Alertas de Seguridad de la Información

C Informativo vulnerabilidad

25/09/2026

[CVE-2026-98132] In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead …

In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO states.c:__clean_func_state() can downgrade scalar zero spill to STACK_ZERO in the following case: *(u64 *)(r10 - 8) = 0; ... checkpoint ... r1 = *(u32 *)(r10 - 4); ... no reads from r10-8 ... Here 4 bytes at r10-8 are dead and verifier changes scalar spil…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

25/09/2026

[CVE-2026-98084] In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't cle…

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpf_loop() verifier marks R1 (and R4) as precise. R1 tracks loop iterations number and because of the 'callback_depth < R1' mechanics in check_helper_call() must be marked precise. However, precision propagation for R1 was broken, when bpf…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

25/09/2026

[CVE-2026-98034] In the Linux kernel, the following vulnerability has been resolved: bpf: Mark NULL kptr stores prec…

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark NULL kptr stores precise check_map_kptr_access() permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it does not mark that register precise. A state checkpoint reached with an imprecise zero can there…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

25/09/2026

[CVE-2026-98040] In the Linux kernel, the following vulnerability has been resolved: bpf: Mark the zero register pre…

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark the zero register precise for a register-form NULL check check_cond_jmp_op() accepts "if rA rB" as a NULL check for a nullable pointer rA when rB is a scalar known to be zero, lifts PTR_MAYBE_NULL from rA in the corresponding branch and does not mark rB precise. Consider the following program: r0 = bpf_get_pran…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

25/09/2026

[CVE-2026-98019] In the Linux kernel, the following vulnerability has been resolved: bpf: mark a NULL call argument …

In the Linux kernel, the following vulnerability has been resolved: bpf: mark a NULL call argument precise check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. check_helper_call() enforces second parameter of the bpf_get_local_storage() to be…

check-pointcheckpointbajo CVSS 0.0 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-93616] A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and…

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

C Informativo vulnerabilidad

17/09/2026

[CVE-2026-92502] In the Linux kernel, the following vulnerability has been resolved: ext4: clear stale xarray tags o…

In the Linux kernel, the following vulnerability has been resolved: ext4: clear stale xarray tags on folios skipped during writeback In data=journal mode, the writeback thread can hit the WARN_ON_ONCE(sb_rdonly(sb)) in ext4_journal_check_start() while the superblock is being remounted read-only during reboot: Workqueue: writeback wb_workfn (flush-253:0) RIP: 0010:ext4_journal_check_start+0x8b/0…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

16/09/2026

[CVE-2026-62997] Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_ex…

Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weights_only=True, and user-supplied load_args are silently dropped. On PyTorch versions earlier than 2.6, a malicious pickle-backed model from an attacker-influenced shared registry, download…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

16/09/2026

[CVE-2026-89834] In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg…

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during free_segment_range In free_segment_range(), the curseg evacuation loop only iterates up to NR_CURSEG_PERSIST_TYPE (0..5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC. Even though these in-memory curseg types are not saved in …

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

16/09/2026

[CVE-2026-89835] In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thr…

In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpoint_merge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through sysfs. The ckpt_thread_ioprio store path updates the saved ioprio value an…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

16/09/2026

[CVE-2026-89831] In the Linux kernel, the following vulnerability has been resolved: f2fs: protect critical_task_pri…

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect critical_task_priority updates with s_umount The sysfs store path already takes s_umount for GC thread control entries, and ckpt_thread_ioprio is covered as well. critical_task_priority also updates checkpoint or GC kthread scheduling state, but it is not covered by that serialization. It can race with remount or …

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

16/09/2026

[CVE-2026-89807] In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL …

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore Both create_queue_cpsch() and create_queue_nocpsch() unconditionally call mqd_mgr->restore_mqd() when a CRIU restore is in progress (qd != NULL), with no NULL guard. On any system where restore_mqd is not implemented for the given queue type, a user holding CAP_CHE…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

11/09/2026

[CVE-2026-89566] In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when…

In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when skipping busy checkpoint buffers journal_shrink_one_cp_list() skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP. The continue statement on this path also skips the need_resched() check at the end of the loop body. Consequently, when a checkpoint list contains mostly busy buffe…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

11/09/2026

[CVE-2026-89567] In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by e…

In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nr_to_scan. Busy buffers therefore do not consume the scan budget. If a checkpoint transaction contains mostly busy buffers, the shrinker can scan its entire checkpoint li…

check-pointcheckpointbajo CVSS 0.0 NVD