Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64406] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in bt_accept_dequeue() bt_accept_get() takes a temporary reference before dropping the accept queue lock. bt_accept_dequeue() currently drops that reference before bt_accept_unlink(), leaving only the queue reference. bt_accept_unlink() drops the queue reference. The subsequent sock_hold() therefore accesses …

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64408] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP conn…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: pin L2CAP connection during netdev registration bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64411] In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate …

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before find_table_lock() update_counters() and compat_update_counters() forward a user-supplied 32-byte table name to find_table_lock() without NUL-terminating it. On a lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s", "ebtable_", name), and vsnprintf() reads pas…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64412] In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module nam…

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: module names must be null-terminated We need to explicitly check the length, else we may pass non-null terminated string to request_module().

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64396] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct file_l…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILE_LOCK_DEFERRED path, ksmbd registers the asynchronous work into the connection's async_requests list via setup_async_work(). The cancel callback smb2_remove_blocked_lock() holds a reference to…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64398] In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check f…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTL_SET_ZERO_DATA FSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via ksmbd_vfs_zero_data() -> vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after checking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no per-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES still y…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64400] In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal b…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: prevent path traversal bypass by restricting caseless retry ksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path resolution within the share root. When a crafted path attempts to escape the share boundary using parent-directory components ('..'), vfs_path_parent_lookup() detects this and immediately fails, ret…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64401] In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon f…

In the Linux kernel, the following vulnerability has been resolved: smb: client: resolve SWN tcon from live registrations cifs_swn_notify() looks up a witness registration by id under cifs_swnreg_idr_mutex, drops the mutex, and then uses the registration's cached tcon pointer. That pointer is not a lifetime reference, and it is not a stable representative once cifs_get_swn_reg() lets multiple t…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64402] In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OO…

In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() When the SMB sink is used as a perf AUX sink, smb_update_buffer() calls smb_sync_perf_buffer() to copy hardware trace data into the perf AUX ring buffer pages. It derives pg_idx = head >> PAGE_SHIFT from @head, which is handle->head, and indexes dst_pages[pg_idx]. …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64403] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate opti…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate option length before reading conf opt value l2cap_get_conf_opt() derives the option length from the attacker-controlled opt->len field and immediately dereferences opt->val (as u8, get_unaligned_le16() or get_unaligned_le32(), or a raw pointer for the default case) before any caller has confirmed that …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64388] In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp wit…

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership (chown) and group (chgrp) modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were also explicitly set. Fix this by checking for posix_extensions in cifs_setattr_nounix() when updating UI…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64389] In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbd_auth_ntlmv2() derives the NTLMv2 session key into sess->sess_key before it verifies the NTLMv2 response. ksmbd_decode_ntlmssp_auth_blob() then continues into KEY_XCH even when ksmbd_auth_ntlmv2() failed. With SMB3 multichannel binding, the failed authentication o…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64390] In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection own…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2_LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths, however, remove the connection list entry while holding fp->conn->llist_lock. With SMB3 multichanne…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64394] In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITE_DAC/WRITE_OW…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY commit cc57232cae23 ("ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE") added a fp->daccess gate to fsctl_set_sparse and noted that "similar handle-level checks exist in other functions but are missing here." The SMB2 SET_INFO…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64395] In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read acce…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to vfs_clone_file_range() or vfs_copy_file_range() without checking the SMB access mask granted to the source handle. A handle opened with attribute access can consequently be used to copy file contents into an…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64379] In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provid…

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parse_dacl() applies the server-provided sub_auth[2] value from the NFS mode SID to cf_mode without masking to 07777. Apply the correct masking, same as in the read path.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64380] In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID l…

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64382] In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in…

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_open() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_open_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale fre…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64372] In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-fre…

In the Linux kernel, the following vulnerability has been resolved: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the two-phase _OSC negotiation. Between the two calls it freed output.pointer but left output.length unchanged. Since acpi_evaluate_object() treats a non-zero length with a non-NULL pointer as an existi…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64374] In the Linux kernel, the following vulnerability has been resolved: sched/rt: Have RT_PUSH_IPI be d…

In the Linux kernel, the following vulnerability has been resolved: sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT RT migration is done aggressively. When a CPU schedules out a high priority RT task for a lower priority task, it will look to see if there's any RT tasks that are waiting to run on another CPU that is of higher priority than the task this CPU is about to run. If it fi…

nvdaltovulnerabilidad CVSS 7.5 NVD