p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de la pila Sistemas operativos · Página 5

Vulnerabilidades publicadas para Sistemas operativos en los últimos 30 días: 6741. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Sistemas operativos

Vulnerabilidades: 158889

  1. CVE-2026-99061

    Sin evaluarEPSS 0,21%Corrección disponible

    wifi: brcmfmac: fix P2P device removal race in brcmf_detach()

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmf_detach() When the driver is removed while the user space process that created the P2P device (e.g. wpa_supplicant) is still exiting, the P2P device interface is removed twice and the kernel crashes. The two paths are: - wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P device. nl80211_del_interface() holds RTNL and the wiphy mutex and calls brcmf_p2p_del_vif(), which disables discovery and waits up to 1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(), which unregisters the

    linux linux linux linux linuxSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 7.2.11-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-99060

    Sin evaluarEPSS 0,21%Corrección disponible

    wifi: mt76: mt7603: initialize global station WCID

    In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global WCID initialized by mt76_register_device(), this WCID is published without ever being passed to mt76_wcid_init(). Since commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status"), mt76_tx() queues every such frame on the WCID's tx_pending or tx_offchannel queue and links its tx_list. The first injected frame ther

    linux linux linux linuxSistemas operativos
    • Actualiza a 456de496b53ae73e6e3020fec815dbdc88aa7c07
    • Actualiza a 6.12.113-1
    • Actualiza a 7.2.11-1
    • Actualiza a 99b8bd6323e6fc69615af828522878b7acb77bff
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2026-99059

    Sin evaluarEPSS 0,21%Corrección disponible

    wireguard: noise: reject response consumption after intermediate initiation

    In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partway through, and during that slow calculation, or even while blocking on down_write(), A completes and then also a handshake initiation that's already been queued up runs in thread C, which itself takes that same down_write(). The handshake initiation creation succeeds, and sets the state back to waiting-for-response, and calls up_write(), at which p

    linux linux linux linux linuxSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 7.2.11-1
    • Actualiza a fb5ce4c7790c3eeec820302d08d70ecf46af4295
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2026-99058

    Sin evaluarEPSS 0,22%Corrección disponible

    workqueue: Fix NULL current_pwq deref in chained work check

    In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current_pwq deref in chained work check current_wq_worker() only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker->current_pwq is populated only while process_one_work() is running the work function. is_chained_work() can be reached while queueing on a draining or destroying workqueue. If a kworker outside work-item execution reaches that path, current_wq_worker() returns a worker but worker->current_pwq is NULL, and the chained-work test can fault before it emits the intended warni

    linux linux linux linux linuxSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 7.2.11-1
    • Actualiza a 729d576df89c7e4341e58c452f8890620a610ac2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2026-99057

    Sin evaluarEPSS 0,21%Corrección disponible

    xen/netfront: don't leak the skb when xennet_fill_frags() fails

    In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennet_fill_frags() fails When a response chain has more slots than fit in the skb's frags, xennet_fill_frags() returns an error and xennet_poll() jumps to its error path. That path moves what's left on tmpq to errq to be freed, but the skb being filled was already dequeued from tmpq, so it's never freed. Each chain that overflows leaks the skb and the pages attached to it as frags, and the backend decides how many slots it sends. Put the skb back on tmpq before taking the error path, like the xennet_set_skb_gso() failure just above

    linux linux linux linux linuxSistemas operativos
    • Actualiza a 5051df031144753d3e18862514969146b601d089
    • Actualiza a 6.12.113-1
    • Actualiza a 7.2.11-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  6. CVE-2026-99056

    Sin evaluarEPSS 0,21%Corrección disponible

    strparser: make sure __strp_recv isn't running before tearing down the parser

    In the Linux kernel, the following vulnerability has been resolved: strparser: make sure __strp_recv isn't running before tearing down the parser The comment above strp_done() claims that if strp is stopped, strp_recv will no longer be called. That's only true if the caller has a mechanism (eg locking) to guarantee that strp_recv() calls that started before strp_stop() have completed by the time we call strp_done(). This adds a dummy lock_sock/release_sock pair to guarantee that any in-flight strp_recv() (which runs under either bh_lock_sock or lock_sock, depending if it's called from ->sk_data_ready or strp_work) has completed. Only espi

    linux linux linux linux linuxSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 7.2.11-1
    • Actualiza a 9f3e9fe1b155e9b4572054d8d140586bc3512ecf
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  7. CVE-2026-99055

