p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de la pila Sistemas operativos · Página 200

Vulnerabilidades publicadas para Sistemas operativos en los últimos 30 días: 6886. Incluidas en el catálogo KEV: 4.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Sistemas operativos

Vulnerabilidades: 161094

  1. CVE-2026-98763

    Alta · CVSS 7EPSS 0,18%Corrección disponible

    usb: core: clear both ep_in and ep_out for non-ep0 control endpoints

    In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both ep_in and ep_out for non-ep0 control endpoints In usb_enable_endpoint(), non-zero control endpoints (where usb_endpoint_xfer_control(&ep->desc) is true) populate both dev->ep_in[epnum] and dev->ep_out[epnum] with the same struct usb_host_endpoint pointer. However, usb_disable_endpoint() only clears either dev->ep_out[epnum] or dev->ep_in[epnum] depending on the direction bit of epaddr when reset_hardware is set, leaving the opposite direction's array slot pointing to the disabled/freed endpoint. Clear both dev->ep_out[epnum] and dev->ep_in[epnum] whe

    linux linux linux linux linux linux-6.12 linux linux-aws linux-azure linux-lts-xenial linux linux-awsSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-98762

    Sin evaluarEPSS 0,17%Corrección disponible

    USB: dwc2: shut down wakeup timer before freeing HCD state

    In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2_hcd_free() currently deletes the timer only after freeing host-owned state, and timer_delete() does not synchronize a callback or prevent it from being queued again. Stop and shut down the timer in dwc2_hcd_release(), before the HCD resources are freed. This covers both the HCD initialization error path and normal HCD removal.

    linux linux linux linux linux linux-6.12 linux linux-aws linux-azure linux-lts-xenial linux linux-awsSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2026-98761

    Media · CVSS 5.1EPSS 0,17%Corrección disponible

    usb: typec: tcpm: recover after failure to start the frs ams

    In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: recover after failure to start the frs ams Reset the port if the tcpm fails to start the FAST_ROLE_SWAP AMS by initiating error recovery on it. This helps in cases where some cables (incorrectly) signal an FRS to an FRS capable port during disconnection. The TCPC autonomously starts sourcing VBUS on detecting the FRS signal. However, the VBUS sourcing is left on when the FAST_ROLE_SWAP AMS fails to start (as tcpm_sink_tx_ok is 0 as CC is open due to the cable disconnect). This is because the code sets the state to INVALID_STATE without resetting the port

    linux linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edgeSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2026-98760

    Media · CVSS 4.3EPSS 0,17%Corrección disponible

    usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()

    In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() tps6598x_connect() passes a stack-allocated typec_partner_desc to typec_register_partner() after initializing only usb_pd, accessory and identity. typec_register_partner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typec_partner_link_device() when a USB device is linked to the port. Uninitialized pd_revision and usb_capability similarly leak stack data through partner sysfs. Zero-ini

    linux linux linux linux linux linux-6.12 linux-azure linux-aws-hwe linux-azure linux-gcp linux-hwe linux-hwe-edgeSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2026-98759

    Media · CVSS 4.1EPSS 0,21%Corrección disponible

    usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()

    In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work() cd321x_update_work() passes a stack-allocated typec_partner_desc to typec_register_partner() after initializing only usb_pd, accessory and identity. typec_register_partner() copies attach and deattach from the descriptor into the partner. With those fields left unset, garbage function pointers may be stored and later invoked from typec_partner_link_device() when a USB device is linked to the port. Uninitialized pd_revision and usb_capability similarly leak stack data through partner sysfs. Zero

    linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3 linux-gke-4.15Sistemas operativos
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  6. CVE-2026-98758

    Sin evaluarEPSS 0,17%Corrección disponible

    usb: typec: ucsi: glink: fix use-after-free of ucsi on remove

    In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmic_glink client is released by the devres cleanup, which runs after pmic_glink_ucsi_remove() has returned, so its notification callbacks can queue work until then. Work that runs after ucsi_unregister() has been called touches freed state: it dereferences the connector array that ucsi_unregister() freed, or registers and unregisters the instance a second time. Disable both work items with disable_work_sync() before unregistering, and unregister only if the instance is still registered. This issue was foun

    linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  7. CVE-2026-98757

    Sin evaluarEPSS 0,18%Corrección disponible

    usb: cdns3: fix use-after-free in cdns3_gadget_exit()

