Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97937] In the Linux kernel, the following vulnerability has been resolved: ftrace: fork: Initialize functi…

In the Linux kernel, the following vulnerability has been resolved: ftrace: fork: Initialize function graph state before copy_exec_state() dup_task_struct() copies the parent's task_struct, including ret_stack. ftrace_graph_init_task() clears the copied function graph state, but it currently runs after copy_exec_state(). For non-CLONE_VM forks, copy_exec_state() allocates a new task_exec_state.…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97940] In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on se…

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6_route_iter_active() treats a walker in FWS_U at the table root as already unlinked. fib6_del_route() can move a still-linked walker into that same state when the current leaf is the last route at the root, so ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq private objec…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97941] In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n->list_lock in _…

In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race Commit ba7425312607 ("mm, slab: add an optimistic __slab_try_return_freelist()") incorrectly assumed that nobody has freed an object to the slab as long as slab->freelist is NULL and cmpxchg succeeds. However, as reported by Hyunwoo Kim [1], other CPUs mig…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97931] In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upg…

In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VM_MAYWRITE set on mappings created with PROT_READ. A process that can open the hwdep node O_RDWR can later use mprotect() to make the mapping writable. The read allocation begins w…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97926] In the Linux kernel, the following vulnerability has been resolved: ufs: validate cylinder group me…

In the Linux kernel, the following vulnerability has been resolved: ufs: validate cylinder group metadata before caching it ufs_read_cylinder() copies the cylinder group index and the rotor positions straight from the on-disk group and caches them without any check: ucpi->c_cgx = fs32_to_cpu(sb, ucg->cg_cgx); ucpi->c_rotor = fs32_to_cpu(sb, ucg->cg_rotor); ucpi->c_frotor = fs32_to_cpu(sb…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97911] In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM regi…

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM region size matches job It is possible for userspace to set the job SRAM size to 0, but then still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register is skipped and a stale base address from a prior job is used. Check the region size against the job…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97903] In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to threa…

In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to thread_pid across proc_flush_pid Commit 0a36bad01731 ("release_task: kill the no longer needed get/put_pid(thread_pid)") removed the reference around proc_flush_pid(). It assumed that free_pids(post.pids) at the end of release_task() would keep thread_pid alive until then. That assumption is wrong. __…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97910] In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress b…

In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress buffer sizes against fixed allocations sprd_platform_compr_open() allocates the stage 0 IRAM buffer (32K data area) and the stage 1 DDR buffer (2M data area) with fixed sizes, but sprd_platform_compr_copy() derives all copy lengths from the user controlled runtime->fragment_size and the write() coun…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

Vulnerabilidad alta en Rojo: DNS Rebinding permite lectura de código fuente y ejecución de programas

La API HTTP de Rojo (puerto 34872 por defecto) carece de validación de encabezados Host/Origin, permitiendo ataques de DNS Rebinding. Un atacante puede leer todo el código fuente del proyecto, escribir código malicioso en disco y ejecutar programas locales sin interacción del usuario. Afecta principalmente a desarrolladores que usan Rojo en máquinas con acceso a internet y a servidores de desarrollo expuestos en redes corporativas de LATAM.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97611] In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after…

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tbl_mask_array_realloc() retires the old mask_array before it stops being reachable: old = ovsl_dereference(tbl->mask_array); if (old) { ... call_rcu(&old->rcu, mask_array_rcu_cb); } rcu_assign_pointer(tbl->mask_array, new); call_rcu() only waits for re…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97612] In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear inner_protocol…

In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear inner_protocol when the last label is popped skb_mpls_push() records the pre-encapsulation network header once, gated on !skb->inner_protocol. skb_mpls_pop() never clears that record, so it outlives the encapsulation it describes. Open vSwitch can then re-push MPLS onto a packet whose inner_network_header still…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97608] In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: unregister l…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: unregister loggers before per-net teardown nf_log_syslog and nfnetlink_log unregister their per-network namespace operations before unregistering their global logger backends. This leaves a window where a sysctl or netlink writer can rebind the still- registered logger after the per-net pre-exit callback clear…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97609] In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: prevent U…

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: prevent UAF during module unload nf_ct_set_timeout() protects the timeout hook dereference and policy lookup with rcu_read_lock(). cttimeout_exit(), however, unregisters the per-net operations before it clears the hook. This allows the following interleaving: CPU 0 CPU 1 c…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97602] In the Linux kernel, the following vulnerability has been resolved: inet: frags: invalidate queues …

In the Linux kernel, the following vulnerability has been resolved: inet: frags: invalidate queues before flushing them fqdir_pre_exit() flushes the skbs from incomplete queues without changing their completion state. A fragment which found a queue before high_thresh was cleared can then acquire the queue lock and reuse stale reassembly metadata. A queue concurrently killed after fqdir->dead is …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97589] In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix wrong return c…

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix wrong return code to engine in asynch callbacks When crypto_finalize_hash_request() or crypto_finalize_skcipher_request() explicitly completes a request, the do_one_request callback must return 0 to indicate successful handling. Returning a negative error code causes the crypto engine to assume the driver failed…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97594] In the Linux kernel, the following vulnerability has been resolved: landlock: Fix use-after-free of…

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix use-after-free of the source's parent directory current_check_refer_path() reads old_dentry->d_parent without holding a reference nor a lock on it, and then dereferences it in collect_domain_accesses() and in the audit record. A reference on a child does not pin its parent: __d_move() reassigns dentry->d_parent an…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97595] In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free o…

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee802154_subif_frame() queues received beacon and MAC-command frames onto local->rx_beacon_list / rx_mac_cmd_list and schedules a process-context worker, storing a raw mac_pkt->sdata (and skb->dev == sdata->dev) with neither a reference nor any…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97583] In the Linux kernel, the following vulnerability has been resolved: afs: Clear stale peer app data …

In the Linux kernel, the following vulnerability has been resolved: afs: Clear stale peer app data after address list changes afs_fs_probe_fileserver() fetches the current endpoint state under server->fs_lock, but leaves old_alist as NULL. Consequently, afs_set_peer_appdata() treats every address list replacement as initial setup and only binds the new peers; it never unbinds peers removed from…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97584] In the Linux kernel, the following vulnerability has been resolved: afs: Fix incorrect free in cand…

In the Linux kernel, the following vulnerability has been resolved: afs: Fix incorrect free in candidate cleanup in afs_lookup_server() Fix afs_lookup_server() to not free an existing server's endpoint state when cleaning up a candidate server. The candidate record doesn't have an endpoint state yet at this point, so the free for that can just be removed.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97573] In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle buffer allocati…

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() bnxt_rx_ring_reset() frees the ring buffers and then reallocates them, ignoring the result. bnxt_alloc_one_rx_ring() can fail in bnxt_alloc_one_tpa_info_data(), which returns -ENOMEM on the first failed allocation and leaves the remaining rxr->rx_tpa[] entries ze…

nvdaltovulnerabilidad CVSS 8.1 NVD