Alertas de Seguridad de la Información

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64132] In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer…

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6_event() Reported by Sashiko: In ipv6_hop_ioam(), the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skb_ensure_writable(), which might reallocate the buffer: if (skb_ensure_writable(skb, optoff + 2 + hdr->opt_len)) goto drop; /* Tra…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64133] In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fix potential OOB…

In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fix potential OOB array access at reading cache find_control() to retrieve a cached info accesses the array with the given index blindly, which may lead to an OOB array access. Add a sanity check for avoiding it.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64134] In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Don't setup bogus io…

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Don't setup bogus iov_iter for silencing At transition to the iov_iter for PCM data transfer, we blindly applied the iov_iter setup also for silencing (i.e. data = NULL), and it leads to a calculation of bogus iov_iter. Fortunately this didn't cause troubles on most of architectures but it goes wrong on RISC-V now, c…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64136] In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count i…

In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock for tc_lock around tc_count changes. There was missing lock around tc_count increment inside smb2_find_smb_sess_tcon_unlocked().

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64137] In the Linux kernel, the following vulnerability has been resolved: smb: client: require net admin …

In the Linux kernel, the following vulnerability has been resolved: smb: client: require net admin for CIFS SWN netlink CIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The intended sender is the cifs.witness helper, but the generic-netlink operation currently has no capability flag, so any local process can send RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel wit…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64138] In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent s…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate SID in parent security descriptor during ACL inheritance Introduce smb_validate_ntsd_sid() helper to safely validate Owner SID and Group SID inside the NT Security Descriptor (smb_ntsd) retrieved from the parent directory.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64140] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer derefer…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in proc_show_files() When a SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSION_LOGOFF, session_fd_check() clears fp->tcon = NULL on the reconnectable file pointer but leaves the fp registered in global_ft.idr until the durable scavenger fires (up to fp->durable_time…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64141] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer derefer…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in compare_guid_key() session_fd_check() walks the per-inode m_op_list during durable-handle session teardown and sets op->conn = NULL for every opinfo whose conn matched the closing session's connection. The matching opinfo, however, stays linked in its per-ClientGuid lease_table_list entry's…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64124] In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bin…

In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be PAGE_SIZE multiples without checking: - tx_vec is sized dmabuf->size / PAGE_SIZE, and net_devmem_get_niov_at() only bounds-checks virt_addr < dmabuf->size before indexing tx_vec[…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64125] In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM…

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM disabled Setting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_CTRL breaks the RX path on GENET hardware once MAC EEE becomes active. RX traffic stops flowing while the link stays up and the usual descriptor/RX error counters remain quiet. In that state the MAC still accepts frames (rbuf_ovflow_cnt keep…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64126] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add E…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate Add Extended Advertising Data length MGMT_OP_ADD_EXT_ADV_DATA is registered as a variable-length command, with MGMT_ADD_EXT_ADV_DATA_SIZE as the fixed header size. The handler then uses cp->adv_data_len and cp->scan_rsp_len to validate and copy cp->data, but it never checks that those bytes are part of…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64116] In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for …

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() Reported by Sashiko: The function ipv6_hop_ioam() accesses __in6_dev_get(skb->dev)->cnf.ioam6_enabled without validating the returned idev pointer. Because addrconf_ifdown() can concurrently clear dev->ip6_ptr via RCU, __in6_dev_get() can return NULL during interface teardo…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64117] In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX…

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. In the unicast forward path, mesh_data does: info = IEEE80211_SKB_CB(fwd_skb); memset(in…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64118] In the Linux kernel, the following vulnerability has been resolved: qed: fix double free in qed_cxt…

In the Linux kernel, the following vulnerability has been resolved: qed: fix double free in qed_cxt_tables_alloc() If one of the later PF or VF CID bitmap allocations fails, qed_cid_map_alloc() jumps to cid_map_fail and frees the previously allocated CID bitmaps before returning an error. qed_cxt_tables_alloc() then calls qed_cxt_mngr_free(), which invokes qed_cid_map_free() again. Fix this by …

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64122] In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free i…

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover mlx5e_tx_reporter_timeout_recover() accesses sq->netdev after mlx5e_safe_reopen_channels() has torn down and freed the channel (and its embedded SQs). Replace the three sq->netdev references with priv->netdev which is safe because priv outlives channel teardown. …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64123] In the Linux kernel, the following vulnerability has been resolved: net: hsr: defer node table free…

In the Linux kernel, the following vulnerability has been resolved: net: hsr: defer node table free until after RCU readers HSR node-list and node-status generic-netlink operations run under rcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and hsr_get_node_data(), but RTM_DELLINK teardown removes the same node table with plain list_del() and frees each node immediately. That …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64108] In the Linux kernel, the following vulnerability has been resolved: cifs: Fix busy dentry used afte…

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix busy dentry used after unmounting Since commit 340cea84f691c ("cifs: open files should not hold ref on superblock"), cifs file only holds the dentry ref_cnt, the cifs file close work(cfile->deferred) could be executed after unmounting, which will trigger a warning in generic_shutdown_super: BUG: Dentry 00000000a14a684…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64109] In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix UAF read of tail->…

In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() unix_stream_data_wait() does skb_peek_tail(&sk->sk_receive_queue) without holding any lock that prevents SKBs on that queue from being dequeued and freed. This has been the case since commit 79f632c71bea ("unix/stream: fix peeking with an offset larger than data in qu…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64111] In the Linux kernel, the following vulnerability has been resolved: lsm: hold cred_guard_mutex for …

In the Linux kernel, the following vulnerability has been resolved: lsm: hold cred_guard_mutex for lsm_set_self_attr() Just as proc_pid_attr_write() already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptraced and if so, whether to allow the transition.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64112] In the Linux kernel, the following vulnerability has been resolved: rbd: eliminate a race in lock_d…

In the Linux kernel, the following vulnerability has been resolved: rbd: eliminate a race in lock_dwork draining on unmap Given how rbd_lock_add_request() and rbd_img_exclusive_lock() are written, lock_dwork may be (re)queued more than it's actually needed: for example in case a new I/O request comes in while we are in the middle of rbd_acquire_lock() on behalf of another I/O request. This is e…

nvdaltovulnerabilidad CVSS 7.8 NVD