Alertas de Seguridad de la Información

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52950] In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: fix UAF with re…

In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: fix UAF with retry loop Retry doesn't work here, since bo will be freed on error, leading to UAF. However, now that we do the alloc & init before the attach, we can now combine this as one unit and have the init do the alloc for us. This should make the retry safe. Reported by Sashiko. v2: Fix up the error unwi…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52951] In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: handle empty bo…

In the Linux kernel, the following vulnerability has been resolved: drm/xe/dma-buf: handle empty bo and UAF races There look to be some nasty races here when triggering the invalidate_mappings hook: 1) We do xe_bo_alloc() followed by the attach, before the actual full bo init step in xe_dma_buf_init_obj(). However the bo is visible on the attachments list after the attach. This is bad si…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52952] In the Linux kernel, the following vulnerability has been resolved: iommu: Fix WARN_ON in __iommu_g…

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix WARN_ON in __iommu_group_set_domain_nofail() due to reset In __iommu_group_set_domain_internal(), concurrent domain attachments are rejected when any device in the group is recovering. This is necessary to fence concurrent attachments to a multi-device group where devices might share the same RID due to PCI DMA alias …

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52953] In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix oops due to out…

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix oops due to out of scope access Below oops triggers when kill QEMU process: Oops: general protection fault, probably for non-canonical address 0x7fffffff844eaaa7: 0000 [#1] SMP NOPTI Call Trace: do_raw_spin_lock+0xaa/0xc0 _raw_spin_lock_irqsave+0x21/0x40 domain_remove_dev_pasid+0x52/0x160 …

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52954] In the Linux kernel, the following vulnerability has been resolved: libceph: handle rbtree insertio…

In the Linux kernel, the following vulnerability has been resolved: libceph: handle rbtree insertion error in decode_choose_args() A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. The received CRUSH map may optionally contain choose_args that get decoded in decode_choose_args(). In this function, num_choose_arg_maps is read from the message, and a correspo…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52955] In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-b…

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. If the values in these two fields differ, an out-of-bounds access can occur. This is the case because the first algorithm field (alg) is use…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52956] In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-b…

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() In __ceph_x_decrypt(), a part of the buffer p is interpreted as a ceph_x_encrypt_header, and the magic field of this struct is accessed. This happens without any guarantee that the buffer is large enough to hold this struct. The function parameter ciphertext_len r…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52957] In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr…

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential null-ptr-deref in decode_choose_args() A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. When decoding this CRUSH map in crush_decode(), an array of max_buckets CRUSH buckets is decoded, where some indices may not refer to actual buckets and are therefore set to NULL.…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52945] In the Linux kernel, the following vulnerability has been resolved: Revert "wireguard: device: enab…

In the Linux kernel, the following vulnerability has been resolved: Revert "wireguard: device: enable threaded NAPI" This reverts commit 933466fc50a8e4eb167acbd0d8ec96a078462e9c which is commit db9ae3b6b43c79b1ba87eea849fd65efa05b4b2e upstream. We have had three independent production user reports in combination with Cilium utilizing WireGuard as encryption underneath that k8s Pod E/W traffic t…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52946] In the Linux kernel, the following vulnerability has been resolved: fs/fcntl: fix SOFTIRQ-unsafe lo…

In the Linux kernel, the following vulnerability has been resolved: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling A SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in send_sigio() and send_sigurg() when a process group receives a signal. When FASYNC is configured for a process group (PIDTYPE_PGID), both functions use read_lock(&tasklist_lock) to traverse the task list…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52947] In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturat…

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove In qrtr_port_remove(), the socket reference count is decremented via __sock_put() before the port is removed from the qrtr_ports XArray and before the RCU grace period elapses. This breaks the fundamental RCU update paradigm. It exposes a race window where…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52943] In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zeroco…

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskb_carve helpers pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy the old skb_shared_info header into a new buffer via memcpy(), which includes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs. Neither function calls net_zcopy_get() for the new shinfo,…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52942] In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC header was set before dumping it The fallback path of dump_mac_header() guards the MAC header access only with "skb->mac_header != skb->network_header", without checking skb_mac_header_was_set(). When the MAC header is unset, mac_header is 0xffff, so the test passes and skb_mac_header(skb) returns…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52929] In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back d…

In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the …

nvdaltovulnerabilidad CVSS 7.5 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52931] In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a nod…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52932] In the Linux kernel, the following vulnerability has been resolved: xfrm: ipcomp: Free destination …

In the Linux kernel, the following vulnerability has been resolved: xfrm: ipcomp: Free destination pages on acomp errors Move the out_free_req label up by a couple of lines so that the allocated dst SG list gets freed on error as well as success.

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52933] In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: fix signed compa…

In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: fix signed comparison in io_poll_get_ownership() io_poll_get_ownership() uses a signed comparison to check whether poll_refs has reached the threshold for the slowpath: if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS)) atomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG (BIT(31)) is se…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52934] In the Linux kernel, the following vulnerability has been resolved: batman-adv: tvlv: reject oversi…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tvlv: reject oversized TVLV packets batadv_tvlv_container_ogm_append() builds a TVLV packet section from the tvlv.container_list. The total size of this section is computed by batadv_tvlv_container_list_size(), which sums the sizes of all registered containers. The return type and accumulator in batadv_tvlv_containe…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52935] In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: do not reuse an…

In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: do not reuse an in-progress partial send espintcp keeps a single in-flight transmit in ctx->partial. Before building a new sk_msg, espintcp_sendmsg() first tries to flush that state through espintcp_push_msgs(). For blocking callers, espintcp_push_msgs() may return success even when the previous partial send is …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52922] In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: handle forward…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: handle forward allocation error batadv_dat_forward_data() calls pskb_copy_for_clone() to duplicate an skb for each DHT candidate, but does not check the return value before passing it to batadv_send_skb_prepare_unicast_4addr(). That function dereferences the skb unconditionally, so a failed allocation triggers a…

nvdaltovulnerabilidad CVSS 7.5 NVD