Alertas de Seguridad de la Información

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90048] In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bound…

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() ni_create_attr_list() allocates a fixed buffer of al_aligned(record_size) (== record_size) bytes and then walks every attribute of the primary MFT record, writing one ATTR_LIST_ENTRY per attribute and advancing the cursor by le_size(name_len), with no check against …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90045] In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifeti…

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifetime handling io_data stores a pointer to the submitting task's mm_struct, but does not currently hold a reference to it while async requests are pending. This can result in a use-after-free if the task exits before completion handling finishes. Take a reference with mmgrab() when queuing the read …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90036] In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-…

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn->blocked_locks_lru -- holds a raw pointer to its nfs4_client but no reference keeping the client alive. When the per-net laundromat reaps such a lock, freeing the nbl drops the owner reference he…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90013] In the Linux kernel, the following vulnerability has been resolved: tracing: Take trace_array refer…

In the Linux kernel, the following vulnerability has been resolved: tracing: Take trace_array reference when opening options file The options files do not take the trace_array reference for the options they represent. This could cause a use-after-free kernel crash if one of these files is opened by one task and another task removes the instance that the option is for. Because it doesn't take a r…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90000] In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with u…

In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its writeReport/readReport buffer purely from the report descriptor supplied by the device, with no minimum bound: data->input_report_size = hid_report_len(input_report); data->output_report_size = hid_report_len(output_report); alloc_size = data-…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89974] In the Linux kernel, the following vulnerability has been resolved: nvme-fc: fix double free of fab…

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails nvmf_create_ctrl() owns the fabrics options and frees them whenever ->create_ctrl() returns an error, so a transport must not free them on its own error paths. nvme-fc tracks this by testing ctrl->ctrl.opts in nvme_fc_ctrl_free(), which requires nvme_fc_init…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89979] In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix race between non…

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix race between non-atomic ops and trigger-start We protect the races of the concurrent state transitions between atomic PCM ops, but the checks between the non-atomic ops (hw_params, hw_free and prepare) and the atomic ops aren't perfect; there is a check of the conflicting PCM state at the beginning of hw_params & …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89980] In the Linux kernel, the following vulnerability has been resolved: ALSA: harmony: initialize locks…

In the Linux kernel, the following vulnerability has been resolved: ALSA: harmony: initialize locks before requesting IRQ snd_harmony_create() registers the IRQ before initializing h->lock and h->mixer_lock. A pending interrupt can invoke the handler while these locks are uninitialized. Initialize both locks before requesting the IRQ so the handler always sees valid lock state.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89965] In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: reject an arena who…

In the Linux kernel, the following vulnerability has been resolved: nvdimm/btt: reject an arena whose nfree is below the lane count The BTT info block's nfree field, the number of reserve free blocks, is read from the medium without validation. btt_freelist_init() and btt_rtt_init() size the per-lane freelist[] and rtt[] arrays by nfree, but the I/O path indexes them by the lane from nd_region_…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-89969] In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds wr…

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvmet_tcp_try_recv_pdu() reads a PDU header into the fixed 128-byte queue->pdu union, then computes the remaining payload length as queue->left = hdr->hlen - queue->offset + hdgst; and reads that many more bytes into &queue->pdu + queue->offset, without ever b…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-89970] In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout…

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmet_auth_sq_free() cancels auth_expired_work with cancel_delayed_work(). If the work has already started, cancellation does not wait for the callback. Transport teardown can consequently free or reuse the queue containing struct nvmet_sq while nvmet_auth_expired_work() st…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89943] In the Linux kernel, the following vulnerability has been resolved: ASoC: loongson: Fix error handl…

In the Linux kernel, the following vulnerability has been resolved: ASoC: loongson: Fix error handling in ACPI property parsing In loongson_card_parse_acpi(), the return value of device_property_read_string() for the `codec-dai-name` property was ignored. If the property is missing or invalid, an uninitialized pointer would be used later, potentially leading to undefined behavior. Fix this by c…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89927] In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Clamp stimer…

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock Fix an issue where userspace or the guest can program an Hyper-V synthetic timer to have a deadline in the past via integer overflow, preventing the CPU from making progress and triggering an RCU stall. Hyper-V's SynIC exposes 4 per-vCPU synthetic timers to the guest, w…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89910] In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix uninitializ…

In the Linux kernel, the following vulnerability has been resolved: LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc Variable vector[] is declared on stack in function dmsintc_inject_irq() and sometimes it is used without initialized. Here fix this issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89893] In the Linux kernel, the following vulnerability has been resolved: media: cx23885: cancel NetUP CI…

In the Linux kernel, the following vulnerability has been resolved: media: cx23885: cancel NetUP CI work before teardown netup_ci_exit() frees a netup_ci_state while its work item, netup_read_ci_status(), may still be pending or running on the system workqueue. The worker obtains the state with container_of() and dereferences it, so it must not outlive the state. netup_ci_init() queues the init…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89894] In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry…

In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: reject geometry changes while the VBI queue is busy vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide dev->width / dev->norm but only refuse the change when the *video* queue (dev->vidq) is busy. The VBI queue (dev->vbiq) shares that same geometry: cx231xx_init_vbi_isoc() latches dma_q->lines_per_f…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89898] In the Linux kernel, the following vulnerability has been resolved: media: cec: extron-da-hd-4k-plu…

In the Linux kernel, the following vulnerability has been resolved: media: cec: extron-da-hd-4k-plus: add sanity check Add check to prevent overflowing msg.msg[] in case the incoming data is malformed.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89887] In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-aft…

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov7740: fix use-after-destroy in remove The ov7740_remove() function had a severe teardown order bug where it destroyed the driver's mutex before freeing the V4L2 control handler which relies on that mutex, leading to a use-after-destroy kernel panic. Furthermore, the driver explicitly called v4l2_ctrl_handler_free()…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89890] In the Linux kernel, the following vulnerability has been resolved: media: go7007: defer the ALSA v…

In the Linux kernel, the following vulnerability has been resolved: media: go7007: defer the ALSA v4l2 put until card release go7007_snd_init() already takes a v4l2_device reference for the ALSA side, but go7007_snd_remove() drops it immediately after calling snd_card_free_when_closed(). That is too early when a userspace process still has the capture PCM open. The ALSA card and its PCM callbac…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89870] In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a r…

In the Linux kernel, the following vulnerability has been resolved: media: zoran: Avoid freeing a registered video_device twice zoran_init_video_device() installs zoran_vdev_release() as the video_device release callback through zoran_template. After video_register_device() succeeds, video_unregister_device() drops the registered video_device reference and the V4L2 core eventually invokes that r…

nvdaltovulnerabilidad CVSS 7.8 NVD