Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64277] In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound t…

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127). rmi_f3a_map_gpios() then allocates gpio_key_map with min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3a_attention…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64279] In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter deregist…

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter deregistration race Adapters can be looked up by their id using i2c_get_adapter() which takes a reference to the embedded struct device. Remove the adapter from the IDR before tearing it down during deregistration (and on registration failure) to make sure its resources are not accessed after having been …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64280] In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA map…

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() afu_ioctl_dma_map() accepts a 64-bit length from userspace via DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value is passed to afu_dma_pin_pages() where npages is derived as length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes int…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64281] In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when t…

In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svc_rdma_sq_wait() on sc_sq_ticket_wait or sc_send_wait can hang indefinitely in TASK_UNINTERRUPTIBLE state across transport teardown, pinning svc_xprt references and blocking svc_rdma_free(). The close path sets XPT_CLOSE before invoking xpo_detach and both w…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-64268] In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response p…

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->processed and then accumulates wqe->processed, but it never checks the running total against the sink buffer length on continuation segments. si…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-64269] In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write…

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg When the server answers an RTRS READ, rdma_write_sg() builds the source scatter/gather entry for the IB_WR_RDMA_WRITE that returns data to the peer. Its length is taken directly from the wire descriptor: plist->length = le32_to_cpu(id->rd_msg->desc[0].len);…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64259] In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse_req on …

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse_req on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server (io_uring_cmd_done() not called) yet. fuse_uring_commit_fetch() ends the fuse request when the ring entry has a wrong state, b…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64260] In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue->stoppe…

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue->stopped races and set/read that value under lock There are several readers of queue->stopped that check the value under lock, but fuse_uring_commit_fetch() did not and actually the value was not set under the lock in fuse_uring_abort_end_requests() either. Especially in fuse_uring_commit_fetch it is impo…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64261] In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-fre…

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues fuse_uring_async_stop_queues() might run when the last reference on ring->queue_refs was already dropped. In order to avoid an early destruction a reference on struct fuse_conn is now taken before starting fuse_uring_async_stop_queues() and that reference is only …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64265] In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_…

In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req When fuse_resend() moves a request from fpq->processing back to fiq->pending, it sets FR_PENDING and clears FR_SENT but does not remove the requests intr_entry from fiq->interrupts. If the request had FR_INTERRUPTED set from a prior signal, intr_entry remains dan…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64266] In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before re…

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async end callback (eg fuse_writepage_free()) can free the args while the subsequent copy chain logic after fuse_ref_folio() accesses them, lead…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-64257] In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping…

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area") restricted the implied bcc[0] length exception to responses without a data area. However, the overlap handling in __smb2_calc_size() clears data_length, which can make…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64255] In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate st…

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers Three BA session handlers use ffs(ba_data->sta_mask) - 1 to derive a station ID without checking that sta_mask is non-zero. When sta_mask is zero, ffs() returns 0 and the subtraction wraps to 0xFFFFFFFF, causing an out-of-bounds access on fw_id_to_link_sta…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64247] In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the ba…

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the bank index when querying sparse banks When checking if a VP ID is included in a sparse bank set, explicitly check that the ID can actually be contained in a sparse bank (the TLFS allows for a maximum of 64 banks of 64 vCPUs each). When handling a paravirtual TLB flush for L2, the VP ID is copied ver…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64251] In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-fre…

In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() pwrseq_debugfs_seq_next() declares 'next' with __free(put_device), which causes put_device() to be called on the returned pointer when the variable goes out of scope. This results in a use-after-free since the seq_file framework receives a pointer whose reference has…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64243] In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: simple-mux: Fix e…

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: simple-mux: Fix enum control bounds check simple_mux_control_put() rejects values greater than e->items, but enum control values are zero based. For the two-entry mux used by this driver, valid values are 0 and 1, so value 2 must be rejected as well. Accepting e->items can store an invalid mux state, pass it to th…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-64232] In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_s…

In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_segments in blk_insert_cloned_request blk_insert_cloned_request() already recomputes nr_phys_segments against the bottom queue, because "the queue settings related to segment counting may differ from the original queue." The exact same reasoning applies to integrity segments: a stacked driver's unde…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64235] In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relat…

In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines With CONFIG_CALL_DEPTH_TRACKING enabled on an x86 retbleed-affected platform (eg: Skylake), with retbleed=stuff, registering a dynamic ftrace trampoline crashes on the first call into the traced function: BUG: unable to handle page fault for address: ffff88…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64226] In the Linux kernel, the following vulnerability has been resolved: sched_ext: Avoid UAF in scx_roo…

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path In scx_root_enable_workfn(), put_task_struct(p) is called before scx_error() dereferences p->comm and p->pid. If the iterator's reference is the last drop, the task is freed synchronously and the deref becomes a UAF. Move put_task_struct() past scx_error().

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64222] In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free…

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free of pool->stack on AQ init failure otx2_pool_aq_init() frees pool->stack when mailbox sync or retry allocation fails, but leaves the pointer unchanged. Later, otx2_sq_aura_pool_init() unwinds the partial setup through otx2_aura_pool_free(), which frees pool->stack again. The CN20K-specific cn20k_po…

nvdaltovulnerabilidad CVSS 7.0 NVD