Alertas de Seguridad de la Información

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53050] In the Linux kernel, the following vulnerability has been resolved: quota: Fix race of dquot_scan_a…

In the Linux kernel, the following vulnerability has been resolved: quota: Fix race of dquot_scan_active() with quota deactivation dquot_scan_active() can race with quota deactivation in quota_release_workfn() like: CPU0 (quota_release_workfn) CPU1 (dquot_scan_active) ============================== ============================== spin_lock(&dq_list_lock); list_replace_init( …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53036] In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix off-by-one in c…

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix off-by-one in check_imm signed range check check_imm(bits, imm) is used in the arm64 BPF JIT to verify that a branch displacement (in arm64 instruction units) fits into the signed N-bit immediate field of a B, B.cond or CBZ/CBNZ encoding before it is handed to the encoder. The macro currently tests for (imm > 0 &…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53040] In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate bg_bits during …

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate bg_bits during freefrag scan [BUG] A crafted filesystem can trigger an out-of-bounds bitmap walk when OCFS2_IOC_INFO is issued with OCFS2_INFO_FL_NON_COHERENT. BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: use-after-free in _test_bit include/asm-generic…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53041] In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix listxattr handling w…

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix listxattr handling when the buffer is full [BUG] If an OCFS2 inode has both inline and block-based xattrs, listxattr() can return a size larger than the caller's buffer when the inline names consume that buffer exactly. kernel BUG at mm/usercopy.c:102! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:usercop…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53031] In the Linux kernel, the following vulnerability has been resolved: bpf: Validate node_id in arena_…

In the Linux kernel, the following vulnerability has been resolved: bpf: Validate node_id in arena_alloc_pages() arena_alloc_pages() accepts a plain int node_id and forwards it through the entire allocation chain without any bounds checking. Validate node_id before passing it down the allocation chain in arena_alloc_pages().

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53033] In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Take state lock f…

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Take state lock for af_unix iter When a BPF iterator program updates a sockmap, there is a race condition in unix_stream_bpf_update_proto() where the `peer` pointer can become stale[1] during a state transition TCP_ESTABLISHED -> TCP_CLOSE. CPU0 bpf CPU1 close -------- …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53020] In the Linux kernel, the following vulnerability has been resolved: um: Fix potential race conditio…

In the Linux kernel, the following vulnerability has been resolved: um: Fix potential race condition in TLB sync During the TLB sync, we need to traverse and modify the page table, so we should hold the page table lock. Since full SMP support for threads within the same process is still missing, let's disable the split page table lock for simplicity.

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53024] In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-fre…

In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free if write is called after disconnect If a user writes to the chardev after disconnect has been called, the kernel panics with the following trace (with CONFIG_INIT_ON_FREE_DEFAULT_ON=y): BUG: kernel NULL pointer dereference, address: 0000000000000218 ... Call Trace: …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53025] In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-fre…

In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free on cdev close This addresses a use-after-free bug when a raw bundle is disconnected but its chardev is still opened by an application. When the application releases the cdev, it causes the following panic when init on free is enabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y): refcount_t: underf…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53026] In the Linux kernel, the following vulnerability has been resolved: NFSD: fix nfs4_file access extr…

In the Linux kernel, the following vulnerability has been resolved: NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg In nfsd4_add_rdaccess_to_wrdeleg, if fp->fi_fds[O_RDONLY] is already set by another thread, __nfs4_file_get_access should not be called to increment the nfs4_file access count since that was already done by the thread that added READ access to the file. The …

nvdaltovulnerabilidad CVSS 7.5 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53010] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in sm…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_open during durable reconnect In smb2_open, the call to ksmbd_put_durable_fd(fp) drops the reference to the durable file descriptor early during the durable reconnect process. If an error occurs subsequently (eg, ksmbd_iov_pin_rsp fails) or a scavenger accesses the file, it leads to a use-after-…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53011] In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: fix use-afte…

In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch In advance_sched(), when should_change_schedules() returns true, switch_schedules() is called to promote the admin schedule to oper. switch_schedules() queues the old oper schedule for RCU freeing via call_rcu(), but 'next' still points into an entry of …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53016] In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skc…

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver. ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV buffer while RFC3686 skciphers expose an 8-byte IV, so the restore overruns the provided buffer. Use crypto_skcipher_ivsize() to copy only the al…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53003] In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 251…

In the Linux kernel, the following vulnerability has been resolved: pppoe: drop PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the current PPPoE driver assumes an uncompressed (2-byte) protocol field. However, the generic PPP layer function ppp_input() is not aware…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53004] In the Linux kernel, the following vulnerability has been resolved: sctp: fix OOB write to userspac…

In the Linux kernel, the following vulnerability has been resolved: sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks sctp_getsockopt_peer_auth_chunks() checks that the caller's optval buffer is large enough for the peer AUTH chunk list with if (len < num_chunks) return -EINVAL; but then writes num_chunks bytes to p->gauth_chunks, which lives at offset offset…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53005] In the Linux kernel, the following vulnerability has been resolved: af_unix: Drop all SCM attribute…

In the Linux kernel, the following vulnerability has been resolved: af_unix: Drop all SCM attributes for SOCKMAP. SOCKMAP can hide inflight fd from AF_UNIX GC. When a socket in SOCKMAP receives skb with inflight fd, sk_psock_verdict_data_ready() looks up the mapped socket and enqueue skb to its psock->ingress_skb. Since neither the old nor the new GC can inspect the psock queue, the hidden skb…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52992] In the Linux kernel, the following vulnerability has been resolved: fs/adfs: validate nzones in adf…

In the Linux kernel, the following vulnerability has been resolved: fs/adfs: validate nzones in adfs_validate_bblk() Reject ADFS disc records with a zero zone count during boot block validation, before the disc record is used. When nzones is 0, adfs_read_map() passes it to kmalloc_array(0, ...) which returns ZERO_SIZE_PTR, and adfs_map_layout() then writes to dm[-1], causing an out-of-bounds wr…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52993] In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_b…

In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipc_buf_append() tipc_msg_validate() can potentially reallocate the skb it is validating, freeing the old one. In tipc_buf_append(), it was being called with a pointer to a local variable which was a copy of the caller's skb pointer. If the skb was reallocated and validation subsequently failed, the e…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52998] In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix p…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check The nf_osf_ttl() function accessed skb->dev to perform a local interface address lookup without verifying that the device pointer was valid. Additionally, the implementation utilized an in_dev_for_each_ifa_rcu loop to match the packet source address against l…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52999] In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix o…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_osf: fix out-of-bounds read on option matching In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once and passed by reference to nf_osf_match_one() for each fingerprint checked. During TCP option parsing, nf_osf_match_one() advances the shared ctx->optp pointer. If a fingerprint perfectly match…

nvdcriticovulnerabilidad CVSS 9.1 NVD