Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-80554
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/vfio_ccw: Limit the number of channel program segments<br /> <br /> The processing of channel programs, and the CCWs within them, is done<br /> recursively. As such, there is an arbitrary (but not architectural)<br /> limit to the number of CCWs that can exist in a single channel program.<br /> <br /> The vfio-ccw logic breaks these channel programs into segments whenever<br /> it encounters a Transfer-In-Channel (TIC) CCW, and the combined number<br /> of segments count towards the global limit. Impose an equivalent limit<br /> to the number of segments until such logic can be made non-recursive.
Gravedad CVSS v3.1: CRÍTICA
Última modificación:
27/08/2026

CVE-2026-80542
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()<br /> <br /> amdgpu_dm_crtc_set_vblank() dereferences acrtc_state-&gt;stream when<br /> vblank is enabled/queried from DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before<br /> a stream is attached to it.<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000008<br /> RIP: amdgpu_dm_crtc_set_vblank+0x6b/0x4d0 [amdgpu]<br /> Call Trace:<br /> drm_vblank_enable<br /> drm_vblank_get<br /> drm_crtc_get_sequence_ioctl<br /> drm_ioctl_kernel<br /> drm_ioctl<br /> <br /> Reproduced by running VKCTS with WSI tests enabled on RADV.<br /> <br /> Guard the enable path on acrtc_state-&gt;stream being non-NULL, matching<br /> the existing checks in this function.<br /> <br /> (cherry picked from commit 7b1b31bf6942e6f43509b48da23f8e27269aac39)
Gravedad: Pendiente de análisis
Última modificación:
26/08/2026

CVE-2026-80543
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/zcrypt: Pad trailing CCA or EP11 message with zeros<br /> <br /> The both functions xcrb_msg_to_type6cprb_msgx() and<br /> xcrb_msg_to_type6_ep11cprb_msgx() copy the user space message into a<br /> kernel buffer based on the message length. But on further processing<br /> the message is supposed to be 4 byte length adjusted. Thus up to 3<br /> bytes of uninitialized kernel memory are forwarded to further<br /> processing steps and may unwanted expose kernel memory to the crypto<br /> card firmware.<br /> <br /> This patch contains code to pad the gap between user space copied<br /> message and message buffer length sent down to further processing of<br /> the CCA or EP11 message to zeros.
Gravedad: Pendiente de análisis
Última modificación:
26/08/2026

CVE-2026-80538
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfs: propagate errors from xfs_rtginode_load<br /> <br /> xfs_rtginode_ensure() treats every xfs_rtginode_load() error other than<br /> -ENOENT as success. This can leave the realtime group inode unset after an<br /> I/O, allocation, or corruption error. Growfs then continues as though the<br /> inode had been loaded.<br /> <br /> Only -ENOENT means that the inode needs to be created. Return all other<br /> errors to the growfs caller.
Gravedad CVSS v3.1: ALTA
Última modificación:
27/08/2026

CVE-2026-80539
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: disallow multiple FENCE chunks in one submit<br /> <br /> amdgpu_cs_pass1() dispatches on chunk_id once per chunk without<br /> rejecting repeated ids. p-&gt;uf_bo is a single-slot field, so a<br /> submission carrying two AMDGPU_CHUNK_ID_FENCE chunks runs<br /> amdgpu_cs_p1_user_fence() twice, and the second run overwrites<br /> p-&gt;uf_bo with a freshly referenced BO without dropping the reference<br /> taken by the first.<br /> <br /> amdgpu_cs_parser_fini() only unrefs the final p-&gt;uf_bo, so every FENCE<br /> chunk but the last leaks a BO reference. The leaked BO outlives handle<br /> close and process exit.<br /> <br /> Reject duplicate FENCE chunks the same way commit fec5f8e8c6bc<br /> ("drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit") did<br /> for p-&gt;bo_list.<br /> <br /> (cherry picked from commit 665b1fc2a1845206408f9a2c6da67101789edb82)
Gravedad: Pendiente de análisis
Última modificación:
27/08/2026

CVE-2026-80540
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: Fix UVD decode image min size calculation<br /> <br /> This needs to use pitch instead of width. Also reject pitch<br /> over 4096 to avoid overflow.<br /> <br /> (cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304)
Gravedad CVSS v3.1: ALTA
Última modificación:
27/08/2026

CVE-2026-80541
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: validate GEM_CREATE domain combinations<br /> <br /> AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK,<br /> but did not validate domain combinations. Userspace could combine<br /> CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making<br /> amdgpu_bo_placement_from_domain() exceed AMDGPU_BO_MAX_PLACEMENTS and<br /> hit BUG_ON().<br /> <br /> Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/<br /> VRAM domains to be specified one at a time. Return -EINVAL for invalid<br /> combinations in amdgpu_gem_create_ioctl().<br /> <br /> v2: Rename helper from amdgpu_gem_domain_valid() to<br /> amdgpu_gem_are_domains_valid() (Christian)<br /> <br /> (cherry picked from commit db39852d0c39843cb02048dfb47e4b8c703e9080)
Gravedad CVSS v3.1: ALTA
Última modificación:
27/08/2026

