Alertas de Seguridad de la Información

L Alto vulnerabilidad

19/07/2026

[CVE-2026-63797] In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free…

In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsg_chrdev_probe() stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsg_chrdev_eptdev_add(). If rpmsg_chrdev_eptdev_add() then fails, its error path frees eptdev while the default endpoint may still dispatch callbacks with the stale pr…

nvdaltovulnerabilidad CVSS 8.4 NVD

L Crítico vulnerabilidad

19/07/2026

[CVE-2026-63800] In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnf…

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs_update_layout() When hitting the NFS_LAYOUT_RETURN branch in pnfs_update_layout(), the code calls pnfs_prepare_to_retry_layoutget(lo). If it succeeds, pnfs_put_layout_hdr(lo) is called before trace_pnfs_update_layout(), which still references 'lo'. This results in a use-after-free when the tracep…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-63801] In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free R…

In the Linux kernel, the following vulnerability has been resolved: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to crypto_aead_decrypt(req) without taking a reference on the netns, unlike the encrypt path. When crypto_aead_decrypt() is offloaded asynchronously (e.g. the SIMD aead wrapper queuing to cryptd), the cryptd wo…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-63802] In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_…

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush() removes another blkg's iostat entries via llist_del_all(). The second blkg sees an empty list and proceeds to free itself while the first…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-63803] In the Linux kernel, the following vulnerability has been resolved: hdlc_ppp: sync per-proto timers…

In the Linux kernel, the following vulnerability has been resolved: hdlc_ppp: sync per-proto timers before freeing hdlc state Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp registers a timer via timer_setup(). That struct ppp is the hdlc->state allocation, which detach_hdlc_protocol() frees with kfree() in both teardown paths: unregister_hdlc_device() and the re-attach inside…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53401] In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-fre…

In the Linux kernel, the following vulnerability has been resolved: fbdev: omap2: fix use-after-free in omapfb_mmap omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that can lead to use-after-free: The fb_mmap() entry point holds mm_lock but not lock (fb_info->lock), while ioctl handlers like OMAPFB_SETUP_PLANE hold lock but not mm_lock. This allows concurrent execution. In oma…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-63793] In the Linux kernel, the following vulnerability has been resolved: ntfs: serialize volume label ac…

In the Linux kernel, the following vulnerability has been resolved: ntfs: serialize volume label accesses Protect vol->volume_label with a mutex and snaphost the label before copy_to_user. This prevent a use-after-free when FS_IOC_SETFSLABEL replaces the vol->volume_label and FS_IOC_GETTSLABEL reads it concurrently.

nvdaltovulnerabilidad CVSS 7.8 NVD

L Crítico vulnerabilidad

19/07/2026

[CVE-2026-63795] In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_…

In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_client_walk() error path When p9_client_walk() is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunk_fid, which currently calls p9_fid_put(fid) unconditionally. This drops a reference to oldfid even thou…

nvdcriticovulnerabilidad CVSS 10.0 NVD

L Crítico vulnerabilidad

19/07/2026

[CVE-2026-53384] In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dw: unregister 825…

In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails dw8250_probe() registers the 8250 port via serial8250_register_8250_port() and then, if the device has a clock, registers a clock notifier. If clk_notifier_register() fails, probe returns the error but leaves the 8250 port registered. The matching serial8250_…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53388] In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before re…

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end the request and free the fuse_io_args (eg fuse_readpages_end()) while the subsequent copy chain logic after fuse_try_move_folio() accesses th…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53389] In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free …

In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of key in del_async path In tcp_ao_delete_key(), the del_async path skips the current_key and rnext_key validity checks present in the synchronous path, assuming these pointers are always NULL on LISTEN sockets. However, if a key was added with set_current=1/set_rnext=1 while the socket was in CLO…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53381] In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount u…

In the Linux kernel, the following vulnerability has been resolved: virtiofs: fix UAF on submount umount iput() called from fuse_release_end() can Oops if the super block has already been destroyed. Normally this is prevented by waiting for num_waiting to go down to zero before commencing with super block shutdown. This only works, however, for the last submount instance, as the wait counter i…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-58598] Concurrent execution using shared resource with improper synchronization ('race condition') in Windo…

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-57076] YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an…

YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor. In the bundled libsyck an anchor name allocated by syck_strndup is stored both as node->anchor, freed when the node is freed, and as the key in the parser's anchors table. Freeing the node frees the shared key, and a later anchor redefinition makes st_del…

nvdaltovulnerabilidad CVSS 7.8 NVD

G Crítico vulnerabilidad

14/07/2026

[CVE-2026-15773] Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker…

Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Alto vulnerabilidad

14/07/2026

[CVE-2026-15774] Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had co…

Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

14/07/2026

[CVE-2026-15777] Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who…

Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

14/07/2026

[CVE-2026-15772] Use after free in GPU in Google Chrome on Android prior to 150.0.7871.125 allowed a remote attacker …

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

14/07/2026

[CVE-2026-15764] Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker …

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

14/07/2026

[CVE-2026-15765] Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convi…

Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 7.5 NVD