    In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3_gadget_exit() cdns3_gadget_start() arms two works on system_freezable_wq: pending_status_wq for the deferred ep0 status stage and aligned_buf_wq for realigned request buffers. Both handlers use the cdns3_device the works are embedded in, and cdns3_pending_setup_status_handler() also calls the ep0 request completion. cdns3_gadget_exit() does not wait for these works. It frees all endpoints and aligned buffers and drops the last reference to the gadget device, which frees priv_dev, so a work queued before the exit can run after the fre

    linux linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-aws-5.4 linux-azure linux-azure-5.3Sistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  8. CVE-2026-98756

    Sin evaluarEPSS 0,18%Corrección disponible

    usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe

    In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pci_set_drvdata(), while the second function reuses it via pci_get_drvdata() when pci_is_enabled() reports that the first function has already been probed. When the second function is probed while the first one has been enabled but has not yet set its driver data, pci_get_drvdata() returns NULL, and the subsequent wrap->devfn assignment dereferences a NULL pointer and crashes the kernel

    linux linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-aws-5.4 linux-azure linux-azure-5.3Sistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  9. CVE-2026-98755

    Sin evaluarEPSS 0,18%Corrección disponible

    tty: vcc: zero-initialize control packet in vcc_send_ctl()

    In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vcc_send_ctl() The stack-allocated struct vio_vcc pkt was partially initialized, leaving the tag.stype_env field uninitialized before being sent via ldc_write(), potentially leaking kernel stack data to the LDC peer.

    linux linux linux linux linux linux-6.12 linux linux-aws linux-azure linux-lts-xenial linux linux-awsSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  10. CVE-2026-98754

    Alta · CVSS 7.1EPSS 0,18%Corrección disponible

    tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

    In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup vcc_cleanup() sets port->tty to NULL without holding port->lock, racing with vcc_event() LDC callbacks that read port->tty under port->lock and then use tty->port. This can cause a use-after-free when the callback dereferences tty->port after cleanup has already destroyed and freed it.

    linux linux linux linux linux linux-6.12 linux linux-aws linux-azure linux-lts-xenial linux linux-awsSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  11. CVE-2026-98753

    Media · CVSS 5.6EPSS 0,18%Corrección disponible

    tty: tty_port: restore TTY_IO_ERROR on activation failure

    In the Linux kernel, the following vulnerability has been resolved: tty: tty_port: restore TTY_IO_ERROR on activation failure Make sure to restore the TTY_IO_ERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic due to unclocked accesses or NULL-pointer dereferences when accessing powered down or deregistered ports when a TTY ioctl races with hangup and open. Note that the flag is set again in tty_port_close() but not restoring it on activation failure leaves a window where drivers fail to handle the ioctl-hangup race.

    linux linux linux linux linux linux-6.12 linux linux-aws linux-azure linux-lts-xenial linux linux-awsSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  12. CVE-2026-98752

    Alta · CVSS 7.3EPSS 0,18%Corrección disponible

    tty: port: fix tty_port_tty_vhangup() race

    In the Linux kernel, the following vulnerability has been resolved: tty: port: fix tty_port_tty_vhangup() race Drivers rely on tty_port_tty_vhangup() to synchronously hang up their ports before tearing down resources as part of deregistration (e.g. on physical disconnect). If tty_port_tty_vhangup() races with another hangup it may however return before the port has been shut down. This is in turn can lead to use-after-free and NULL-pointer dereferences in racing ioctls (including a synchronous hangup) and in processing of racing asynchronous hangups (carrier loss). Add the missing serialisation to tty_port_tty_vhangup() and tty_port_hangu

    linux linux linux linux linux linux-6.12 linux linux-aws linux-azure linux-lts-xenial linux linux-awsSistemas operativos
    • Actualiza a 2.6.32
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  13. CVE-2026-98751

    Sin evaluarEPSS 0,18%Corrección disponible

    tty: abort break signalling on hangup

    In the Linux kernel, the following vulnerability has been resolved: tty: abort break signalling on hangup The break ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Drivers must handle this race, but TCSBRK and TCSBRKP should still be aborted to avoid calling back into the driver after a user-controlled timeout (possibly even after the tty has been reopened). Note that drivers should disable any break state on shutdown so just return on hangup (calling break_ctl() again is racy and will most likely fail for drivers handling the race).

    linux linux linux linux linux linux-6.12 linux linux-aws linux-azure linux-lts-xenial linux linux-awsSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  14. CVE-2026-98750

