CVE-2026-98454

The Linux kernel contains an out-of-bounds read vulnerability within the smb client component. The smb2_parse_contexts() function fails to limit each record to its Next field before dispatching, allowing a malformed chain to expose bytes beyond the current context. Additionally, the QFid handler ...

CVE-2026-98454 smb: client: fix create context out-of-bounds reads

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2parsecontexts validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose bytes...

CVE-2026-98455 Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

CVE-2026-98455

The Linux kernel contains a vulnerability in the Bluetooth RFCOMM stack where a NULL pointer dereference occurs in the RFCOMM_CONNINFO getsockopt handler. When BT_DEFER_SETUP is enabled, the dlc->defer_setup flag remains set even if the session is cleared during rfcomm_recv_disc(). Consequentl...

EUVD-2026-103695

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

EUVD-2026-103694

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix create context out-of-bounds reads smb2parsecontexts validates the complete create-context area but does not limit each record to its Next field before dispatching it. A malformed chain can therefore expose bytes...

CVE-2026-98453

The Linux kernel contains a vulnerability in the SMB client where SMB2_open() incorrectly handles the lifecycle of a remote handle. Specifically, the function accounts for a successful CREATE response as a remote open before parsing the create contexts. If smb2_parse_contexts() encounters malform...

CVE-2026-98453 smb: client: close handle after create-context parsing failure

In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2open accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2parsecontexts rejects malformed context data, SMB2open...

EUVD-2026-103693

In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2open accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2parsecontexts rejects malformed context data, SMB2open...

CVE-2026-98452

The Linux kernel contains a vulnerability in the SMB client where open_cached_dir() fails to properly handle compound requests. Specifically, if a CREATE succeeds but a subsequent command in the compound request returns an error, the system fails to retain the CREATE FID for proper cleanup using ...

CVE-2026-98452 smb: client: clean up failed cached directory opens

In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens opencacheddir sends CREATE and QUERYINFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common...

EUVD-2026-103692

In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens opencacheddir sends CREATE and QUERYINFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common...

CVE-2026-98451

The Linux kernel contains a vulnerability in the SMB client where an O_CREAT open operation on an existing symlink or non-regular inode causes a dentry reference leak . This occurs because cifs_atomic_open() calls finish_open() on these inodes, but symlink inodes lack a CIFS release operation. Th...

CVE-2026-98451 smb: client: use finish_no_open() for non-regular inodes

In the Linux kernel, the following vulnerability has been resolved: smb: client: use finishnoopen for non-regular inodes An OCREAT open can find an existing symlink or another non-regular inode. cifsatomicopen calls finishopen on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release...

EUVD-2026-103691

In the Linux kernel, the following vulnerability has been resolved: smb: client: use finishnoopen for non-regular inodes An OCREAT open can find an existing symlink or another non-regular inode. cifsatomicopen calls finishopen on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release...

CVE-2026-98450

The Linux kernel contains a vulnerability in the SMB client where the compound_send_recv() function fails to properly manage remote handles during compound wait errors. If a later wait is interrupted or a later MID fails during synchronization, an earlier CREATE operation might already have opene...

CVE-2026-98450 smb: client: close completed creates on compound wait errors

In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compoundsendrecv waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already ha...

EUVD-2026-103690

In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compoundsendrecv waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already ha...

CVE-2026-98449

The Linux kernel contains a vulnerability in the SMB client where compound requests fail to properly manage mids during a reconnect. Specifically, compound_send_recv() unlocks the server without removing mids from the pending_mid_q after a send failure. During reconnection, cifs_abort_connection(...

CVE-2026-98449 smb: client: delete compound mids on send failure before unlock

In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a compound request fails, smbsendrqst kicks off a reconnect. compoundsendrecv still has those mids on pendingmidq, but it unlocks the server without...