CVE-2026-80544
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing<br /> <br /> The zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct<br /> overlays to access and modify the domain field in the EP11 CPRB<br /> payload, creating maintainability and security concerns:<br /> 1. Struct overlay approach (pld_hdr) assumes fixed payload structure<br /> and doesn&amp;#39;t validate the actual ASN.1 encoding.<br /> 2. Complex length format detection logic is error-prone and doesn&amp;#39;t<br /> properly validate bounds at each parsing step.<br /> 3. Direct struct member access bypasses proper ASN.1 validation.<br /> <br /> Fix by replacing struct overlays with explicit ASN.1 parsing that<br /> validates each field (payload tag/length, function tag/length/value,<br /> optional domain tag/length/value) with proper bounds checking at every<br /> step. Add asn1_int_encode() helper function to safely write integer<br /> values with correct endianness conversion. This makes the code<br /> consistent with the validation pattern introduced with the rework of<br /> the xcrb_msg_to_type6_ep11cprb_msgx() function.
Gravedad CVSS v3.1: ALTA
Última modificación:
27/08/2026

CVE-2026-80545
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/zcrypt: Improve EP11 CPRB length and overflow checks<br /> <br /> The xcrb_msg_to_type6_ep11cprb_msgx() function lacks proper input<br /> validation, creating security vulnerabilities:<br /> 1. Missing minimum size validation: The ep11_cprb structure and<br /> subsequent payload fields (pld_tag, pld_lenfmt) are copied from<br /> userspace without verifying sufficient buffer length.<br /> 2. Arithmetic overflow in length calculations: CEIL4 alignment could<br /> overflow, bypassing size checks and enabling buffer overflows.<br /> 3. The payload is asn1 encoded but the function just uses a simple c<br /> struct overlay to access some fields of the payload.<br /> <br /> Fix by using size_t for length calculations, adding U32_MAX boundary<br /> checks after alignment, and validating minimum request size and<br /> minimum reply size before copying from userspace. Do a very simple<br /> asn1 parsing of the payload up to the function value field.
Gravedad CVSS v3.1: ALTA
Última modificación:
27/08/2026

CVE-2026-80546
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/zcrypt: Improve CCA CPRB length and overflow checks<br /> <br /> The xcrb_msg_to_type6cprb_msgx() function lacks proper input<br /> validation, creating security vulnerabilities:<br /> 1. Integer overflow after CEIL4 alignment: Signed int variables could<br /> overflow during 4-byte boundary alignment, causing undersized<br /> buffer allocations or incorrect bounds checking.<br /> 2. Missing minimum size validation: The CPRBX structure is copied from<br /> userspace without verifying sufficient buffer length. Undersized<br /> buffers cause uninitialized memory access when reading structure<br /> fields like cprbx.cprb_len and cprbx.domain.<br /> 3. Arithmetic overflow in sum calculations: Adding control block and<br /> data block sizes could overflow, bypassing size checks and enabling<br /> buffer overflows.<br /> <br /> Fix by using size_t for length calculations, adding U32_MAX boundary<br /> checks after alignment, validating minimum control block size before<br /> copying from userspace, and detecting sum calculation overflows.
Gravedad CVSS v3.1: ALTA
Última modificación:
27/08/2026

CVE-2026-80532
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfs: fix another iunlink infinite loop bug in online fsck<br /> <br /> xrep_iunlink_resolve_bucket is supposed to reconstruct as much of the<br /> incore prev and next unlinked list pointers based on what it finds on<br /> disk and in memory before we move on to relinking the truly lost inodes<br /> back into the unlinked list. However, it&amp;#39;s still vulnerable to infinite<br /> loops that come in via the next_unlinked pointers.<br /> <br /> Fix this problem by remembering which inodes we&amp;#39;ve already seen and<br /> checking new agino pointers against that. If a bit is already set,<br /> either this is a loop or the inode has nonzero link count. We&amp;#39;ll deal<br /> with the second case in a subsequent patch.
Gravedad: Pendiente de análisis
Última modificación:
26/08/2026

CVE-2026-80533
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfs: don&amp;#39;t walk off the end of a null sc-&gt;sa.agi_bp in AGI repair<br /> <br /> LOLLM noticed a longstanding bug where xrep_iunlink_walk_ondisk_bucket<br /> tries to walk ragi-&gt;sc-&gt;sa.agi_bp to rebuild the unlinked inode lists.<br /> Unfortunately, it&amp;#39;s possible for agi_bp to be null if the buffer<br /> verifier fails, so we have to use ragi-&gt;agi_bp (which skips verifier<br /> checks) instead.
Gravedad: Pendiente de análisis
Última modificación:
26/08/2026
Suscribirse a Vulnerabilidades