Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2025-38576
Publication date:
19/08/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> powerpc/eeh: Make EEH driver device hotplug safe<br /> <br /> Multiple race conditions existed between the PCIe hotplug driver and the<br /> EEH driver, leading to a variety of kernel oopses of the same general<br /> nature:<br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> A second class of oops is also seen when the underlying bus disappears<br /> during device recovery.<br /> <br /> Refactor the EEH module to be PCI rescan and remove safe. Also clean<br /> up a few minor formatting / readability issues.
Severity CVSS v4.0: Pending analysis
Last modification:
09/01/2026

CVE-2025-38574
Publication date:
19/08/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> pptp: ensure minimal skb length in pptp_xmit()<br /> <br /> Commit aabc6596ffb3 ("net: ppp: Add bound checking for skb data<br /> on ppp_sync_txmung") fixed ppp_sync_txmunge()<br /> <br /> We need a similar fix in pptp_xmit(), otherwise we might<br /> read uninit data as reported by syzbot.<br /> <br /> BUG: KMSAN: uninit-value in pptp_xmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193<br /> pptp_xmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193<br /> ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2290 [inline]<br /> ppp_input+0x1d6/0xe60 drivers/net/ppp/ppp_generic.c:2314<br /> pppoe_rcv_core+0x1e8/0x760 drivers/net/ppp/pppoe.c:379<br /> sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148<br /> __release_sock+0x1d3/0x330 net/core/sock.c:3213<br /> release_sock+0x6b/0x270 net/core/sock.c:3767<br /> pppoe_sendmsg+0x15d/0xcb0 drivers/net/ppp/pppoe.c:904<br /> sock_sendmsg_nosec net/socket.c:712 [inline]<br /> __sock_sendmsg+0x330/0x3d0 net/socket.c:727<br /> ____sys_sendmsg+0x893/0xd80 net/socket.c:2566<br /> ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620<br /> __sys_sendmmsg+0x2d9/0x7c0 net/socket.c:2709
Severity CVSS v4.0: Pending analysis
Last modification:
09/01/2026

CVE-2025-38573
Publication date:
19/08/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> spi: cs42l43: Property entry should be a null-terminated array<br /> <br /> The software node does not specify a count of property entries, so the<br /> array must be null-terminated.<br /> <br /> When unterminated, this can lead to a fault in the downstream cs35l56<br /> amplifier driver, because the node parse walks off the end of the<br /> array into unknown memory.
Severity CVSS v4.0: Pending analysis
Last modification:
26/11/2025

CVE-2025-38565
Publication date:
19/08/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> perf/core: Exit early on perf_mmap() fail<br /> <br /> When perf_mmap() fails to allocate a buffer, it still invokes the<br /> event_mapped() callback of the related event. On X86 this might increase<br /> the perf_rdpmc_allowed reference counter. But nothing undoes this as<br /> perf_mmap_close() is never called in this case, which causes another<br /> reference count leak.<br /> <br /> Return early on failure to prevent that.
Severity CVSS v4.0: Pending analysis
Last modification:
08/01/2026

CVE-2025-38569
Publication date:
19/08/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> benet: fix BUG when creating VFs<br /> <br /> benet crashes as soon as SRIOV VFs are created:<br /> <br /> kernel BUG at mm/vmalloc.c:3457!<br /> Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI<br /> CPU: 4 UID: 0 PID: 7408 Comm: test.sh Kdump: loaded Not tainted 6.16.0+ #1 PREEMPT(voluntary)<br /> [...]<br /> RIP: 0010:vunmap+0x5f/0x70<br /> [...]<br /> Call Trace:<br /> <br /> __iommu_dma_free+0xe8/0x1c0<br /> be_cmd_set_mac_list+0x3fe/0x640 [be2net]<br /> be_cmd_set_mac+0xaf/0x110 [be2net]<br /> be_vf_eth_addr_config+0x19f/0x330 [be2net]<br /> be_vf_setup+0x4f7/0x990 [be2net]<br /> be_pci_sriov_configure+0x3a1/0x470 [be2net]<br /> sriov_numvfs_store+0x20b/0x380<br /> kernfs_fop_write_iter+0x354/0x530<br /> vfs_write+0x9b9/0xf60<br /> ksys_write+0xf3/0x1d0<br /> do_syscall_64+0x8c/0x3d0<br /> <br /> be_cmd_set_mac_list() calls dma_free_coherent() under a spin_lock_bh.<br /> Fix it by freeing only after the lock has been released.
Severity CVSS v4.0: Pending analysis
Last modification:
08/01/2026

