Alertas de Seguridad de la Información

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53322] In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Clean up DMABUFs befo…

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Clean up DMABUFs before disabling function On device shutdown, make vfio_pci_core_close_device() call vfio_pci_dma_buf_cleanup() before the function is disabled via vfio_pci_core_disable(). This ensures that all access via DMABUFs is revoked before the function's BARs become inaccessible. This fixes an issue where, i…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Crítico vulnerabilidad

26/06/2026

[CVE-2026-53309] In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dl…

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison The local-vs-remote region comparison loop uses '

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53300] In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix NTMP DMA use-af…

In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix NTMP DMA use-after-free issue The AI-generated review reported a potential DMA use-after-free issue [1]. If netc_xmit_ntmp_cmd() times out and returns an error, the pending command is not explicitly aborted, while ntmp_free_data_mem() unconditionally frees the DMA buffer. If the buffer has already been reallocate…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53303] In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extension_list re…

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() In f2fs_sbi_show(), the extension_list, extension_count and hot_ext_count are read without holding sbi->sb_lock. If a concurrent sysfs store modifies the extension list via f2fs_update_extension_list(), the show path may read inconsistent count and array conten…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53294] In the Linux kernel, the following vulnerability has been resolved: mailbox: mailbox-test: don't fr…

In the Linux kernel, the following vulnerability has been resolved: mailbox: mailbox-test: don't free the reused channel The RX channel can be aliased to the TX channel if it has a different MMIO. This special case needs to be handled when freeing the channels otherwise a double-free occurs.

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53296] In the Linux kernel, the following vulnerability has been resolved: mailbox: mailbox-test: free cha…

In the Linux kernel, the following vulnerability has been resolved: mailbox: mailbox-test: free channels on probe error On probe error, free the previously obtained channels. This not only prevents a leak, but also UAF scenarios because the client structure will be removed nonetheless because it was allocated with devm.

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53286] In the Linux kernel, the following vulnerability has been resolved: idpf: fix double free and use-a…

In the Linux kernel, the following vulnerability has been resolved: idpf: fix double free and use-after-free in aux device error paths When auxiliary_device_add() fails in idpf_plug_vport_aux_dev() or idpf_plug_core_aux_dev(), the err_aux_dev_add label calls auxiliary_device_uninit() and falls through to err_aux_dev_init. The uninit call will trigger put_device(), which invokes the release call…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53290] In the Linux kernel, the following vulnerability has been resolved: drm/xe/eustall: Fix drm_dev_put…

In the Linux kernel, the following vulnerability has been resolved: drm/xe/eustall: Fix drm_dev_put called before stream disable in close In xe_eu_stall_stream_close(), drm_dev_put() is called before the stream is disabled and its resources are freed. If this drops the last reference, the device structures could be freed while the subsequent cleanup code still accesses them, leading to a use-aft…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53284] In the Linux kernel, the following vulnerability has been resolved: btrfs: only release the dirty p…

In the Linux kernel, the following vulnerability has been resolved: btrfs: only release the dirty pages io tree after successful writes [WARNING] With extra warning on dirty extent buffers at umount (aka, the next patch in the series), test case generic/388 can trigger the following warning about dirty extent buffers at unmount time: BTRFS critical (device dm-2 state E): emergency shutdown …

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53281] In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid NULL pointer …

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE") fixed a NULL pointer dereference in an unlikely situation partly. If dev_pasid is not found in the dev_pasids list, it remains NULL. However, the teardown operations are executed uncondition…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53270] In the Linux kernel, the following vulnerability has been resolved: ipvs: clear the svc scheduler p…

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear the svc scheduler ptr early on edit ip_vs_edit_service() while unbinding the old scheduler clears the svc->scheduler ptr after the scheduler module initiates RCU callbacks. This can cause packets to use the old scheduler at the time when svc->sched_data is already freed after RCU grace period. Fix it by clearing the…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53272] In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sb…

In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sbi->sync_decompress z_erofs_decompress_kickoff() can race with filesystem unmount, causing a use-after-free on sbi->sync_decompress. When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff() to queue z_erofs_decompressqueue_work() asynchronously. Then, after all folios are unlocked, un…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53273] In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-f…

In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the client wait as killable so it can be interrupted during shutdown or after a supplicant crash. This changes the original lifetime expectations: the client task can now terminate whil…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53275] In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free…

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a pointer to the multicast group address is retrieved when initially parsing the packet. This pointer is later dereferenced without being reloaded despite the fact that the skb header might have been reallocated following the pskb_may_pull(…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53276] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix a use-after…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer In iso_sock_rebind_bc(), the bis pointer is cached, then the socket lock is dropped: bis = iso_pi(sk)->conn->hcon; /* Release the socket before lookups since that requires hci_dev_lock * which shall not be acquired while holding sock_lock for proper * ordering. …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53277] In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Take the SRCU lock …

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation walk_s1() and kvm_walk_nested_s2() expect to be called while holding kvm->srcu to guard against memslot changes. While this is generally the case, __kvm_at_s12() and __kvm_find_s1_desc_level() call into the respective walkers without taking k…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53262] In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference …

In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() pppol2tp_ioctl() read sock->sk->sk_user_data directly without any locks or reference counting. If a controllable sleep was induced during copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent socket close could trigger pppol2tp_session_close() asyn…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53264] In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU wit…

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock()

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53265] In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: check allo…

In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: check allocation under invalidate lock commit 2d1f7b65f5de ("dm cache policy smq: fix missing locks in invalidating cache blocks") added mq->lock around the destructive part of smq_invalidate_mapping(), but left the e->allocated check outside the critical section. That leaves a check-then-act race. Two conc…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53266] In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_sna…

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is intentional: at the bridge ebtables hooks the Ethernet header is addressed through skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet payload. Aski…

nvdaltovulnerabilidad CVSS 8.8 NVD