Alertas de Seguridad de la Información

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64098] In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible…

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible resv lock for plane updates virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and ignore its return value. The function can fail with -EINTR from dma_resv_lock_interruptible() (signal during lock wait) or with -ENOM…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64099] In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of …

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree() on cpu_job's timestamp and performance query arrays after v3d_job_cleanup(), which drops the job's last reference and frees cpu_job. Reading cpu_job at that point is a use-after-free. Also, on the early v3d_job_init() …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64076] In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: eb_tables: c…

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: eb_tables: close module init race sashiko reports for unrelated patch: Does the core ebtables initialization in ebtables.c suffer from a similar race? Once nf_register_sockopt() completes, the sockopts are exposed globally. sockopt has to be registered last, just like in ip/ip6/arptables.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64082] In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption …

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption from uninitialized cregs on error compat_riscv_gpr_set() calls cregs_to_regs() unconditionally, even when user_regset_copyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task's pt_regs, corrupting its registe…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64056] In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX…

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmac_rx() is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device is using both. Make the RX SKB a per-port variable and carry it over between invocations in the p…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64048] In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT t…

In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] == NUL…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64051] In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check …

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remap_pfn_range during mmap The call to remap_pfn_range in qaic_gem_object_mmap is susceptible to (re)mapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap() unmaps only the VMA region and not the additional mappings. To prevent this, check the remaining…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64044] In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in …

In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMD_NEW_PEER error path ovpn_nl_peer_new_doit()'s error path calls ovpn_peer_release() directly rather than ovpn_peer_put(), bypassing the kref. The accompanying comment ("peer was not yet hashed, thus it is not used in any context") holds for UDP but not for TCP. For UDP, the ovpn_socket union us…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64033] In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free i…

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and srv_path->kobj may already have been initialized. If a later step fails, the cleanup currently calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sys…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64035] In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD…

In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igc_fpe_init_smd_frame() initializes igc_tx_buffer fields for an SMD skb, but does not set the buffer type: https://sashiko.dev/#/patchset/20260415025226.114115-1-kohei%40enjuk.jp Since igc_tx_buffer entries are reused, a stale XDP or XSK type can remain and make T…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64025] In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data…

In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and defers to psock->saved_data_ready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership of the receive queue (commit e91de6afa81c, "bpf: Fix running sk_skb program types w…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64029] In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output…

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with event_input seq_ump_process_event() borrows client->out_rfile.output without synchronizing with the first-open and last-close transition in seq_ump_client_open() and seq_ump_client_close(). The last output unuse can therefore drop opened[STR_OUT] to zero and release the rawmidi file…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64015] In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU r…

In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assoc_array_find() in find_key_to_update() without holding the RCU read lock, while the assoc_array_gc() code really is designed around removing the node from the tree and then freeing it after an RCU grace-period. The regu…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64005] In the Linux kernel, the following vulnerability has been resolved: net/smc: Do not re-initialize s…

In the Linux kernel, the following vulnerability has been resolved: net/smc: Do not re-initialize smc hashtables INIT_HLIST_HEAD(&smc_v*_hashinfo.ht) are called after smc_nl_init(), proto_register() and sock_register(). This can lead to smc_v*_hashinfo.ht being reset even though hash entries already exist and are being used, possibly resulting in a corrupted list. Remove unnecessary and dangero…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63994] In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers a…

In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_c…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63979] In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pin…

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to accept_doit handshake_req_next() removes the request from the per-net pending list and drops hn_lock before handshake_nl_accept_doit() reads req->hr_sk->sk_socket and dereferences sock->file (once in FD_PREPARE() and again in get_file()). In that window a consumer running tls…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63978] In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending re…

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to list_splice_init() in handshake_net_exit() are reversed. The call moves the local empty "requests" list onto hn->hn_requests, leaving the local list empty, so the subsequent drain loop runs zero iterations. Pending handshake requests that had not yet be…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63968] In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loo…

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6_select_path() Found while auditing the same pattern Sashiko reported in rt6_fill_node() [1]. Apply the same fix as commit f8d8ce1b515a ("ipv6: fix possible infinite loop in fib6_info_uses_dev()"). Writers holding tb6_lock can list_del_rcu(&first->fib6_siblings) without waiting for RCU re…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63954] In the Linux kernel, the following vulnerability has been resolved: hpfs: fix a crash if hpfs_map_d…

In the Linux kernel, the following vulnerability has been resolved: hpfs: fix a crash if hpfs_map_dnode_bitmap fails If hpfs_map_dnode_bitmap fails, the code would call hpfs_brelse4 on uninitialized quad buffer head, causing a crash.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63950] In the Linux kernel, the following vulnerability has been resolved: mm/rmap: initialize nr_pages to…

In the Linux kernel, the following vulnerability has been resolved: mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one Initialize nr_pages to 1 at the start of each loop iteration, like folio_referenced_one() does. Without this, nr_pages computed by a previous folio_unmap_pte_batch() call can be reused on a later iteration that does not run folio_unmap_pte_batch() again. mmap …

nvdaltovulnerabilidad CVSS 7.8 NVD