Alertas de Seguridad de la Información

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80576] In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IB…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through to ib->length_dw without a limit, while ring_emit_ib() encodes length into packet fields. Oversized values can corrupt adjacent control bits and destabilize command submission. Add a per-ring IB pac…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80578] In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desync…

In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fb_io_read() In fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to a faulty user buffer), the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the hardware 'src' pointer has already been eagerly advanced by the original chunk size. If th…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80568] In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block s…

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - block s_input when F54 queue is busy Changing the input (diagnostic report type) mid-stream changes the report size. Since V4L2 buffers are allocated based on the size at stream start, changing the input while streaming could lead to a heap buffer overflow if the new size is larger than the allocated buff…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80569] In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound t…

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer rmi_f54_work() reads a diagnostics report from the device into f54->report_data, sizing the transfer with rmi_f54_get_report_size(): report_size = rmi_f54_get_report_size(f54); ... for (i = 0; i < report_size; i += F54_REPORT_DATA_SIZE) { int size = …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80570] In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero re…

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmi_f54_work(), if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where f54->report_size was normally zeroed out. This left f54->report_size containing its previous successful …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80561] In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe de…

In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decode_locker() decode_locker() in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. ceph_decode_copy() at the locker_id_t name field has no preceding bounds check. With p == end after ceph_start_…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80565] In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix error path in…

In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix error path in devm_qce_register_algs If ops->register_algs() fails, the error path repeatedly calls the same ops->unregister_algs() from the failed registration. Use the loop index to unregister the previously registered algorithms instead.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80555] In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory …

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory if cp_init() fails The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory. An attempt to address this exists in ccw…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80556] In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: Fix use-after-f…

In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition In atmci_probe, &host->bh_work is bound with atmci_work_func, and atmci_interrupt, atmci_timeout_timer and atmci_dma_complete can all queue this work on system_bh_wq. If we remove the module, atmci_remove makes cleanup and the memory allocated for host wit…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80557] In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode…

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode_watchers() via missing bounds check ceph_start_decoding() validates that struct_len bytes remain in the buffer after the encoding header, but accepts struct_len=0 as valid: ceph_decode_need(p, end, 0, bad) always passes. When a malicious or compromised OSD sends an obj_list_watch_response_t reply …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80558] In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid os…

In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primary_temp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts that don't exist, i.e., that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). These indices are used to create …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80559] In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device…

In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device registration ordering In sur40_probe(), input_register_device() was previously called early before the V4L2 video device and vb2_queue components were fully initialized. If userspace opened the input device immediately upon registration, sur40_open() would trigger and start the sur40_poll() worker…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80560] In the Linux kernel, the following vulnerability has been resolved: openrisc: signal: do not restor…

In the Linux kernel, the following vulnerability has been resolved: openrisc: signal: do not restore privileged SR bits on sigreturn restore_sigcontext() copies the whole supervision register (SR) from the signal frame and only clears SPR_SR_SM before the value is reloaded into the hardware SR (through ESR and l.rfe) on the return to user space. All other SR bits are left under user control. A…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80547] In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Implement a crw …

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Implement a crw lock Unlike the channel_program struct, which covers synchronous I/O submissions and asynchronous interrupts, the CRW region relies exclusively on asynchronous events coming from hardware. Implement a lock to manage the list of those payloads, to ensure they are read cohesively.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80548] In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Selectively expa…

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Selectively expand io_mutex The io_mutex was defined to serialize the io_regions, but then has also sort of been associated with the I/O themselves because of the close relationship they share. With the handful of races that are possible, the choices are either to: A) expand the scope of io_mutex to close these …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80549] In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Move cp cleanup …

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Move cp cleanup out of not operational The fsm_notoper() routine is called when the device has been lost, and is (by definition) no longer operational. Since this can happen asynchronously from the normal behavior of the driver, the cleanup may happen when holding other locks in the calling sequence (notably, the …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80550] In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Fix out of bound…

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Fix out of bounds check on CCW array The routine ccwchain_calc_length() counts the number of channel command words (CCWs) that are chained together in a single channel program, and rejects anything larger than CCWCHAIN_LEN_MAX (256) CCWs. The loop itself is "do..while (count < 257)", and while the logic in is_cpa…

nvdaltovulnerabilidad CVSS 7.9 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80551] In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDA…

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDAW remains constant The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full IDAL. Verify that the address found in the first IDAW is unchanged between reads, to ensure a consis…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80552] In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure index for…

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure index for read/write regions are within range The introduction of the capability chain rightly clamped the region indexes to the range of the capabilities itself, but neglected to do so for the existing read/write regions which should also be enforced.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80553] In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing …

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing workqueues The initialization of the io_work and crw_work workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup tags in _release_dev to ensure work isn't dispatched after the private struct is free'd.

nvdaltovulnerabilidad CVSS 8.8 NVD