Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-31755
Fecha de publicación:
01/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: cdns3: gadget: fix NULL pointer dereference in ep_queue<br /> <br /> When the gadget endpoint is disabled or not yet configured, the ep-&gt;desc<br /> pointer can be NULL. This leads to a NULL pointer dereference when<br /> __cdns3_gadget_ep_queue() is called, causing a kernel crash.<br /> <br /> Add a check to return -ESHUTDOWN if ep-&gt;desc is NULL, which is the<br /> standard return code for unconfigured endpoints.<br /> <br /> This prevents potential crashes when ep_queue is called on endpoints<br /> that are not ready.
Gravedad CVSS v3.1: MEDIA
Última modificación:
08/05/2026

CVE-2026-31754
Fecha de publicación:
01/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: cdns3: gadget: fix state inconsistency on gadget init failure<br /> <br /> When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode<br /> while software state remains INACTIVE, creating hardware/software state<br /> inconsistency.<br /> <br /> When switching to host mode via sysfs:<br /> echo host &gt; /sys/class/usb_role/13180000.usb-role-switch/role<br /> <br /> The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error,<br /> so cdns_role_stop() skips cleanup because state is still INACTIVE.<br /> This violates the DRD controller design specification (Figure22),<br /> which requires returning to idle state before switching roles.<br /> <br /> This leads to a synchronous external abort in xhci_gen_setup() when<br /> setting up the host controller:<br /> <br /> [ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19<br /> [ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget<br /> [ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed<br /> ...<br /> [ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller<br /> [ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP<br /> [ 1301.382485] pc : xhci_gen_setup+0xa4/0x408<br /> [ 1301.393391] backtrace:<br /> ...<br /> xhci_gen_setup+0xa4/0x408
Gravedad CVSS v3.1: MEDIA
Última modificación:
08/05/2026

CVE-2026-31753
Fecha de publicación:
01/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> auxdisplay: line-display: fix NULL dereference in linedisp_release<br /> <br /> linedisp_release() currently retrieves the enclosing struct linedisp via<br /> to_linedisp(). That lookup depends on the attachment list, but the<br /> attachment may already have been removed before put_device() invokes the<br /> release callback. This can happen in linedisp_unregister(), and can also<br /> be reached from some linedisp_register() error paths.<br /> <br /> In that case, to_linedisp() returns NULL and linedisp_release()<br /> dereferences it while freeing the display resources.<br /> <br /> The struct device released here is the embedded linedisp-&gt;dev used by<br /> linedisp_register(), so retrieve the enclosing object directly with<br /> container_of() instead.
Gravedad CVSS v3.1: MEDIA
Última modificación:
08/05/2026

CVE-2026-31751
Fecha de publicación:
01/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> comedi: dt2815: add hardware detection to prevent crash<br /> <br /> The dt2815 driver crashes when attached to I/O ports without actual<br /> hardware present. This occurs because syzkaller or users can attach<br /> the driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl.<br /> <br /> When no hardware exists at the specified port, inb() operations return<br /> 0xff (floating bus), but outb() operations can trigger page faults due<br /> to undefined behavior, especially under race conditions:<br /> <br /> BUG: unable to handle page fault for address: 000000007fffff90<br /> #PF: supervisor write access in kernel mode<br /> #PF: error_code(0x0002) - not-present page<br /> RIP: 0010:dt2815_attach+0x6e0/0x1110<br /> <br /> Add hardware detection by reading the status register before attempting<br /> any write operations. If the read returns 0xff, assume no hardware is<br /> present and fail the attach with -ENODEV. This prevents crashes from<br /> outb() operations on non-existent hardware.
Gravedad CVSS v3.1: MEDIA
Última modificación:
07/05/2026

CVE-2026-31750
Fecha de publicación:
01/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> comedi: runflags cannot determine whether to reclaim chanlist<br /> <br /> syzbot reported a memory leak [1], because commit 4e1da516debb ("comedi:<br /> Add reference counting for Comedi command handling") did not consider<br /> the exceptional exit case in do_cmd_ioctl() where runflags is not set.<br /> This caused chanlist not to be properly freed by do_become_nonbusy(),<br /> as it only frees chanlist when runflags is correctly set.<br /> <br /> Added a check in do_become_nonbusy() for the case where runflags is not<br /> set, to properly free the chanlist memory.<br /> <br /> [1]<br /> BUG: memory leak<br /> backtrace (crc 844a0efa):<br /> __comedi_get_user_chanlist drivers/comedi/comedi_fops.c:1815 [inline]<br /> do_cmd_ioctl.part.0+0x112/0x350 drivers/comedi/comedi_fops.c:1890<br /> do_cmd_ioctl drivers/comedi/comedi_fops.c:1858 [inline]
Gravedad CVSS v3.1: MEDIA
Última modificación:
07/05/2026

CVE-2026-31749
Fecha de publicación:
01/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> comedi: ni_atmio16d: Fix invalid clean-up after failed attach<br /> <br /> If the driver&amp;#39;s COMEDI "attach" handler function (`atmio16d_attach()`)<br /> returns an error, the COMEDI core will call the driver&amp;#39;s "detach"<br /> handler function (`atmio16d_detach()`) to clean up. This calls<br /> `reset_atmio16d()` unconditionally, but depending on where the error<br /> occurred in the attach handler, the device may not have been<br /> sufficiently initialized to call `reset_atmio16d()`. It uses<br /> `dev-&gt;iobase` as the I/O port base address and `dev-&gt;private` as the<br /> pointer to the COMEDI device&amp;#39;s private data structure. `dev-&gt;iobase`<br /> may still be set to its initial value of 0, which would result in<br /> undesired writes to low I/O port addresses. `dev-&gt;private` may still be<br /> `NULL`, which would result in null pointer dereferences.<br /> <br /> Fix `atmio16d_detach()` by checking that `dev-&gt;private` is valid<br /> (non-null) before calling `reset_atmio16d()`. This implies that<br /> `dev-&gt;iobase` was set correctly since that is set up before<br /> `dev-&gt;private`.
Gravedad CVSS v3.1: MEDIA
Última modificación:
07/05/2026

CVE-2026-31748
Fecha de publicación:
01/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> comedi: me_daq: Fix potential overrun of firmware buffer<br /> <br /> `me2600_xilinx_download()` loads the firmware that was requested by<br /> `request_firmware()`. It is possible for it to overrun the source<br /> buffer because it blindly trusts the file format. It reads a data<br /> stream length from the first 4 bytes into variable `file_length` and<br /> reads the data stream contents of length `file_length` from offset 16<br /> onwards. Although it checks that the supplied firmware is at least 16<br /> bytes long, it does not check that it is long enough to contain the data<br /> stream.<br /> <br /> Add a test to ensure that the supplied firmware is long enough to<br /> contain the header and the data stream. On failure, log an error and<br /> return `-EINVAL`.
Gravedad CVSS v3.1: ALTA
Última modificación:
07/05/2026

CVE-2026-31747
Fecha de publicación:
01/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> comedi: me4000: Fix potential overrun of firmware buffer<br /> <br /> `me4000_xilinx_download()` loads the firmware that was requested by<br /> `request_firmware()`. It is possible for it to overrun the source<br /> buffer because it blindly trusts the file format. It reads a data<br /> stream length from the first 4 bytes into variable `file_length` and<br /> reads the data stream contents of length `file_length` from offset 16<br /> onwards.<br /> <br /> Add a test to ensure that the supplied firmware is long enough to<br /> contain the header and the data stream. On failure, log an error and<br /> return `-EINVAL`.<br /> <br /> Note: The firmware loading was totally broken before commit ac584af59945<br /> ("staging: comedi: me4000: fix firmware downloading"), but that is the<br /> most sensible target for this fix.
Gravedad CVSS v3.1: ALTA
Última modificación:
07/05/2026

CVE-2026-31746
Fecha de publicación:
01/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/zcrypt: Fix memory leak with CCA cards used as accelerator<br /> <br /> Tests showed that there is a memory leak if CCA cards are used as<br /> accelerator for clear key RSA requests (ME and CRT). With the last<br /> rework for the memory allocation the AP messages are allocated by<br /> ap_init_apmsg() but for some reason on two places (ME and CRT) the<br /> older allocation was still in place. So the first allocation simple<br /> was never freed.
Gravedad CVSS v3.1: MEDIA
Última modificación:
07/05/2026

CVE-2026-31745
Fecha de publicación:
01/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> reset: gpio: fix double free in reset_add_gpio_aux_device() error path<br /> <br /> When __auxiliary_device_add() fails, reset_add_gpio_aux_device()<br /> calls auxiliary_device_uninit(adev).<br /> <br /> The device release callback reset_gpio_aux_device_release() frees<br /> adev, but the current error path then calls kfree(adev) again,<br /> causing a double free.<br /> <br /> Keep kfree(adev) for the auxiliary_device_init() failure path, but<br /> avoid freeing adev after auxiliary_device_uninit().
Gravedad CVSS v3.1: ALTA
Última modificación:
07/05/2026

CVE-2026-31744
Fecha de publicación:
01/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> PM: EM: Fix NULL pointer dereference when perf domain ID is not found<br /> <br /> dev_energymodel_nl_get_perf_domains_doit() calls<br /> em_perf_domain_get_by_id() but does not check the return value before<br /> passing it to __em_nl_get_pd_size(). When a caller supplies a<br /> non-existent perf domain ID, em_perf_domain_get_by_id() returns NULL,<br /> and __em_nl_get_pd_size() immediately dereferences pd-&gt;cpus<br /> (struct offset 0x30), causing a NULL pointer dereference.<br /> <br /> The sister handler dev_energymodel_nl_get_perf_table_doit() already<br /> handles this correctly via __em_nl_get_pd_table_id(), which returns<br /> NULL and causes the caller to return -EINVAL. Add the same NULL check<br /> in the get-perf-domains do handler.<br /> <br /> [ rjw: Subject and changelog edits ]
Gravedad CVSS v3.1: MEDIA
Última modificación:
07/05/2026

CVE-2026-31743
Fecha de publicación:
01/05/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy<br /> <br /> Buffer size used in dma allocation and memcpy is wrong.<br /> It can lead to undersized DMA buffer access and possible<br /> memory corruption. use correct buffer size in dma_alloc_coherent<br /> and memcpy.
Gravedad CVSS v3.1: ALTA
Última modificación:
07/05/2026
Suscribirse a Vulnerabilidades