Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las últimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las últimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las últimas vulnerabilidades incorporadas al repositorio.

CVE-2026-80539
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: disallow multiple FENCE chunks in one submit<br /> <br /> amdgpu_cs_pass1() dispatches on chunk_id once per chunk without<br /> rejecting repeated ids. p-&gt;uf_bo is a single-slot field, so a<br /> submission carrying two AMDGPU_CHUNK_ID_FENCE chunks runs<br /> amdgpu_cs_p1_user_fence() twice, and the second run overwrites<br /> p-&gt;uf_bo with a freshly referenced BO without dropping the reference<br /> taken by the first.<br /> <br /> amdgpu_cs_parser_fini() only unrefs the final p-&gt;uf_bo, so every FENCE<br /> chunk but the last leaks a BO reference. The leaked BO outlives handle<br /> close and process exit.<br /> <br /> Reject duplicate FENCE chunks the same way commit fec5f8e8c6bc<br /> ("drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit") did<br /> for p-&gt;bo_list.<br /> <br /> (cherry picked from commit 665b1fc2a1845206408f9a2c6da67101789edb82)
Gravedad: Pendiente de análisis
Última modificación:
27/08/2026

CVE-2026-80540
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: Fix UVD decode image min size calculation<br /> <br /> This needs to use pitch instead of width. Also reject pitch<br /> over 4096 to avoid overflow.<br /> <br /> (cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304)
Gravedad CVSS v3.1: ALTA
Última modificación:
27/08/2026

CVE-2026-80541
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: validate GEM_CREATE domain combinations<br /> <br /> AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK,<br /> but did not validate domain combinations. Userspace could combine<br /> CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making<br /> amdgpu_bo_placement_from_domain() exceed AMDGPU_BO_MAX_PLACEMENTS and<br /> hit BUG_ON().<br /> <br /> Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/<br /> VRAM domains to be specified one at a time. Return -EINVAL for invalid<br /> combinations in amdgpu_gem_create_ioctl().<br /> <br /> v2: Rename helper from amdgpu_gem_domain_valid() to<br /> amdgpu_gem_are_domains_valid() (Christian)<br /> <br /> (cherry picked from commit db39852d0c39843cb02048dfb47e4b8c703e9080)
Gravedad CVSS v3.1: ALTA
Última modificación:
27/08/2026

CVE-2026-80544
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing<br /> <br /> The zcrypt_msgtype6_send_ep11_cprb() function uses fragile struct<br /> overlays to access and modify the domain field in the EP11 CPRB<br /> payload, creating maintainability and security concerns:<br /> 1. Struct overlay approach (pld_hdr) assumes fixed payload structure<br /> and doesn&amp;#39;t validate the actual ASN.1 encoding.<br /> 2. Complex length format detection logic is error-prone and doesn&amp;#39;t<br /> properly validate bounds at each parsing step.<br /> 3. Direct struct member access bypasses proper ASN.1 validation.<br /> <br /> Fix by replacing struct overlays with explicit ASN.1 parsing that<br /> validates each field (payload tag/length, function tag/length/value,<br /> optional domain tag/length/value) with proper bounds checking at every<br /> step. Add asn1_int_encode() helper function to safely write integer<br /> values with correct endianness conversion. This makes the code<br /> consistent with the validation pattern introduced with the rework of<br /> the xcrb_msg_to_type6_ep11cprb_msgx() function.
Gravedad CVSS v3.1: ALTA
Última modificación:
27/08/2026

CVE-2026-80545
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/zcrypt: Improve EP11 CPRB length and overflow checks<br /> <br /> The xcrb_msg_to_type6_ep11cprb_msgx() function lacks proper input<br /> validation, creating security vulnerabilities:<br /> 1. Missing minimum size validation: The ep11_cprb structure and<br /> subsequent payload fields (pld_tag, pld_lenfmt) are copied from<br /> userspace without verifying sufficient buffer length.<br /> 2. Arithmetic overflow in length calculations: CEIL4 alignment could<br /> overflow, bypassing size checks and enabling buffer overflows.<br /> 3. The payload is asn1 encoded but the function just uses a simple c<br /> struct overlay to access some fields of the payload.<br /> <br /> Fix by using size_t for length calculations, adding U32_MAX boundary<br /> checks after alignment, and validating minimum request size and<br /> minimum reply size before copying from userspace. Do a very simple<br /> asn1 parsing of the payload up to the function value field.
Gravedad CVSS v3.1: ALTA
Última modificación:
27/08/2026