CVE-2025-38566
Publication date:
19/08/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sunrpc: fix handling of server side tls alerts<br /> <br /> Scott Mayhew discovered a security exploit in NFS over TLS in<br /> tls_alert_recv() due to its assumption it can read data from<br /> the msg iterator&amp;#39;s kvec..<br /> <br /> kTLS implementation splits TLS non-data record payload between<br /> the control message buffer (which includes the type such as TLS<br /> aler or TLS cipher change) and the rest of the payload (say TLS<br /> alert&amp;#39;s level/description) which goes into the msg payload buffer.<br /> <br /> This patch proposes to rework how control messages are setup and<br /> used by sock_recvmsg().<br /> <br /> If no control message structure is setup, kTLS layer will read and<br /> process TLS data record types. As soon as it encounters a TLS control<br /> message, it would return an error. At that point, NFS can setup a<br /> kvec backed msg buffer and read in the control message such as a<br /> TLS alert. Msg iterator can advance the kvec pointer as a part of<br /> the copy process thus we need to revert the iterator before calling<br /> into the tls_alert_recv.
Severity CVSS v4.0: Pending analysis
Last modification:
26/11/2025

CVE-2025-38571
Publication date:
19/08/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sunrpc: fix client side handling of tls alerts<br /> <br /> A security exploit was discovered in NFS over TLS in tls_alert_recv<br /> due to its assumption that there is valid data in the msghdr&amp;#39;s<br /> iterator&amp;#39;s kvec.<br /> <br /> Instead, this patch proposes the rework how control messages are<br /> setup and used by sock_recvmsg().<br /> <br /> If no control message structure is setup, kTLS layer will read and<br /> process TLS data record types. As soon as it encounters a TLS control<br /> message, it would return an error. At that point, NFS can setup a kvec<br /> backed control buffer and read in the control message such as a TLS<br /> alert. Scott found that a msg iterator can advance the kvec pointer<br /> as a part of the copy process thus we need to revert the iterator<br /> before calling into the tls_alert_recv.
Severity CVSS v4.0: Pending analysis
Last modification:
26/11/2025

CVE-2025-38570
Publication date:
19/08/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> eth: fbnic: unlink NAPIs from queues on error to open<br /> <br /> CI hit a UaF in fbnic in the AF_XDP portion of the queues.py test.<br /> The UaF is in the __sk_mark_napi_id_once() call in xsk_bind(),<br /> NAPI has been freed. Looks like the device failed to open earlier,<br /> and we lack clearing the NAPI pointer from the queue.
Severity CVSS v4.0: Pending analysis
Last modification:
26/11/2025

CVE-2025-38568
Publication date:
19/08/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing<br /> <br /> TCA_MQPRIO_TC_ENTRY_INDEX is validated using<br /> NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value<br /> TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack<br /> write in the fp[] array, which only has room for 16 elements (0–15).<br /> <br /> Fix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1.
Severity CVSS v4.0: Pending analysis
Last modification:
26/11/2025

CVE-2025-38567
Publication date:
19/08/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nfsd: avoid ref leak in nfsd_open_local_fh()<br /> <br /> If two calls to nfsd_open_local_fh() race and both successfully call<br /> nfsd_file_acquire_local(), they will both get an extra reference to the<br /> net to accompany the file reference stored in *pnf.<br /> <br /> One of them will fail to store (using xchg()) the file reference in<br /> *pnf and will drop that reference but WON&amp;#39;T drop the accompanying<br /> reference to the net. This leak means that when the nfs server is shut<br /> down it will hang in nfsd_shutdown_net() waiting for<br /> &amp;nn-&gt;nfsd_net_free_done.<br /> <br /> This patch adds the missing nfsd_net_put().
Severity CVSS v4.0: Pending analysis
Last modification:
26/11/2025

CVE-2025-38561
Publication date:
19/08/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: fix Preauh_HashValue race condition<br /> <br /> If client send multiple session setup requests to ksmbd,<br /> Preauh_HashValue race condition could happen.<br /> There is no need to free sess-&gt;Preauh_HashValue at session setup phase.<br /> It can be freed together with session at connection termination phase.
Severity CVSS v4.0: Pending analysis
Last modification:
07/01/2026

CVE-2025-38562
Publication date:
19/08/2025
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ksmbd: fix null pointer dereference error in generate_encryptionkey<br /> <br /> If client send two session setups with krb5 authenticate to ksmbd,<br /> null pointer dereference error in generate_encryptionkey could happen.<br /> sess-&gt;Preauth_HashValue is set to NULL if session is valid.<br /> So this patch skip generate encryption key if session is valid.
Severity CVSS v4.0: Pending analysis
Last modification:
08/01/2026
Subscribe to Vulnerabilities