    Media · CVSS 5.4EPSS 0,18%Corrección disponible

    tty: fix saved termios reset race

    In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being opened (e.g. when CLOCAL is not set). Not all TTY drivers guarantee that the minor number is no longer in use when registering devices however, something which can lead to a use-after-free when closing a TTY (and saving its termios) races with re-registration. Add a new TTY_DRIVER_RESET_SAVED_TERMIOS flag to request that any saved termios state is

    linux linux linux linux linux linux-6.12 linux-azure linux-aws-hwe linux-azure linux-gcp linux-hwe linux-hwe-edgeSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  15. CVE-2026-98749

    Sin evaluarEPSS 0,18%Corrección disponible

    tty: serial: max3100: shut down timer before freeing port

    In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100_shutdown() stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the serial core does not call max3100_shutdown() again, so max3100_remove() frees the port while the timer remains armed. max3100_timeout() may then access the freed port and re-arm the timer. Add final timer teardown to max3100_remove() and use timer_shutdown_sync() to prevent a racing callback from re-arming it. Also free the IRQ and destroy the workqueue there before freeing the port. Ke

    linux linux linux linux linux linux-6.12 linux linux-aws linux-azure linux-lts-xenial linux linux-awsSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  16. CVE-2026-98748

    Sin evaluarEPSS 0,17%Corrección disponible

    serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()

    In the Linux kernel, the following vulnerability has been resolved: serial: 8250_bcm7271: fix use-after-free in brcmuart_remove() brcmuart_handle_irq() starts priv->hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuart_hrtimer_func() dereferences priv. brcmuart_remove() cancels the hrtimer before it unregisters the port, so a receive-timeout interrupt that arrives in between re-arms the timer. After devm frees priv, the callback runs on freed memory. Unregister the port before cancelling the hrtimer. serial8250_unregister_port() shuts the port down and frees its IRQ,

    linux linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edgeSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  17. CVE-2026-98747

    Sin evaluarEPSS 0,15%Corrección disponible

    serial: core: fix NULL pointer dereference in serial_core_unregister_port()

    In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serial_core_unregister_port() port->port_dev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serial_core_port_device_add(). serial_core_unregister_port() passes it straight to serial_core_get_ctrl_dev(), which dereferences it: KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] RIP: serial_core_unregister_port Call Trace: serial8250_unregister_port serial8250_remove unbind_store Return early when there is no port device, and rea

    linux linux linux linux linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcp linux-gcp-5.3Sistemas operativos
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  18. CVE-2026-98746

    Sin evaluarEPSS 0,17%Corrección disponible

    serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()

    In the Linux kernel, the following vulnerability has been resolved: serial: ma35d1: Fix clock reference leak in ma35d1serial_probe() of_clk_get() returns a clock with a reference that has to be released with clk_put(). ma35d1serial_probe() never does that, so the reference is leaked on the probe error paths and also when the port is removed. Release it on the error paths and in ma35d1serial_remove().

    linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  19. CVE-2026-98745

    Media · CVSS 6.8EPSS 0,17%Corrección disponible

    arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems

    In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems When system_supports_sme() is true but system_supports_sve() is false, restoring a specifically crafted SVE signal context can result in the task erroneously having non-streaming SVE state. Subsequent attempts to manipulate the task's FPSIMD/SVE/SME state can result in a variety of problems, including fatal EL1 UNDEFs. In such configurations, the kernel always creates an SVE signal context when delivering a signal, and this can only be in one of two states: (1) SVE_SIG_FLAG_SM is set, and an SVE pa

    linux linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edgeSistemas operativos
    • Actualiza a 6.1.191
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  20. CVE-2026-98744

    Media · CVSS 4.8EPSS 0,17%Corrección disponible

    ASoC: codecs: max98363: fix uninitialized stream_config->type

    In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix uninitialized stream_config->type stream_config is not initialized before being passed to sdw_stream_add_slave(). The type field may contain garbage and is later copied to stream->type by sdw_config_stream(). Zero-initialize stream_config so type defaults to SDW_STREAM_PCM.

    linux linux linux linux linux-6.12 linux-hwe-edge linux-aws-5.0 linux-aws-5.3 linux-azure linux-azure-5.3 linux-azure-edge linux-gcpSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 6.12.113-1~deb12u1
    • Actualiza a 7.2.10-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →