Alertas de Seguridad de la Información

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90037] In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-…

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during close_lru reaping An nfs4_openowner left on nn->close_lru after its final CLOSE keeps its last closed stateid in oo_last_closed_stid, holding only a raw pointer to its nfs4_client. The laundromat reaps timed-out entries, drops nn->client_lock, and calls nfs4_put_stid(), which dereferenc…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90022] In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi2: fix use-a…

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi2: fix use-after-free in string attribute show path f_midi2_opts_str_show() takes the string lock internally, but its callers dereference the opts->info. pointer before calling it, outside the lock. This races with f_midi2_opts_str_store(), which frees the old string under opts->lock when the attribute …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90025] In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: …

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix OOB altmode array index The UCSI displayport driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMOD…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90026] In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic: cancel r…

In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic: cancel reset_work on stop pdphy_stop() disables IRQs but leaves reset_work pending. If the IRQ handler schedules it just before disable_irq(), the work runs after remove() frees the struct via devm. Call cancel_work_sync() after disabling IRQs to close the window. This issue was found by an in-house sta…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90027] In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic-typec: di…

In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop cc_debounce_dwork is queued from the set_cc() and start_toggling() callbacks, which run from TCPM's kthread worker. port_stop() returns before tcpm_unregister_port() destroys that worker. Flushing the worker during unregister may therefore run a callback which queu…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90014] In the Linux kernel, the following vulnerability has been resolved: tracing: Have show_event_filter…

In the Linux kernel, the following vulnerability has been resolved: tracing: Have show_event_filters/triggers files take trace array ref The newly added files show_event_filters and show_event_triggers that show all filters or triggers that are set within the trace array do not take a reference for the trace array it is showing. Without taking a reference, the trace_array may be freed via "rmdir…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90016] In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB rea…

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() rtw_restruct_wmm_ie() scans in_ie for a WMM IE with: while (i < in_len) { ... if (i + 5 < in_len && in_ie[i] == 0xDD && ...) { ... break; } i += (in_ie[i + 1] + 2); /* to the next IE element */ } When the "i + 5 < in_len" match check fails simply because…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90017] In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB rea…

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() rtw_action_frame_parse() takes a frame_len parameter but never actually checks it before indexing into the frame body: const u8 *frame_body = frame + sizeof(struct ieee80211_hdr_3addr); ... c = frame_body[0]; ... a = frame_body[1]; frame_body already points 24 b…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90018] In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB rea…

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() rtw_get_wps_attr() walks WPS attributes inside a WPS IE taken from a wireless management frame. For each candidate attribute it only checks that the fixed 4-byte attribute header (2-byte ID + 2-byte length) fits inside the IE: if (attr_ptr + 4 > wps_ie + w…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90007] In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback inde…

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001_request_msix() unwinds previously registered handlers with free_irq() when request_irq() fails. The rollback loop uses the failing index i for every iteration instead of the already registered vector index j. That passes the wrong IRQ/dev_id pair to free_irq() a…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90008] In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Limit NVMe …

In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame megasas_make_prp_nvme() builds a command's PRP list in cmd->sg_frame, a DMA pool buffer of instance->max_chain_frame_sz bytes, spending one entry per NVMe page of the transfer plus one per page of the buffer for the chain pointer. The loop runs until the transfer…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90009] In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in io_uri…

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Fix TOCTOU in io_uring passthrough command setup scsi_bsg_uring_cmd() reads bsg_uring_cmd from the shared mmap'd SQE. Userspace can change a field after we check it and before we use it. request_len is the sharp case: it can grow past sizeof(scmd->cmnd) after the bound check and overflow scmd->cmnd in copy_from_user()…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90010] In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap io_uring sense c…

In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Cap io_uring sense copy to max_response_len Completion copied scmd->sense_len to the user response buffer without honoring max_response_len. After a valid sense, the midlayer sets sense_len to the real length (up to SCSI_SENSE_BUFFERSIZE), so a smaller user buffer was overrun.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90011] In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a …

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test is '>' and login->req_buf is allocated with exactly MAX_KEY_VALUE_PAIRS bytes. Since iscsit_get_login_rx() receives payload_length + padding…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90012] In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership …

In the Linux kernel, the following vulnerability has been resolved: spi: Fix DMA mapping ownership on partial map failure If RX mapping fails after TX mapping succeeds, __spi_map_msg() unmaps TX but leaves tx_sg_mapped set. If TX mapping fails on a later transfer, mappings created for earlier transfers remain active. In both cases, cur_{tx,rx}_dma_dev have not yet been updated because they are …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90013] In the Linux kernel, the following vulnerability has been resolved: tracing: Take trace_array refer…

In the Linux kernel, the following vulnerability has been resolved: tracing: Take trace_array reference when opening options file The options files do not take the trace_array reference for the options they represent. This could cause a use-after-free kernel crash if one of these files is opened by one task and another task removes the instance that the option is for. Because it doesn't take a r…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90002] In the Linux kernel, the following vulnerability has been resolved: ftrace: Take trace_array refere…

In the Linux kernel, the following vulnerability has been resolved: ftrace: Take trace_array reference before accessing its ftrace_ops The trace instance files set_ftrace_filter and set_ftrace_notrace was updated to work with specific trace instances (trace_arrays). The issue is that when these files are opened, there is a small race window where it will use the ftrace_ops from the inode->privat…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90003] In the Linux kernel, the following vulnerability has been resolved: futex: Prevent rcuwait use-afte…

In the Linux kernel, the following vulnerability has been resolved: futex: Prevent rcuwait use-after-free during requeue PI On PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report (slab-out-of-bounds) in futex_requeue_pi_complete() invocation of rcuwait_wake_up(). The futex_q used by futex_wait_requeue_pi() is allocated on the waiter's stack. An early wakeup can race with a PI requeue as…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89998] In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and u…

In the Linux kernel, the following vulnerability has been resolved: dm: fix race when loading and unloading a table If the userspace calls two concurrent table load ioctls and one of them succeeds and the other fails, there is a race condition because dm_setup_md_queue walks &md->table_devices without any lock. If the walk races with dm_table_destroy -> free_devices -> dm_put_table_device, there…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89999] In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report len…

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: validate report length in wacom_intuos_pro2_bt_irq wacom_intuos_pro2_bt_irq() receives the wire report length in `len` but never consults it before parsing. After the report-id gate it unconditionally calls wacom_intuos_pro2_bt_pen() and then, selected by features.type, a fixed chain of sub-parsers, none of which rec…

nvdaltovulnerabilidad CVSS 8.1 NVD