Alertas de Seguridad de la Información

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52989] In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_…

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue) and returns early. However, because the function returns void, the callers are entirely unaware that a fatal error has occ…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52982] In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-afte…

In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit() syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit() when accessing skb->len for tx statistics after usb_submit_urb() has been called: BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x760 drivers/net/usb/rtl8150.c:712 Read of …

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52958] In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-b…

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in osdmap_decode() When decoding osd_state and osd_weight from an incoming osdmap in osdmap_decode(), both are decoded for each osd, i.e., map->max_osd times. The ceph_decode_need() check only accounts for sizeof(*map->osd_weight) once. This can potentially result in an out-of-bounds m…

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52955] In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-b…

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. If the values in these two fields differ, an out-of-bounds access can occur. This is the case because the first algorithm field (alg) is use…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52931] In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a nod…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52924] In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale C…

In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless …

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52914] In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reasse…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the i…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

09/06/2026

[CVE-2026-48303] Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Auth…

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

L Crítico vulnerabilidad

09/06/2026

[CVE-2026-46325] In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conver…

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, …

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

09/06/2026

[CVE-2026-46316] In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the …

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's reference on each entry with vgic_put_irq(). It puts the iterated pointer, though, rather than the value returned by xa_erase(). The functi…

nvdcriticovulnerabilidad CVSS 9.3 NVD

G Crítico vulnerabilidad

09/06/2026

[CVE-2026-11659] Integer overflow in UI in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker t…

Integer overflow in UI in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

L Crítico vulnerabilidad

08/06/2026

[CVE-2026-46289] In the Linux kernel, the following vulnerability has been resolved: lib/scatterlist: fix length cal…

In the Linux kernel, the following vulnerability has been resolved: lib/scatterlist: fix length calculations in extract_kvec_to_sg Patch series "Fix bugs in extract_iter_to_sg()", v3. Fix bugs in the kvec and user variants of extract_iter_to_sg. This series is growing due to useful remarks made by sashiko.dev. The main bugs are: - The length for an sglist entry when extracting from a kvec c…

nvdcriticovulnerabilidad CVSS 9.8 NVD

G Crítico vulnerabilidad

05/06/2026

[CVE-2026-11282] Insufficient policy enforcement in Sandbox in Google Chrome on Linux prior to 149.0.7827.53 allowed …

Insufficient policy enforcement in Sandbox in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

04/06/2026

[CVE-2026-11112] Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.78…

Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

04/06/2026

[CVE-2026-10972] Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker t…

Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

L Crítico vulnerabilidad

03/06/2026

[CVE-2026-46266] In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO…

In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous. socket(AF_INET, SOCK_RAW, 255); A malicious incoming ICMP packet can set the protocol field to 255 and match this socket, leading to FNHE cache changes. inner = IP(s…

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Crítico vulnerabilidad

03/06/2026

[CVE-2026-46244] In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 …

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all extension headers, but the result is immediately overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only accounts for the IPv6 base h…

nvdcriticovulnerabilidad CVSS 9.1 NVD