Alertas de Seguridad de la Información

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53151] In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to ex…

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents o…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53131] In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC…

In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb…

nvdcriticovulnerabilidad CVSS 9.4 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53086] In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeo…

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53088] In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix off-by-one i…

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb The write_ptr points to the next open tx_cb. We want to return the tx_cb that gets rewinded, so we must rewind the pointer first then return the tx_cb that it points to. That way the txcb can be correctly cleaned up.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53055] In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - preven…

In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - prevent req used-after-free for sec During packet transmission, if the system is under heavy load, the hardware might complete processing the packet and free the request memory (req) before the transmission function finishes. If the software subsequently accesses this req, a use-after-free error will occ…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53043] In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregio…

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregions in dlm_match_regions() Patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()". In dlm_match_regions(), the qr_numregions field from a DLM_QUERY_REGION network message is used to drive loops over the qr_regions buffer without sufficient validation. This series fixes two issues: - Patch …

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53045] In the Linux kernel, the following vulnerability has been resolved: memory: tegra124-emc: Fix dll_c…

In the Linux kernel, the following vulnerability has been resolved: memory: tegra124-emc: Fix dll_change check The code checking whether the specified memory timing enables DLL in the EMRS register was reversed. DLL is enabled if bit A0 is low. Fix the check.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53046] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from …

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine ksmbd_crypt_message() sets a NULL completion callback on AEAD requests and does not handle the -EINPROGRESS return code from async hardware crypto engines like the Qualcomm Crypto Engine (QCE). When QCE returns -EINPROGRESS, ksmbd treats it as an error and imm…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53049] In the Linux kernel, the following vulnerability has been resolved: gfs2: add some missing log lock…

In the Linux kernel, the following vulnerability has been resolved: gfs2: add some missing log locking Function gfs2_logd() calls the log flushing functions gfs2_ail1_start(), gfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock, but these functions require exclusion against concurrent transactions. To fix that, add a non-locking __gfs2_log_flush() function. Then, in …

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53010] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in sm…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_open during durable reconnect In smb2_open, the call to ksmbd_put_durable_fd(fp) drops the reference to the durable file descriptor early during the durable reconnect process. If an error occurs subsequently (eg, ksmbd_iov_pin_rsp fails) or a scavenger accesses the file, it leads to a use-after-…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52993] In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_b…

In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local variable which was a copy of the caller's skb pointer. If the skb was reallocated and validation subsequently failed, the e…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52999] In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix o…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once and passed by reference to nf_osf_match_one() for each fingerprint checked. During TCP option parsing, nf_osf_match_one() advances the shared ctx->optp pointer. If a fingerprint perfectly match…

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52986] In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: do…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: don't use simple_strtoul Replace unsafe port parsing in epaddr_len(), ct_sip_parse_header_uri(), and ct_sip_parse_request() with a new sip_parse_port() helper that validates each digit against the buffer limit, eliminating the use of simple_strtoul() which assumes NUL-terminated strings. The previou…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52989] In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_…

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occ…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52982] In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-afte…

In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit() when accessing skb->len for tx statistics after usb_submit_urb() has been called: BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x760 drivers/net/usb/rtl8150.c:712 Read of …

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52958] In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-b…

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When decoding osd_state and osd_weight from an incoming osdmap in osdmap_decode(), both are decoded for each osd, i.e., map->max_osd times. The ceph_decode_need() check only accounts for sizeof(*map->osd_weight) once. This can potentially result in an out-of-bounds m…

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52955] In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-b…

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. If the values in these two fields differ, an out-of-bounds access can occur. This is the case because the first algorithm field (alg) is use…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52931] In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a nod…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52924] In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale C…

In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless …

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52914] In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reasse…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the i…

nvdcriticovulnerabilidad CVSS 9.8 NVD