CVE-2026-80546
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/zcrypt: Improve CCA CPRB length and overflow checks<br /> <br /> The xcrb_msg_to_type6cprb_msgx() function lacks proper input<br /> validation, creating security vulnerabilities:<br /> 1. Integer overflow after CEIL4 alignment: Signed int variables could<br /> overflow during 4-byte boundary alignment, causing undersized<br /> buffer allocations or incorrect bounds checking.<br /> 2. Missing minimum size validation: The CPRBX structure is copied from<br /> userspace without verifying sufficient buffer length. Undersized<br /> buffers cause uninitialized memory access when reading structure<br /> fields like cprbx.cprb_len and cprbx.domain.<br /> 3. Arithmetic overflow in sum calculations: Adding control block and<br /> data block sizes could overflow, bypassing size checks and enabling<br /> buffer overflows.<br /> <br /> Fix by using size_t for length calculations, adding U32_MAX boundary<br /> checks after alignment, validating minimum control block size before<br /> copying from userspace, and detecting sum calculation overflows.
Gravedad CVSS v3.1: ALTA
Última modificación:
27/08/2026

CVE-2026-80532
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfs: fix another iunlink infinite loop bug in online fsck<br /> <br /> xrep_iunlink_resolve_bucket is supposed to reconstruct as much of the<br /> incore prev and next unlinked list pointers based on what it finds on<br /> disk and in memory before we move on to relinking the truly lost inodes<br /> back into the unlinked list. However, it&amp;#39;s still vulnerable to infinite<br /> loops that come in via the next_unlinked pointers.<br /> <br /> Fix this problem by remembering which inodes we&amp;#39;ve already seen and<br /> checking new agino pointers against that. If a bit is already set,<br /> either this is a loop or the inode has nonzero link count. We&amp;#39;ll deal<br /> with the second case in a subsequent patch.
Gravedad: Pendiente de análisis
Última modificación:
26/08/2026

CVE-2026-80533
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfs: don&amp;#39;t walk off the end of a null sc-&gt;sa.agi_bp in AGI repair<br /> <br /> LOLLM noticed a longstanding bug where xrep_iunlink_walk_ondisk_bucket<br /> tries to walk ragi-&gt;sc-&gt;sa.agi_bp to rebuild the unlinked inode lists.<br /> Unfortunately, it&amp;#39;s possible for agi_bp to be null if the buffer<br /> verifier fails, so we have to use ragi-&gt;agi_bp (which skips verifier<br /> checks) instead.
Gravedad: Pendiente de análisis
Última modificación:
26/08/2026

CVE-2026-80535
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfs: don&amp;#39;t double-lock when deleting a self-referential directory<br /> <br /> LOLLM notices that the dirtree scrubber can detect a directory that<br /> refers to itself. In this case, it&amp;#39;s not correct for the directory tree<br /> repair code to try to iolock/ilock both sc-&gt;ip and dp, because they&amp;#39;re<br /> the same inode. Fix this by detecting that corner case and handling it<br /> appropriately.
Gravedad: Pendiente de análisis
Última modificación:
26/08/2026

CVE-2026-80531
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfs: avoid UAF on sc-&gt;tempip in xrep_tempfile_create<br /> <br /> LOLLM noticed a potential UAF if the tempfile creation code fails after<br /> it set sc-&gt;tempip. Fix that.
Gravedad CVSS v3.1: ALTA
Última modificación:
27/08/2026

CVE-2026-80534
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfs: fix ilock leak on error in xfs_dq_get_next_id<br /> <br /> xfs_dq_get_next_id() takes the quota inode ILOCK before calling<br /> xfs_iread_extents(). If xfs_iread_extents() fails, the function returns<br /> immediately without releasing the lock, leaking the quota inode ILOCK.<br /> This can leave the quota inode locked and cause subsequent quota<br /> operations to hang.<br /> <br /> Fix this by jumping to a common unlock path on error instead of returning<br /> directly.
Gravedad: Pendiente de análisis
Última modificación:
27/08/2026

CVE-2026-80536
Fecha de publicación:
26/08/2026
Idioma:
Inglés
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfs: bounds-check buffer log item&amp;#39;s dirty bitmap<br /> <br /> xlog_recover_do_reg_buffer() replays each dirty region described by a<br /> buffer log item&amp;#39;s bitmap into the buffer read for that item:<br /> <br /> memcpy(xfs_buf_offset(bp, (uint)bit
Gravedad CVSS v3.1: ALTA
Última modificación:
27/08/2026
Suscribirse a Vulnerabilidades