    Sin evaluarEPSS 0,21%Corrección disponible

    tcp: reject net_iov in zerocopy receive mapping hints

    In the Linux kernel, the following vulnerability has been resolved: tcp: reject net_iov in zerocopy receive mapping hints After copying a readable prefix, receive_fallback_to_copy() asks tcp_zerocopy_set_hint_for_skb() where page mapping can resume. If the next skb is unreadable, find_next_mappable_frag() passes its net_iov fragment to can_map_frag(). skb_frag_page() returns NULL for a net_iov, but can_map_frag() dereferences it in PageCompound(). A v7.2 KASAN run on a connected TCP socket with 64 readable bytes followed by a 4096-byte NET_IOV_DMABUF fragment reported: BUG: KASAN: null-ptr-deref in can_map_frag tcp_zerocopy_receive ->

    linux linux linux linuxSistemas operativos
    • Actualiza a 563d3564513496b9ce3b3ba7a5154427554d0f06
    • Actualiza a 6.12.113-1
    • Actualiza a 7.2.11-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  8. CVE-2026-99054

    Sin evaluarEPSS 0,21%Corrección disponible

    tipc: destroy topsrv workqueues before closing connections

    In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipc_topsrv_stop() closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could then queue more work, and in-flight send/recv work could drop the last connection reference during the conn_idr walk. That race produced several teardown failures: refcount_t addition on 0 from conn_get() on a connection whose release was blocked on idr_lock, a subsequent use-after-free in tipc_conn_close(), queue_work() on an already destroyed w

    linux linux linux linux linuxSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 7.2.11-1
    • Actualiza a 7f796bb3b440d7f1b14c0e3b520462eb34f553af
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  9. CVE-2026-99053

    Sin evaluarEPSS 0,21%Corrección disponible

    tipc: hold a reference to nodes found by link name

    In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipc_node_find_by_name() returns a node after dropping its RCU read lock without taking a reference. The LINK_SET, LINK_GET and LINK_RESET_STATS handlers then lock and access the node, racing with timer-driven cleanup of a down peer. Generic netlink serialization does not exclude the node timer. The following interleaving can leave a handler using a freed node: CPU 0: find the node under RCU and release the node read lock CPU 1: tipc_node_timeout() clears the links and unlinks the down node CPU 1: drop the list an

    linux linux linux linux linuxSistemas operativos
    • Actualiza a 1428c5f1d346a2e1ac9156713975a72246957009
    • Actualiza a 6.12.113-1
    • Actualiza a 7.2.11-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  10. CVE-2026-99052

    Sin evaluarEPSS 0,21%Corrección disponible

    selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts

    In the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts When an NFSv4 filesystem exported with security_label is mounted a second time, sget_fc() returns the existing superblock and nfs_get_root() calls security_sb_set_mnt_opts() again on it. Since the superblock is already SB_INITIALIZED, selinux_set_mnt_opts() takes an early exit without setting SECURITY_LSM_NATIVE_LABELS in *set_kern_flags. nfs_get_root() then sees kflags without SECURITY_LSM_NATIVE_LABELS set and clears NFS_CAP_SECURITY_LABEL on the shared nfs_server, silently disabling per-file labeli

    linux linux linux linux linuxSistemas operativos
    • Actualiza a 5509d498e1b9edafebd5a60ba3cb9ecfda23dc2b
    • Actualiza a 6.12.113-1
    • Actualiza a 7.2.11-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  11. CVE-2026-99051

    Sin evaluarEPSS 0,2%Corrección disponible

    fsverity: RCU-delay the freeing of struct fsverity_info

    In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverity_info __fsverity_get_info() calls rhashtable_lookup_fast(), which just uses rcu_read_lock() and doesn't directly synchronize with fsverity_remove_info(). For the same inode this isn't a problem: its fsverity_info is removed only at inode eviction time or upon failure to enable verity, when the inode no longer needs its fsverity_info and it will no longer be accessed via that inode. However, this is broken and can cause a use-after-free for concurrent __fsverity_get_info() for *different* inodes. Those rely on following fs

    linux linux linuxSistemas operativos
    • Actualiza a 7.2.11-1
    • Actualiza a fa84f091a8e7fc46fd29834496fab9739dd4c8dc
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  12. CVE-2026-99050

    Sin evaluarEPSS 0,21%Corrección disponible

    gpio: mpsse: fix race when arming the IRQ poll worker

    In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio_mpsse_irq_enable() arms the poll worker before publishing it: schedule_work() runs before the worker is added to priv->workers. If gpio_mpsse_disconnect() walks the list in that window it misses the worker, and once disconnect returns, the USB core frees mpsse_priv while the orphaned gpio_mpsse_poll() work keeps accessing it, causing a use-after-free. Fix this by publishing and arming the worker in one irq_spin critical section. Teardown walks the same list under irq_spin, so a worker found on the list is guarantee

    linux linux linuxSistemas operativos
    • Actualiza a 6.18.57
    • Actualiza a 7.2.11-1
    • Actualiza a 76390ac0bca7e5058b7482eb4d951c3bda5df812
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  13. CVE-2026-99049

    Sin evaluarEPSS 0,21%Corrección disponible

    gpio: xilinx: fix runtime PM leak on request error path

    In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pm_runtime_get_sync() leaves the usage counter incremented even when it fails, and xgpio_request() returns the error without dropping it. gpiolib does not call ->free() when ->request() fails, so xgpio_free(), which holds the only matching pm_runtime_put(), never runs. The reference is leaked and the controller can no longer runtime-suspend, so its clock stays enabled. Switch to pm_runtime_resume_and_get(), which only increments the usage counter on success.

