Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-64215
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table<br /> <br /> Check the return value of kzalloc() to prevent a NULL pointer<br /> dereference on allocation failure.<br /> <br /> Patchwork: https://patchwork.freedesktop.org/patch/721342/
Gravedad: Pendiente de análisis
Última modificación:
30/07/2026

CVE-2026-64220
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> device property: set fwnode-&gt;secondary to NULL in fwnode_init()<br /> <br /> If a firmware node is allocated on the stack (for instance: temporary<br /> software node whose life-time we control) or on the heap - but using a<br /> non-zeroing allocation function - and initialized using fwnode_init(),<br /> its secondary pointer will contain uninitalized memory which likely will<br /> be neither NULL nor IS_ERR() and so may end up being dereferenced (for<br /> example: in dev_to_swnode()). Set fwnode-&gt;secondary to NULL on<br /> initialization.
Gravedad: Pendiente de análisis
Última modificación:
30/07/2026

CVE-2026-64216
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()<br /> <br /> netfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it<br /> is wanting to unlock and compares that to rreq-&gt;no_unlock_folio so that it<br /> doesn&amp;#39;t unlock a folio being read for netfs_perform_write() or<br /> netfs_write_begin().<br /> <br /> However, given that netfs_unlock_abandoned_read_pages() is called _after_<br /> NETFS_RREQ_IN_PROGRESS is cleared, the one folio that it&amp;#39;s not allowed to<br /> dereference is the one specified by -&gt;no_unlock_folio as ownership<br /> immediately reverts to the caller.<br /> <br /> Fix this by storing the folio pointer instead and using that rather than<br /> the index. Also fix netfs_unlock_read_folio() where the same applies.
Gravedad CVSS v3.1: CRÍTICA
Última modificación:
30/07/2026

CVE-2026-64217
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfs: Fix overrun check in netfs_extract_user_iter()<br /> <br /> Fix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills<br /> pages[], then those pages don&amp;#39;t get included in the iterator constructed at<br /> the end of the function. If there was an overfill, memory corruption has<br /> already happened.
Gravedad CVSS v3.1: ALTA
Última modificación:
30/07/2026

CVE-2026-64218
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> batman-adv: bla: fix report_work leak on backbone_gw purge<br /> <br /> batadv_bla_purge_backbone_gw() removes stale backbone gateway entries,<br /> but fails to properly handle their associated report_work:<br /> <br /> - If report_work is running, the purge must wait for it to finish before<br /> freeing the backbone_gw, otherwise the worker may access freed memory<br /> (e.g. bat_priv).<br /> - If report_work is pending, the purge must cancel it and release the<br /> reference held for that pending work item.<br /> <br /> The previous implementation called hlist_for_each_entry_safe() inside a<br /> spin_lock_bh() section, but cancel_work_sync() may sleep and therefore<br /> cannot be called from within a spinlock-protected region.<br /> <br /> Restructure the loop to handle one entry per spinlock critical section:<br /> acquire the lock, find the next entry to purge, remove it from the hash<br /> list, then release the lock before calling cancel_work_sync() and<br /> dropping the hash_entry reference. Repeat until no more entries require<br /> purging.
Gravedad CVSS v3.1: ALTA
Última modificación:
30/07/2026

CVE-2026-64219
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async<br /> <br /> [Why&amp;How]<br /> dc_process_dmub_aux_transfer_async() copies payload-&gt;length bytes into a<br /> 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which<br /> is a no-op in release builds. If a caller ever passes length &gt; 16 this<br /> results in a stack buffer overflow via memcpy.<br /> <br /> Additionally, link_index is used to dereference dc-&gt;links[] without<br /> bounds checking against dc-&gt;link_count, risking an out-of-bounds access.<br /> <br /> Replace the ASSERT with a hard runtime check that returns false when<br /> payload-&gt;length exceeds the destination buffer size, and add a bounds<br /> check for link_index before it is used.<br /> <br /> (cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881)
Gravedad CVSS v3.1: ALTA
Última modificación:
30/07/2026

