Alertas de Seguridad de la Información

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53182] In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject oversized…

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject oversized EMA RNR lists nl80211_parse_rnr_elems() stores the parsed element count in a u8-backed cfg80211_rnr_elems::cnt field and uses that count to size the flexible array allocation. Reject nested NL80211_ATTR_EMA_RNR_ELEMS input once the count reaches 255, before incrementing it again. This keeps the p…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53183] In the Linux kernel, the following vulnerability has been resolved: mptcp: allow subflow rcv wnd to…

In the Linux kernel, the following vulnerability has been resolved: mptcp: allow subflow rcv wnd to shrink In MPTCP connection, the `window` field in the TCP header refers to the MPTCP-level rcv_nxt and it's right edge should not move backward. Such constraint is enforced at DSS option generation time. At the same time, the TCP stack ensures independently that the TCP-level rcv wnd right's edge…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53184] In the Linux kernel, the following vulnerability has been resolved: udp: clear skb->dev before runn…

In the Linux kernel, the following vulnerability has been resolved: udp: clear skb->dev before running a sockmap verdict On the UDP receive path skb->dev is repurposed as dev_scratch (the truesize/state cache set by udp_set_dev_scratch()), through the union { struct net_device *dev; unsigned long dev_scratch; } in sk_buff. When a UDP socket is in a sockmap, sk_data_ready is sk_psock_verdict_dat…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53185] In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zra…

In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() passes its parent bio down, so for ZRAM_WB slots the read is dispatched asynchronously and zram_read_page() returns 0 while the bio is still i…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53170] In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: reject DMA comman…

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: reject DMA commands with uninitialized length cmd_state_init() initializes the command state with memset(0xff), leaving dma->len at U64_MAX to signal missing setup. The only setter is NPU_SET_DMA0_LEN; if userspace omits this command and issues NPU_OP_DMA_START, dma->len remains U64_MAX. In dma_length(), a positiv…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53171] In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix arithmetic is…

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix arithmetic issues in dma_length() dma_length() derives DMA region usage from command stream values and updates region_size[]: len = ((len + stride[0]) * size0 + stride[1]) * size1 region_size[region] = max(..., len + dma->offset) Several arithmetic issues can corrupt the derived region size: - signed…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53172] In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix IFM region in…

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix IFM region index out-of-bounds in command stream parser NPU_SET_IFM_REGION extracts the region index with param & 0x7f, giving a maximum value of 127. However region_size[] and output_region[] in struct ethosu_validated_cmdstream_info are both sized to NPU_BASEP_REGION_MAX (8), giving valid indices [0..7]. Eve…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53173] In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix OOB write in …

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate() The command stream parsing loop increments the index variable a second time when a 64-bit command word is encountered (bit 14 set), but does not re-check the loop bound before writing the second word: for (i = 0; i < size / 4; i++) { bocmds[i] =…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53174] In the Linux kernel, the following vulnerability has been resolved: ovl: keep err zero after succes…

In the Linux kernel, the following vulnerability has been resolved: ovl: keep err zero after successful ovl_cache_get() ovl_iterate_merged() stores PTR_ERR(cache) in err before checking IS_ERR(cache). On success err holds the truncated cache pointer and can be returned as a bogus non-zero error. The syzbot reproducer reaches this through overlay-on-overlay readdir: getdents64 iterate_dir…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53175] In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free…

In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush On netns teardown, fqdir_pre_exit() walks the fqdir rhashtable and flushes every fragment queue that is not yet complete using inet_frag_queue_flush(). That helper frees all the skbs queued on the fragment queue but does not set INET_FRAG_COMPLETE, and leaves q…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53176] In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs sho…

In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53157] In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device…

In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a phonet_device from the per-net device list with list_del_rcu(), but frees it immediately. RCU readers walking the same list can still hold a pointer to the object after it has been removed, leading to a slab-use-after-free. Use kfree_rcu(),…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53159] In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix DMA address …

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix DMA address corruption due to find_vma misuse fastrpc_get_args() uses find_vma() to look up the VMA for a user-provided pointer and compute a DMA address offset. When the address falls in a gap before the returned VMA, (ptr & PAGE_MASK) - vma->vm_start underflows, corrupting the DMA address sent to the DSP. R…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53160] In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-fr…

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free race in fastrpc_map_create fastrpc_map_lookup returns a raw pointer after releasing fl->lock. The caller fastrpc_map_create then calls fastrpc_map_get (kref_get_unless_zero) on this unprotected pointer. A concurrent MEM_UNMAP can free the map between the lock release and the kref operation, resu…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53161] In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-fr…

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context There is a race between fastrpc_device_release() and the workqueue that processes DSP responses. When the user closes the file descriptor, fastrpc_device_release() frees the fastrpc_user structure. Concurrently, an in-flight DSP invocation can complete and fa…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53162] In the Linux kernel, the following vulnerability has been resolved: memcg: use round-robin victim s…

In the Linux kernel, the following vulnerability has been resolved: memcg: use round-robin victim selection in refill_stock Harry Yoo reported that get_random_u32_below() is not safe to call in the nmi context and memcg charge draining can happen in nmi context. More specifically get_random_u32_below() is neither reentrant- nor NMI-safe: it acquires a per-cpu local_lock via local_lock_irqsave()…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53165] In the Linux kernel, the following vulnerability has been resolved: iomap: avoid potential null fol…

In the Linux kernel, the following vulnerability has been resolved: iomap: avoid potential null folio->mapping deref during error reporting When a buffered read fails, iomap_finish_folio_read() reports the error with fserror_report_io(folio->mapping->host, ...). This is called after ifs->read_bytes_pending has been decremented by the bytes attempted to be read. For a folio split across multiple…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53147] In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain r…

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Validate XDomain request packet size before type cast tb_xdp_handle_request() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter t…

nvdaltovulnerabilidad CVSS 8.1 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53148] In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain resp…

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Clamp XDomain response data copy to allocation size tb_xdp_properties_request() derives the per-packet copy length from the response header without checking that it fits in the previously allocated data buffer. A malicious peer can set its length field larger than the declared data_length, causing memcpy to write p…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53149] In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directo…

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size __tb_property_parse_dir() does not check that content_offset + content_len fits within block_len for the root directory case. When rootdir->length equals or exceeds block_len - 2, the entry loop reads past the allocated property block. Add a bounds check after computing co…

nvdaltovulnerabilidad CVSS 7.1 NVD