains dan…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64266] In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before re…

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async end callback (eg fuse_writepage_free()) can free the args while the subsequent copy chain logic after fuse_ref_folio() accesses them, lead…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64255] In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate st…

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw_id_to_link_sta…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64247] In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the ba…

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the bank index when querying sparse banks When checking if a VP ID is included in a sparse bank set, explicitly check that the ID can actually be contained in a sparse bank (the TLFS allows for a maximum of 64 banks of 64 vCPUs each). When handling a paravirtual TLB flush for L2, the VP ID is copied ver…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64251] In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-fre…

In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() pwrseq_debugfs_seq_next() declares 'next' with __free(put_device), which causes put_device() to be called on the returned pointer when the variable goes out of scope. This results in a use-after-free since the seq_file framework receives a pointer whose reference has…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64243] In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: simple-mux: Fix e…

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: simple-mux: Fix enum control bounds check simple_mux_control_put() rejects values greater than e->items, but enum control values are zero based. For the two-entry mux used by this driver, valid values are 0 and 1, so value 2 must be rejected as well. Accepting e->items can store an invalid mux state, pass it to th…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64235] In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relat…

In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines With CONFIG_CALL_DEPTH_TRACKING enabled on an x86 retbleed-affected platform (eg: Skylake), with retbleed=stuff, registering a dynamic ftrace trampoline crashes on the first call into the traced function: BUG: unable to handle page fault for address: ffff88…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64226] In the Linux kernel, the following vulnerability has been resolved: sched_ext: Avoid UAF in scx_roo…

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path In scx_root_enable_workfn(), put_task_struct(p) is called before scx_error() dereferences p->comm and p->pid. If the iterator's reference is the last drop, the task is freed synchronously and the deref becomes a UAF. Move put_task_struct() past scx_error().

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64222] In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free…

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool->stack on AQ init failure otx2_pool_aq_init() frees pool->stack when mailbox sync or retry allocation fails, but leaves the pointer unchanged. Later, otx2_sq_aura_pool_init() unwinds the partial setup through otx2_aura_pool_free(), which frees pool->stack again. The CN20K-specific cn20k_po…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64223] In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only pr…

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements against the number of link-map entries indicated by link_map_presence. ieee80211_parse_neg_ttlm() must consume the same layout. The parser advanced its cursor for every TID, including TIDs whose prese…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64217] In the Linux kernel, the following vulnerability has been resolved: netfs: Fix overrun check in net…

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix overrun check in netfs_extract_user_iter() Fix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills pages[], then those pages don't get included in the iterator constructed at the end of the function. If there was an overfill, memory corruption has already happened.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64218] In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix report_wor…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix report_work leak on backbone_gw purge batadv_bla_purge_backbone_gw() removes stale backbone gateway entries, but fails to properly handle their associated report_work: - If report_work is running, the purge must wait for it to finish before freeing the backbone_gw, otherwise the worker may access freed me…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64219] In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate paylo…

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which is a no-op in release builds. If a caller ever passes length > 16 this results i…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64221] In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-fre…

In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-free after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to clear the DMA channel pointer also if buffer allocation fails to avoid passing a pointer to the released channel to the DMA engine (or trying to free the channel a second time on late probe er…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64208] In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of…

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AF_RXRPC to make use of this to validate DATA packets secured with RxGK.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64210] In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix unlocked wr…

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix unlocked writing to ICOSQ During napi poll, when the affinity changes and there's still XSK work to be done, we trigger an ICOSQ interrupt on the new CPU. However, this triggering on the ICOSQ is done unprotected. There are 2 such races: A) mlx5e_trigger_irq() is called while mlx5e_xsk_alloc_rx_mpwqe() is r…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-64600] In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork map…

In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-16607] A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before v…

A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for local privilege escalation to root of an already authenticated user on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

21/07/2026

[CVE-2026-16422] Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7…

Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7871.182 allowed an attacker in a privileged network position to perform domain spoofing via malicious network traffic. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.5 NVD