Alertas de Seguridad de la Información

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53216] In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame siz…

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising P…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53221] In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel m…

In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any loc…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53186] In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense c…

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSI…

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53175] In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free…

In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53176] In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs sho…

In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53151] In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to ex…

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix the ACK parser to extract the SACK table for parsing Fix modification of the received skbuff in rxrpc_input_soft_acks() and a potential incorrect access of the buffer in a fragmented UDP packet (the packet would probably have to be deliberately pre-generated as fragmented) when AF_RXRPC tries to extract the contents o…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53131] In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC…

In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb…

nvdcriticovulnerabilidad CVSS 9.4 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53086] In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeo…

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53088] In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix off-by-one i…

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb The write_ptr points to the next open tx_cb. We want to return the tx_cb that gets rewinded, so we must rewind the pointer first then return the tx_cb that it points to. That way the txcb can be correctly cleaned up.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53055] In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - preven…

In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - prevent req used-after-free for sec During packet transmission, if the system is under heavy load, the hardware might complete processing the packet and free the request memory (req) before the transmission function finishes. If the software subsequently accesses this req, a use-after-free error will occ…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53043] In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregio…

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregions in dlm_match_regions() Patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()". In dlm_match_regions(), the qr_numregions field from a DLM_QUERY_REGION network message is used to drive loops over the qr_regions buffer without sufficient validation. This series fixes two issues: - Patch …

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53045] In the Linux kernel, the following vulnerability has been resolved: memory: tegra124-emc: Fix dll_c…

In the Linux kernel, the following vulnerability has been resolved: memory: tegra124-emc: Fix dll_change check The code checking whether the specified memory timing enables DLL in the EMRS register was reversed. DLL is enabled if bit A0 is low. Fix the check.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53046] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from …

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine ksmbd_crypt_message() sets a NULL completion callback on AEAD requests and does not handle the -EINPROGRESS return code from async hardware crypto engines like the Qualcomm Crypto Engine (QCE). When QCE returns -EINPROGRESS, ksmbd treats it as an error and imm…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53049] In the Linux kernel, the following vulnerability has been resolved: gfs2: add some missing log lock…

In the Linux kernel, the following vulnerability has been resolved: gfs2: add some missing log locking Function gfs2_logd() calls the log flushing functions gfs2_ail1_start(), gfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock, but these functions require exclusion against concurrent transactions. To fix that, add a non-locking __gfs2_log_flush() function. Then, in …

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53010] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in sm…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_open during durable reconnect In smb2_open, the call to ksmbd_put_durable_fd(fp) drops the reference to the durable file descriptor early during the durable reconnect process. If an error occurs subsequently (eg, ksmbd_iov_pin_rsp fails) or a scavenger accesses the file, it leads to a use-after-…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53002] In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sp…

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: remove sprintf usage Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check. Increase buffer size in mangle_content_len() while at it. BUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270 Write of size 1 at addr [..] vsnpri…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53006] In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv…

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. Remove these temporary variables: - We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr when net_dbg_ratelimited() is called in the slow path. - Avoid potential future misuse after pskb_pul…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52993] In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_b…

In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local variable which was a copy of the caller's skb pointer. If the skb was reallocated and validation subsequently failed, the e…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52999] In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix o…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once and passed by reference to nf_osf_match_one() for each fingerprint checked. During TCP option parsing, nf_osf_match_one() advances the shared ctx->optp pointer. If a fingerprint perfectly match…

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52986] In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: do…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: don't use simple_strtoul Replace unsafe port parsing in epaddr_len(), ct_sip_parse_header_uri(), and ct_sip_parse_request() with a new sip_parse_port() helper that validates each digit against the buffer limit, eliminating the use of simple_strtoul() which assumes NUL-terminated strings. The previou…

nvdcriticovulnerabilidad CVSS 9.8 NVD