Alertas de Seguridad de la Información

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53120] In the Linux kernel, the following vulnerability has been resolved: PCI: use generic driver_overrid…

In the Linux kernel, the following vulnerability has been resolved: PCI: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of prop…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53109] In the Linux kernel, the following vulnerability has been resolved: powerpc/pgtable-frag: Fix bad p…

In the Linux kernel, the following vulnerability has been resolved: powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy powerpc uses pt_frag_refcount as a reference counter for tracking it's pte and pmd page table fragments. For PTE table, in case of Hash with 64K pagesize, we have 16 fragments of 4K size in one 64K page. Patch series [1] "mm: free retracted page table by RCU" added pt…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53110] In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Zero-extend bpf prog …

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Zero-extend bpf prog return values and kfunc arguments s390x ABI requires callers to zero-extend unsigned arguments and sign-extend signed arguments, and callees to zero-extend unsigned return values and sign-extend signed return values. s390 BPF JIT currently implements only sign extension. Fix this omission and impl…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53112] In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix possibl…

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet The irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and scheduled when RTL_IMR_BCNINT interrupt is triggered by hardware. But it is never killed in rtl_pci_deinit(). When the rtlwifi card probe fails or is being detached, the ie…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53115] In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: use generic driver…

In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53116] In the Linux kernel, the following vulnerability has been resolved: s390/ap: use generic driver_ove…

In the Linux kernel, the following vulnerability has been resolved: s390/ap: use generic driver_override infrastructure When the AP masks are updated via apmask_store() or aqmask_store(), ap_bus_revise_bindings() is called after ap_attr_mutex has been released. This calls __ap_revise_reserved(), which accesses the driver_override field without holding any lock, racing against a concurrent drive…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53098] In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix use-aft…

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() When the mt7915 pci chip is detaching, the mt7915_crash_data is released in mt7915_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7915_ma…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53089] In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in offl…

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in offloaded map/prog info fill When querying info for an offloaded BPF map or program, bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() obtain the network namespace with get_net(dev_net(offmap->netdev)). However, the associated netdev's netns may be racing with teardown during netns des…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53090] In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ld_{abs,ind} failure p…

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ld_{abs,ind} failure path analysis in subprogs Usage of ld_{abs,ind} instructions got extended into subprogs some time ago via commit 09b28d76eac4 ("bpf: Add abnormal return checks."). These are only allowed in subprograms when the latter are BTF annotated and have scalar return types. The code generator in bpf_gen_ld_…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53091] In the Linux kernel, the following vulnerability has been resolved: net: pull headers in qdisc_pkt_…

In the Linux kernel, the following vulnerability has been resolved: net: pull headers in qdisc_pkt_len_segs_init() Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head. net/core/tso.c users are particularly at risk, because tso_build_hdr() does a memcpy(hdr, skb->data, hdr_len); qdisc_pkt_len_segs_init() already does a dissection of gso packets. Use pskb_may…

nvdaltovulnerabilidad CVSS 8.4 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53092] In the Linux kernel, the following vulnerability has been resolved: bpf: Fix linked reg delta track…

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix linked reg delta tracking when src_reg == dst_reg Consider the case of rX += rX where src_reg and dst_reg are pointers to the same bpf_reg_state in adjust_reg_min_max_vals(). The latter first modifies the dst_reg in-place, and later in the delta tracking, the subsequent is_reg_const(src_reg)/reg_const_value(src_reg) rea…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53094] In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stale offload->prog po…

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stale offload->prog pointer after constant blinding When a dev-bound-only BPF program (BPF_F_XDP_DEV_BOUND_ONLY) undergoes JIT compilation with constant blinding enabled (bpf_jit_harden >= 2), bpf_jit_blind_constants() clones the program. The original prog is then freed in bpf_jit_prog_release_other(), which updates aux…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53096] In the Linux kernel, the following vulnerability has been resolved: bpf: Use RCU-safe iteration in …

In the Linux kernel, the following vulnerability has been resolved: bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path The DEVMAP_HASH branch in dev_map_redirect_multi() uses hlist_for_each_entry_safe() to iterate hash buckets, but this function runs under RCU protection (called from xdp_do_generic_redirect_map() in softirq context). Concurrent writers (__dev_map_hash_update_elem, …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53097] In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix use-aft…

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() When the mt7996 pci chip is detaching, the mt7996_crash_data is released in mt7996_coredump_unregister(). However, the work item dump_work may still be running or pending, leading to UAF bugs when the already freed crash_data is dereferenced again in mt7996_ma…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53081] In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce regsafe base id co…

In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars When regsafe() compares two scalar registers that both carry BPF_ADD_CONST, check_scalar_ids() maps their full compound id (aka base | BPF_ADD_CONST flag) as one idmap entry. However, it never verifies that the underlying base ids, that is, with the flag stripped…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53085] In the Linux kernel, the following vulnerability has been resolved: bpf: fix mm lifecycle in open-c…

In the Linux kernel, the following vulnerability has been resolved: bpf: fix mm lifecycle in open-coded task_vma iterator The open-coded task_vma iterator reads task->mm locklessly and acquires mmap_read_trylock() but never calls mmget(). If the task exits concurrently, the mm_struct can be freed as it is not SLAB_TYPESAFE_BY_RCU, resulting in a use-after-free. Safely read task->mm with a trylo…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53086] In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeo…

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53087] In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix leaking free…

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix leaking free_bds While reclaiming the tx queue we fast forward the write pointer to drop any data in flight. These dropped frames are not added back to the pool of free bds. We also need to tell the netdev that we are dropping said data.

nvdaltovulnerabilidad CVSS 7.5 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53088] In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix off-by-one i…

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb The write_ptr points to the next open tx_cb. We want to return the tx_cb that gets rewinded, so we must rewind the pointer first then return the tx_cb that it points to. That way the txcb can be correctly cleaned up.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53072] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix locking in hci_c…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls hci_connect_cfm(conn) without hdev->lock. Generally hci_connect_cfm() assumes it is held, and if conn is deleted concurrently -> UAF. Only SCO and ISO set HCI_PROTO_DEFER and only for defer setu…

nvdaltovulnerabilidad CVSS 8.8 NVD