Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80747] In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check fo…

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype …

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80748] In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteratio…

In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(), the for_each_sg() macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry. However, the code incorrectly uses '&sg[i]' and 'sg_dma_len(&sg[i])' inside the loop, w…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80749] In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of …

In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination (a generic target, sized to accept many different data blocks) not the source (a very specific type of data block). Thus, it was copying 60 bytes of data from a 2…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80750] In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaini…

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after of_node_put() scpsys_get_bus_protection_legacy() looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap lookup failed, but still pass that node to dev_err_probe() with %pOF on failure. If of_node_p…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80751] In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initia…

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() mtk_mfg_attach_dev() reads prev_o on the first iteration of its loop, in "if (prev_o && prev_o->freq == o->freq)", before prev_o is assigned at the end of the loop body. On that first iteration, evaluating prev_o reads an indeterminate value. If it is non-NULL, t…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80752] In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver …

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpad_spi_suspend() retrieves the controller state with spi_get_drvdata(), but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80741] In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read…

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINT_MAX, causing an out-of-bounds read. Add an early return when len is 0.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80734] In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping…

In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes [BUG] When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERT()s related to folio size: 795 (241074): drop_caches: 3 assertion failed: IS_ALIGNED(start, blocksize) && IS_ALIGNED(end + 1, blocksize), in extent_io.c:1404 (…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80735] In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by…

In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref sk_user_data Some subsystems, like BPF SOCKMAP, set sk_user_data without actually setting the encap_type. For this reason, we must make sure that the type is the one ovpn expects before dereferencing sk_user_data. Failing to do so may lead to out-of-bounds reads.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80736] In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth grou…

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth group reservation indexing Valid bandwidth group IDs range from 1 through MAX_GROUPS, while Group ID 0 is reserved. tb_consumed_dp_bandwidth() uses the Group ID directly to index its local group_reserved[] array. The array currently has MAX_GROUPS entries, so its valid indices are 0 through MAX_GROUPS…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80737] In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize…

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80738] In the Linux kernel, the following vulnerability has been resolved: bpf: Check sk_state before sk_p…

In the Linux kernel, the following vulnerability has been resolved: bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer 'sk' with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access sk->sk_protocol without validating whether 'sk' represents a full socket. Fix this issue by checking sk->sk_state != …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-80726] In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: WARN and clear ro…

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Explicitly clear role.invalid when deriving a child shadow page's role from its parent to harden against bugs elsewhere in KVM, as violating KVM's invariant that invalid pages are NOT on the list of active MMU pages leads to use-after-free due to __kvm_m…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80731] In the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-…

In the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header dev_validate_header() reads dev->hard_header_len directly when zero-padding short link layer headers for CAP_SYS_RAWIO holders: if (capable(CAP_SYS_RAWIO)) { memset(ll_header + len, 0, dev->hard_header_len - len); return true; } Packet send p…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80732] In the Linux kernel, the following vulnerability has been resolved: ata: pata_sl82c105: fix bridge …

In the Linux kernel, the following vulnerability has been resolved: ata: pata_sl82c105: fix bridge revision use-after-free pci_get_slot() returns a referenced PCI device. Commit 44c10138fd4b ("PCI: Change all drivers to use pci_device->revision") replaced a configuration-space read with direct access to the cached revision field, but left that access after pci_dev_put(). The bridge may therefore…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-76642] util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running …

util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-78409] The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the conf…

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-78410] A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pi…

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

01/09/2026

Inyección de comandos OS alta en yast2-users (CVE-2026-59680)

Se identificó una vulnerabilidad de inyección de comandos en yast2-users que afecta la gestión de usuarios en sistemas Linux basados en SUSE. La función get_password_term() no valida campos numéricos (shadowLastChange, shadowExpire), permitiendo ejecución arbitraria de comandos del sistema operativo con privilegios elevados. Afecta directamente servidores administrados en México y LATAM que utilicen esta herramienta.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

01/09/2026

Inyección de comandos OS alta en yast2-auth-client comprometería servidores con Active Directory

Una vulnerabilidad de inyección de comandos del sistema operativo en yast2-auth-client (CVSS 8.8) permite a atacantes que controlen valores de configuración de Active Directory ejecutar comandos arbitrarios como root en hosts configurados. El componente Auth::AuthConf interpola directamente valores de configuración en invocaciones de comandos Samba sin sanitización, afectando principalmente servidores Linux/Unix en entornos corporativos que integran autenticación con infraestructuras AD en LATAM.

nvdaltovulnerabilidad CVSS 8.8 NVD