Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE  (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2024-42138
Publication date:
30/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file<br /> <br /> In case of invalid INI file mlxsw_linecard_types_init() deallocates memory<br /> but doesn&amp;#39;t reset pointer to NULL and returns 0. In case of any error<br /> occurred after mlxsw_linecard_types_init() call, mlxsw_linecards_init()<br /> calls mlxsw_linecard_types_fini() which performs memory deallocation again.<br /> <br /> Add pointer reset to NULL.<br /> <br /> Found by Linux Verification Center (linuxtesting.org) with SVACE.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-42140
Publication date:
30/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> riscv: kexec: Avoid deadlock in kexec crash path<br /> <br /> If the kexec crash code is called in the interrupt context, the<br /> machine_kexec_mask_interrupts() function will trigger a deadlock while<br /> trying to acquire the irqdesc spinlock and then deactivate irqchip in<br /> irq_set_irqchip_state() function.<br /> <br /> Unlike arm64, riscv only requires irq_eoi handler to complete EOI and<br /> keeping irq_set_irqchip_state() will only leave this possible deadlock<br /> without any use. So we simply remove it.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-42142
Publication date:
30/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/mlx5: E-switch, Create ingress ACL when needed<br /> <br /> Currently, ingress acl is used for three features. It is created only<br /> when vport metadata match and prio tag are enabled. But active-backup<br /> lag mode also uses it. It is independent of vport metadata match and<br /> prio tag. And vport metadata match can be disabled using the<br /> following devlink command:<br /> <br /> # devlink dev param set pci/0000:08:00.0 name esw_port_metadata \<br /> value false cmode runtime<br /> <br /> If ingress acl is not created, will hit panic when creating drop rule<br /> for active-backup lag mode. If always create it, there will be about<br /> 5% performance degradation.<br /> <br /> Fix it by creating ingress acl when needed. If esw_port_metadata is<br /> true, ingress acl exists, then create drop rule using existing<br /> ingress acl. If esw_port_metadata is false, create ingress acl and<br /> then create drop rule.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-42130
Publication date:
30/07/2024
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Severity CVSS v4.0: Pending analysis
Last modification:
31/01/2026

CVE-2024-42117
Publication date:
30/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: ASSERT when failing to find index by plane/stream id<br /> <br /> [WHY]<br /> find_disp_cfg_idx_by_plane_id and find_disp_cfg_idx_by_stream_id returns<br /> an array index and they return -1 when not found; however, -1 is not a<br /> valid index number.<br /> <br /> [HOW]<br /> When this happens, call ASSERT(), and return a positive number (which is<br /> fewer than callers&amp;#39; array size) instead.<br /> <br /> This fixes 4 OVERRUN and 2 NEGATIVE_RETURNS issues reported by Coverity.
Severity CVSS v4.0: Pending analysis
Last modification:
26/09/2025

CVE-2024-42118
Publication date:
30/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: Do not return negative stream id for array<br /> <br /> [WHY]<br /> resource_stream_to_stream_idx returns an array index and it return -1<br /> when not found; however, -1 is not a valid array index number.<br /> <br /> [HOW]<br /> When this happens, call ASSERT(), and return a zero instead.<br /> <br /> This fixes an OVERRUN and an NEGATIVE_RETURNS issues reported by Coverity.
Severity CVSS v4.0: Pending analysis
Last modification:
29/09/2025

CVE-2024-42123
Publication date:
30/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: fix double free err_addr pointer warnings<br /> <br /> In amdgpu_umc_bad_page_polling_timeout, the amdgpu_umc_handle_bad_pages<br /> will be run many times so that double free err_addr in some special case.<br /> So set the err_addr to NULL to avoid the warnings.
Severity CVSS v4.0: Pending analysis
Last modification:
25/09/2024

CVE-2024-42125
Publication date:
30/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: rtw89: fw: scan offload prohibit all 6 GHz channel if no 6 GHz sband<br /> <br /> We have some policy via BIOS to block uses of 6 GHz. In this case, 6 GHz<br /> sband will be NULL even if it is WiFi 7 chip. So, add NULL handling here<br /> to avoid crash.
Severity CVSS v4.0: Pending analysis
Last modification:
06/10/2025

CVE-2024-42128
Publication date:
30/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> leds: an30259a: Use devm_mutex_init() for mutex initialization<br /> <br /> In this driver LEDs are registered using devm_led_classdev_register()<br /> so they are automatically unregistered after module&amp;#39;s remove() is done.<br /> led_classdev_unregister() calls module&amp;#39;s led_set_brightness() to turn off<br /> the LEDs and that callback uses mutex which was destroyed already<br /> in module&amp;#39;s remove() so use devm API instead.
Severity CVSS v4.0: Pending analysis
Last modification:
29/09/2025

CVE-2024-42122
Publication date:
30/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: Add NULL pointer check for kzalloc<br /> <br /> [Why &amp; How]<br /> Check return pointer of kzalloc before using it.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-42129
Publication date:
30/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> leds: mlxreg: Use devm_mutex_init() for mutex initialization<br /> <br /> In this driver LEDs are registered using devm_led_classdev_register()<br /> so they are automatically unregistered after module&amp;#39;s remove() is done.<br /> led_classdev_unregister() calls module&amp;#39;s led_set_brightness() to turn off<br /> the LEDs and that callback uses mutex which was destroyed already<br /> in module&amp;#39;s remove() so use devm API instead.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025

CVE-2024-42119
Publication date:
30/07/2024
In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: Skip finding free audio for unknown engine_id<br /> <br /> [WHY]<br /> ENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it<br /> also means it is uninitialized and does not need free audio.<br /> <br /> [HOW]<br /> Skip and return NULL.<br /> <br /> This fixes 2 OVERRUN issues reported by Coverity.
Severity CVSS v4.0: Pending analysis
Last modification:
03/11/2025
Subscribe to Vulnerabilities