Alertas de Seguridad de la Información

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64057] In the Linux kernel, the following vulnerability has been resolved: afs: Fix the locking used by af…

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the locking used by afs_get_link() The afs filesystem in the kernel doesn't do locking correctly for symbolic links. There are a number of problems: (1) It doesn't do any locking around afs_read_single() to prevent races between multiple ->get_link() calls, thereby allowing the possibility of leaks. (2) I…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64058] In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_read_folio() t…

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_read_folio() to wait on writeback Fix netfs_read_folio() to wait for an ongoing writeback to complete so that it can trust the dirty flag and whatever is attached to folio->private (folio->private may get cleaned up by the collector before it clears the writeback flag).

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64061] In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early put of sink fo…

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early put of sink folio in netfs_read_gaps() Fix netfs_read_gaps() to release the sink page it uses after waiting for the request to complete. The way the sink page is used is that an ITER_BVEC-class iterator is created that has the gaps from the target folio at either end, but has the sink page tiled over the middle…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64047] In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sg_…

In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring When an sk_msg scatterlist ring wraps (sg.end < sg.start), tls_push_record() chains the tail portion of the ring to the head using sg_chain(). An extra entry in the sg array is reserved for this: struct sk_msg_sg { [...] /* The extra two …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64048] In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT t…

In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] == NUL…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64050] In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: don't mix devm and…

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: don't mix devm and drmm functions Mixing devm and drmm functions will result in a use-after-free on msm driver teardown if userspace keeps a reference on the drm device: The WB connector data will be destroyed because of the use of devm_kzalloc()), while the usersoace still can try interacting with the WB connector …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64051] In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check …

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remap_pfn_range during mmap The call to remap_pfn_range in qaic_gem_object_mmap is susceptible to (re)mapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap() unmaps only the VMA region and not the additional mappings. To prevent this, check the remaining…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64053] In the Linux kernel, the following vulnerability has been resolved: block: don't overwrite bip_vcnt…

In the Linux kernel, the following vulnerability has been resolved: block: don't overwrite bip_vcnt in bio_integrity_copy_user() bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce segment. Overwriting it with nr_vecs breaks bip_vcnt

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64055] In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Carry o…

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Carry over frag counter The gmac_rx() NAPI poll function assembles packets in an SKB from a ring buffer. If the ring buffer gets completely emptied during a poll cycle, we exit gmac_rx(), but the packet is not yet completely assembled in the SKB, yet the fragment counter frag_nr is reset to zero on the n…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64039] In the Linux kernel, the following vulnerability has been resolved: drm/msm/snapshot: fix dumping o…

In the Linux kernel, the following vulnerability has been resolved: drm/msm/snapshot: fix dumping of the unaligned regions The snapshotting code internally aligns data segment to 16 bytes. This works fine for DPU code (where most of the regions are aligned), but fails for snapshotting of the DSI data (because DSI data region is shifted by 4 bytes). Fix the code by removing length alignment and b…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64041] In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: fs210x: fix possi…

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: fs210x: fix possible buffer overflow In fs210x_effect_scene_info(), a string was copied like this: strscpy(DST, SRC, strlen(SRC) + 1); A buffer overflow would happen if strlen(SRC) >= sizeof(DST). Actually, strscpy() must be used this way: strscpy(DST, SRC, sizeof(DST)); strscpy(DST, SRC); // default…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64042] In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Check BAR resources b…

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Check BAR resources before exporting a DMABUF A DMABUF exports access to BAR resources and, although they are requested at startup time, we need to ensure they really were reserved before exporting. Otherwise, it's possible to access unreserved resources through the export. Add a check to the DMABUF-creation path.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64044] In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in …

In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMD_NEW_PEER error path ovpn_nl_peer_new_doit()'s error path calls ovpn_peer_release() directly rather than ovpn_peer_put(), bypassing the kref. The accompanying comment ("peer was not yet hashed, thus it is not used in any context") holds for UDP but not for TCP. For UDP, the ovpn_socket union us…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64045] In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - use cached peer poi…

In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - use cached peer pointer in ovpn_tcp_close() ovpn_tcp_close() loads the ovpn_socket via rcu_dereference_sk_user_data() under rcu_read_lock(), takes a reference on sock->peer, caches the peer pointer in a local, and drops the read lock. It then passes sock->peer (rather than the cached local) to ovpn_peer_del(), re-der…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64046] In the Linux kernel, the following vulnerability has been resolved: net: tls: prevent chain-after-c…

In the Linux kernel, the following vulnerability has been resolved: net: tls: prevent chain-after-chain in plain text SG Sashiko points out that if end = 0 (start != 0) the current code will create a chain link to content type right after the wrap link: This would create a chain where the wrap link points directly to another chain link. The scatterlist API sg_next iterator does not recurs…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64030] In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check li…

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15. sdata->link[] has IEEE80211_MLD_MAX_NUM_LINKS (15) entries (indices 0..14), making index 15 out-of-bounds. A connected WiFi 7 AP …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64031] In the Linux kernel, the following vulnerability has been resolved: erofs: fix managed cache race f…

In the Linux kernel, the following vulnerability has been resolved: erofs: fix managed cache race for unaligned extents After unaligned compressed extents were introduced, the following race could occur: [Thread 1] [Thread 2] (z_erofs_fill_bio_vec) ... filemap_add_folio (1) …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64032] In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix a possible u…

In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix a possible use-after-free when removing a bridge port When per-VLAN multicast snooping is enabled, the bridge iterates over all the bridge ports, disables the per-port multicast context on each port and enables the per-{port, VLAN} multicast contexts instead. The reverse happens when per-VLAN multicast snoopin…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64033] In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free i…

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and srv_path->kobj may already have been initialized. If a later step fails, the cleanup currently calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sys…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64034] In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fe…

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_handle_resp() re-reads the same field from the same DMA buffer for test_bit() and pointer arithmetic. DMA-coherent memory is mapped uncache…

nvdcriticovulnerabilidad CVSS 9.3 NVD