Alertas de Seguridad de la Información

C Informativo vulnerabilidad

25/09/2026

[CVE-2026-98132] In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead …

In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO states.c:__clean_func_state() can downgrade scalar zero spill to STACK_ZERO in the following case: *(u64 *)(r10 - 8) = 0; ... checkpoint ... r1 = *(u32 *)(r10 - 4); ... no reads from r10-8 ... Here 4 bytes at r10-8 are dead and verifier changes scalar spil…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

25/09/2026

[CVE-2026-98084] In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't cle…

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpf_loop() verifier marks R1 (and R4) as precise. R1 tracks loop iterations number and because of the 'callback_depth < R1' mechanics in check_helper_call() must be marked precise. However, precision propagation for R1 was broken, when bpf…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

25/09/2026

[CVE-2026-98034] In the Linux kernel, the following vulnerability has been resolved: bpf: Mark NULL kptr stores prec…

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark NULL kptr stores precise check_map_kptr_access() permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it does not mark that register precise. A state checkpoint reached with an imprecise zero can there…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

25/09/2026

[CVE-2026-98040] In the Linux kernel, the following vulnerability has been resolved: bpf: Mark the zero register pre…

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark the zero register precise for a register-form NULL check check_cond_jmp_op() accepts "if rA rB" as a NULL check for a nullable pointer rA when rB is a scalar known to be zero, lifts PTR_MAYBE_NULL from rA in the corresponding branch and does not mark rB precise. Consider the following program: r0 = bpf_get_pran…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

25/09/2026

[CVE-2026-98019] In the Linux kernel, the following vulnerability has been resolved: bpf: mark a NULL call argument …

In the Linux kernel, the following vulnerability has been resolved: bpf: mark a NULL call argument precise check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. check_helper_call() enforces second parameter of the bpf_get_local_storage() to be…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

17/09/2026

[CVE-2026-92502] In the Linux kernel, the following vulnerability has been resolved: ext4: clear stale xarray tags o…

In the Linux kernel, the following vulnerability has been resolved: ext4: clear stale xarray tags on folios skipped during writeback In data=journal mode, the writeback thread can hit the WARN_ON_ONCE(sb_rdonly(sb)) in ext4_journal_check_start() while the superblock is being remounted read-only during reboot: Workqueue: writeback wb_workfn (flush-253:0) RIP: 0010:ext4_journal_check_start+0x8b/0…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

16/09/2026

[CVE-2026-62997] Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_ex…

Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedro_datasets_experimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weights_only=True, and user-supplied load_args are silently dropped. On PyTorch versions earlier than 2.6, a malicious pickle-backed model from an attacker-influenced shared registry, download…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

16/09/2026

[CVE-2026-89834] In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg…

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to migrate all curseg types during free_segment_range In free_segment_range(), the curseg evacuation loop only iterates up to NR_CURSEG_PERSIST_TYPE (0..5), missing non-persistent in-memory curseg types such as CURSEG_COLD_DATA_PINNED and CURSEG_ALL_DATA_ATGC. Even though these in-memory curseg types are not saved in …

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

16/09/2026

[CVE-2026-89835] In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thr…

In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid NULL checkpoint thread access in sysfs checkpoint_merge can be enabled even when no checkpoint merge thread is running. A read-only mount is one case: f2fs does not start f2fs_issue_ckpt there, but ckpt_thread_ioprio is still writable through sysfs. The ckpt_thread_ioprio store path updates the saved ioprio value an…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

16/09/2026

[CVE-2026-89831] In the Linux kernel, the following vulnerability has been resolved: f2fs: protect critical_task_pri…

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect critical_task_priority updates with s_umount The sysfs store path already takes s_umount for GC thread control entries, and ckpt_thread_ioprio is covered as well. critical_task_priority also updates checkpoint or GC kthread scheduling state, but it is not covered by that serialization. It can race with remount or …

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

16/09/2026

[CVE-2026-89807] In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL …

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore Both create_queue_cpsch() and create_queue_nocpsch() unconditionally call mqd_mgr->restore_mqd() when a CRIU restore is in progress (qd != NULL), with no NULL guard. On any system where restore_mqd is not implemented for the given queue type, a user holding CAP_CHE…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

11/09/2026

[CVE-2026-89566] In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when…

In the Linux kernel, the following vulnerability has been resolved: jbd2: check need_resched() when skipping busy checkpoint buffers journal_shrink_one_cp_list() skips busy checkpoint buffers when called with JBD2_SHRINK_BUSY_SKIP. The continue statement on this path also skips the need_resched() check at the end of the loop body. Consequently, when a checkpoint list contains mostly busy buffe…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

11/09/2026

[CVE-2026-89567] In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by e…

In the Linux kernel, the following vulnerability has been resolved: jbd2: bound shrinker scans by examined checkpoint buffers The jbd2 shrinker currently accounts only checkpoint buffers that it successfully releases against nr_to_scan. Busy buffers therefore do not consume the scan budget. If a checkpoint transaction contains mostly busy buffers, the shrinker can scan its entire checkpoint li…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

04/09/2026

[CVE-2026-18540] undici's retry interceptor can append the body of a ranged retry response to bytes already delivered…

undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response …

check-pointcheckpointbajo CVSS 3.7 NVD

C Medio vulnerabilidad

17/08/2026

[CVE-2026-75104] Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing atta…

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling file disclosure and filesystem reconnaissance.

check-pointcheckpointmedio CVSS 5.5 NVD

C Informativo vulnerabilidad

15/08/2026

[CVE-2026-74446] In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold event_mutex wh…

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold event_mutex while checkpointing CRIU events kfd_criu_checkpoint_events() counts the entries in p->event_idr via kfd_get_num_events(), allocates an array sized to that count, and then walks the same IDR to fill it. Neither the count nor the walk holds p->event_mutex. The CRIU checkpoint caller holds only p->mute…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

15/08/2026

[CVE-2026-72161] In the Linux kernel, the following vulnerability has been resolved: ocfs2: add journal NULL check i…

In the Linux kernel, the following vulnerability has been resolved: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() During unmount, ocfs2_journal_shutdown() frees the journal and sets osb->journal to NULL. Later, when VFS evicts remaining cached inodes, ocfs2_evict_inode() -> ocfs2_clear_inode() -> ocfs2_checkpoint_inode() -> ocfs2_ci_fully_checkpointed() dereferences osb->journal, cau…

check-pointcheckpointbajo CVSS 0.0 NVD

C Informativo vulnerabilidad

12/08/2026

[CVE-2026-68447] In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU contr…

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size from hardware without bounding it to the allocated BO region. If the HW field is larger than the queue's control stack allocation, memcpy reads past the BO into adjacent GTT memory and can …

check-pointcheckpointbajo CVSS 0.0 NVD

C Medio vulnerabilidad

06/08/2026

[CVE-2026-71433] LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of L…

LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by matching that string as a simple prefix pattern, so a read scoped to one namespace could also match a s…

check-pointcheckpointmedio CVSS 5.3 NVD

C Medio vulnerabilidad

04/08/2026

[CVE-2026-48121] @langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that …

@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from config.configurable are passed into MongoDB find() queries in MongoDBSaver.getTuple() without type enforcement. If an attacker supplies an objec…

check-pointcheckpointmedio CVSS 6.7 NVD