CVE-2026-64221
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> spi: ti-qspi: fix use-after-free after DMA setup failure<br /> <br /> The driver falls back to PIO mode if DMA setup fails during probe.<br /> <br /> Make sure to clear the DMA channel pointer also if buffer allocation<br /> fails to avoid passing a pointer to the released channel to the DMA<br /> engine (or trying to free the channel a second time on late probe errors<br /> or driver unbind).<br /> <br /> This issue was flagged by Sashiko when reviewing a devres allocation<br /> conversion patch.
Gravedad CVSS v3.1: ALTA
Última modificación:
30/07/2026

CVE-2026-64209
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config<br /> <br /> swing_tbl and pre_emphasis_tbl are 4x4 arrays (valid indices 0-3), but<br /> the boundary check uses "&gt; 4" instead of "&gt;= 4", allowing index 4 to<br /> cause an out-of-bounds access.
Gravedad: Pendiente de análisis
Última modificación:
30/07/2026

CVE-2026-64211
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> srcu: Don&amp;#39;t queue workqueue handlers to never-online CPUs<br /> <br /> While an srcu_struct structure is in the midst of switching from CPU-0<br /> to all-CPUs state, it can attempt to invoke callbacks for CPUs that<br /> have never been online. Worse yet, it can attempt in invoke callbacks<br /> for CPUs that never will be online, even including imaginary CPUs not in<br /> cpu_possible_mask. This can cause hangs on s390, which is not set up to<br /> deal with workqueue handlers being scheduled on such CPUs. This commit<br /> therefore causes Tree SRCU to refrain from queueing workqueue handlers<br /> on CPUs that have not yet (and might never) come online.<br /> <br /> Because callbacks are not invoked on CPUs that have not been<br /> online, it is an error to invoke call_srcu(), synchronize_srcu(), or<br /> synchronize_srcu_expedited() on a CPU that is not yet fully online.<br /> However, it turns out to be less code to redirect the callbacks<br /> from too-early invocations of call_srcu() than to warn about such<br /> invocations. This commit therefore also redirects callbacks queued on<br /> not-yet-fully-online CPUs to the boot CPU.
Gravedad: Pendiente de análisis
Última modificación:
30/07/2026

CVE-2026-64212
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: iwlwifi: mld: don&amp;#39;t dereference a pointer before NULL checking it<br /> <br /> In iwl_mld_remove_link, the link-&gt;fw_id is saved at the beginning of the<br /> function so we have it after we freed the link.<br /> <br /> But the link pointer can be NULL, and is not checked when the fw_id is<br /> stored.<br /> <br /> Fix it by simply freeing the link at the end of the function.<br /> <br /> fFixes: 0e66a39f4f0e ("wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()")
Gravedad: Pendiente de análisis
Última modificación:
30/07/2026

CVE-2026-64213
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hwmon: (lm90) Add lock protection to lm90_alert<br /> <br /> Sashiko reports:<br /> <br /> lm90_alert() executes in the smbus alert context and calls<br /> lm90_update_confreg() to disable the hardware alert line, without<br /> acquiring hwmon_lock.<br /> <br /> Concurrently, sysfs write operations (such as lm90_write_convrate) hold<br /> the hwmon_lock, temporarily modify data-&gt;config, and then restore it.<br /> <br /> If an alert interrupt occurs concurrently with a sysfs write, the sysfs<br /> path will overwrite the alert handler&amp;#39;s modifications to data-&gt;config<br /> and the hardware register.<br /> <br /> This unintentionally re-enables the hardware alert line while the alarm is<br /> still active, causing an interrupt storm.<br /> <br /> Add the missing lock to lm90_alert() to solve the problem.
Gravedad: Pendiente de análisis
Última modificación:
30/07/2026

CVE-2026-64208
Fecha de publicación:
24/07/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks<br /> <br /> Change the krb5 crypto library to provide facilities to precheck the length<br /> of the message about to be decrypted or verified.<br /> <br /> Fix AF_RXRPC to make use of this to validate DATA packets secured with<br /> RxGK.
Gravedad CVSS v3.1: ALTA
Última modificación:
30/07/2026
Suscribirse a Vulnerabilidades