    linux linux linux linux linuxSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 7.2.11-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  14. CVE-2026-99048

    Sin evaluarEPSS 0,21%Corrección disponible

    gve: fix napi_disable deadlock when attempting to disable XSK pools

    In the Linux kernel, the following vulnerability has been resolved: gve: fix napi_disable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls the unlocked versions of napi_disable and napi_enable. However, the netdev lock has already been acquired before ndo_bpf is called because GVE supports queue management ops. Calling the unlocked versions of napi_disable/enable results in a deadlock when attempting to disable XSK pools, as the thread attempts to re-acquire a lock it already holds. Update the NAPI calls to use the locked versions. This issue was found in production.

    linux linux linuxSistemas operativos
    • Actualiza a 7.2.11-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  15. CVE-2026-99047

    Sin evaluarEPSS 0,21%Corrección disponible

    gve: fix XSK buffer leak when rings are stopped

    In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak when rings are stopped GVE does not free XSK buffers when resetting ring state as a part of stopping queues. This causes all XSK buffers which are posted to the NIC to be leaked. Free XSK buffers attached to an allocated buf_state when stopping rings. This issue was hit in production.

    linux linux linuxSistemas operativos
    • Actualiza a 506f9de069d07a72b9887ce3edd2fdf32f4953aa
    • Actualiza a 7.2.11-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  16. CVE-2026-99046

    Sin evaluarEPSS 0,21%Corrección disponible

    gve: fix XSK buffer leak on error descriptor

    In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the buf_state and its attached buffer should be freed. In the case of AF_XDP ZC, the XSK buffer was not freed, leading to a leak. This issue was caught by LLM.

    linux linux linuxSistemas operativos
    • Actualiza a 06656aaa7e43ae62b673c2244d27099b8b94a70d
    • Actualiza a 7.2.11-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  17. CVE-2026-99045

    Sin evaluarEPSS 0,21%Corrección disponible

    ibmveth: h_free logical LAN on open-fail after register

    In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_buffer_pools without h_free_logical_lan(), so PHYP still owns the buffer-list page when it is unmapped. request_irq() failure already issued the hypercall before taking the same label. Move that h_free to the shared post-register unwind so both paths deregister before the buffer list is unmapped.

    linux linux linux linux linuxSistemas operativos
    • Actualiza a 6.12.113-1
    • Actualiza a 7.2.11-1
    • Actualiza a decb4d4ead2c71ef698727734ab5024a872eb372
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  18. CVE-2026-99044

    Sin evaluarEPSS 0,21%Corrección disponible

    ice: fix use-after-free in dynamic port cleanup

    In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the dynamic port from pf->dyn_ports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-free. Follow the reverse of the allocation order in ice_alloc_dynamic_port() by erasing the xarray entry before freeing the VSI.

    linux linux linux linuxSistemas operativos
    • Actualiza a 7.2.11-1
    • Actualiza a 7c1344df1ae0579f57b97647e5203b06496ce10c
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  19. CVE-2026-99043

    Sin evaluarEPSS 0,21%Corrección disponible

    ice: fix metadata_dst refcount handling on representor teardown

    In the Linux kernel, the following vulnerability has been resolved: ice: fix metadata_dst refcount handling on representor teardown ice_eswitch_release_repr() uses metadata_dst_free() to release the representor's metadata_dst. metadata_dst_free() directly frees the underlying memory without checking the dst_entry refcount. When ice_eswitch_port_start_xmit() processes a packet, it takes a reference via dst_hold() and attaches the metadata_dst to the skb. If the representor is torn down while packets are still queued on the lower device (e.g. in a qdisc), the metadata_dst is freed while references are still held. Use dst_release() instead,

    linux linux linux linux linuxSistemas operativos
    • Actualiza a 1f263235651775f93c15d90c9f25c3f4a4ef6512
    • Actualiza a 6.12.113-1
    • Actualiza a 7.2.11-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  20. CVE-2026-99042

    Sin evaluarEPSS 0,21%Corrección disponible

    io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

    In the Linux kernel, the following vulnerability has been resolved: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_connect_bpf_populate() fills connect.port and connect.v6_addr for AF_INET6 only when addr_len >= sizeof(struct sockaddr_in6), i.e. 28 bytes. The IPv6 connect paths accept SIN6_LEN_RFC2133 (24 bytes), which already holds sin6_port and sin6_addr. io_connect() passes addr_len to the socket layer unchanged. At addr_len 24 the filter sees family AF_INET6 with port and address zero, while the kernel connects to the real destination. A filter that denies an IPv6 port or address is bypassed. Denying connect.

    linux linux linuxSistemas operativos
    • Actualiza a 7.2.11-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →