Alertas de Seguridad de la Información

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53223] In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to r…

In the Linux kernel, the following vulnerability has been resolved: net: guard timestamp cmsgs to real error queue skbs skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb from sk_error_queue. That assumption is not true for AF_PACKET sockets: outgoing packet taps are also delivered to packet sockets with skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACK…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53224] In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT ch…

In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncate…

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53225] In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sct…

In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated p…

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53228] In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 he…

In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53229] In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix DMA and xdp…

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure In the XSK branch of mlx5e_xmit_xdp_buff(), when sq->xmit_xdp_frame() returns false (e.g. XDPSQ is full), the function returns without unmapping the DMA address or freeing the xdp_frame allocated by xdp_convert_zc_to_xdp_frame(). The xdpi_fifo push only happens on…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53230] In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bound…

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list mlx5_query_nic_vport_mac_list() sizes its firmware command buffer using the PF's log_max_current_uc/mc_list capabilities. When querying a VF vport with a larger configured max (via devlink), the firmware response can overflow this buffer: BUG: KASAN: slab-out-of…

nvdaltovulnerabilidad CVSS 8.7 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53215] In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers b…

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53216] In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame siz…

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising P…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53217] In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: sync RX data at the…

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: sync RX data at the hardware packet offset mvpp2 programs the RX queue packet offset, so hardware writes received data at dma_addr + MVPP2_SKB_HEADROOM. The current CPU sync starts at dma_addr and only covers rx_bytes + MVPP2_MH_SIZE bytes, which syncs the unused headroom and misses the same number of bytes at the pa…

nvdaltovulnerabilidad CVSS 8.6 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53221] In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel m…

In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any loc…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53205] In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks f…

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add bounds checks for firmware log indices Add validation that read and write indices in the firmware log buffer are within valid bounds (< data_size) before using them. If out-of-bounds indices are encountered (from firmware), clamp them to safe values instead of proceeding with invalid offsets. This prevents poten…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53209] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject ove…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Existing advertising instances can already hold the maximum extended advertising payload. When hci_adv_bcast_annoucement() prepends the Broadcast Announcement service data to that payload, the combined data may no longer fit in the temporary buffer used to rebu…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53212] In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix use-after-free on object destroy nft_tunnel_obj_destroy() calls metadata_dst_free() which directly kfree()s the metadata_dst, ignoring the dst_entry refcount. Packets that took a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued (e.g. in a netem qdisc) are left with a dangling poin…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53198] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a …

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL A deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work on conn->async_requests via setup_async_work(), with cancel_fn = smb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock. When the request is cancelled, the w…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53199] In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: use kmap_local_page …

In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf netvsc_copy_to_send_buf() copies page buffer entries into the VMBus send buffer using phys_to_virt() on the entry PFN. Entries for the RNDIS header and the skb linear data come from kmalloc'd memory and are always in the kernel direct map, but entries for skb fragments re…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53200] In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix handling of…

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX XN has already been extracted from its bitfield position so using FIELD_PREP() on the mask that clears XN[0] is completely broken, having the effect of unconditionally granting execute permissions... Fix the obvious mistake by manipulating the right bit.

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53201] In the Linux kernel, the following vulnerability has been resolved: Revert "drm/xe: Skip exec queue…

In the Linux kernel, the following vulnerability has been resolved: Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend" This reverts commit 8533051ce92015e9cc6f75e0d52119b9d91610b6. The idle-skip optimization bypasses GuC suspend, so the GPU may not perform the context switch that flushes TLB entries for invalidated userptr VMAs. In LR/preempt-fence VM mode, this ca…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53202] In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer …

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware-supplied data_size is cast to signed int before being used in min_t(). Large unsigned values (>= 0x80000000) become negative, causing unsigned wraparound and oversized memcpy operations that can overflow the stack buffer. Chang…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53203] In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add buffer overflow…

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add buffer overflow check in MS get_info_ioctl Add validation that the info size returned from the metric stream info query is not exceeded when checked against the allocated buffer size. If the firmware returns a size larger than the buffer, reject the operation with -EOVERFLOW instead of proceeding with an incorrec…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53186] In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense c…

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSI…

nvdcriticovulnerabilidad CVSS 9.1 NVD