416716 matches found
EUVD-2026-81751
In the Linux kernel, the following vulnerability has been resolved: m68k: nfcon: Do not call consoleisregistered in nfcondevice Since 7c2af0f634f1 "tty: ttyio: use consolelistlock for list synchronization" showconsactive calls the .device method under the consolelistlock, but consoleisregistered...
CVE-2026-90156 ksmbd: safely discard unregistered deferred locks
In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile defers a lock, smb2lock puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes th...
CVE-2026-90156
CVE-2026-90156 affects the ksmbd (SMB server) module in the Linux kernel . The vulnerability is a NULL pointer dereference in the lock rollback path: when vfs_lock_file() defers a lock, smb2_lock() places its ksmbd_lock on the rollback list before allocating and registering the asynchronous work....
EUVD-2026-81749
In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile defers a lock, smb2lock puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes th...
CVE-2026-90156 ksmbd: safely discard unregistered deferred locks
In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile defers a lock, smb2lock puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes th...
CVE-2026-90156
In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely discard unregistered deferred locks When vfslockfile defers a lock, smb2lock puts its ksmbdlock on rollbacklist before allocating and registering the asynchronous work. If either operation fails, rollback assumes th...
EUVD-2026-81747
In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope session state changes to bound connections ksmbdallconnsetstatus treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move...
CVE-2026-90154 ksmbd: scope session state changes to bound connections
In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope session state changes to bound connections ksmbdallconnsetstatus treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move...
CVE-2026-90154
CVE-2026-90154 affects the ksmbd subsystem of the Linux kernel . The function ksmbd_all_conn_set_status() incorrectly treats every connection with a transient binding flag as belonging to the target SessionId, so a logoff or session replacement can move an unrelated connection to NEED_RECONNECT o...
CVE-2026-90155 ksmbd: detach blocked lock requests before freeing
In the Linux kernel, the following vulnerability has been resolved: ksmbd: detach blocked lock requests before freeing A filelock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already...
CVE-2026-90154 ksmbd: scope session state changes to bound connections
In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope session state changes to bound connections ksmbdallconnsetstatus treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move...
CVE-2026-90155
In the Linux kernel, the following vulnerability has been resolved: ksmbd: detach blocked lock requests before freeing A filelock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already...
CVE-2026-90155 ksmbd: detach blocked lock requests before freeing
In the Linux kernel, the following vulnerability has been resolved: ksmbd: detach blocked lock requests before freeing A filelock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already...
CVE-2026-90155
CVE-2026-90155 affects the ksmbd (SMB server) component of the Linux kernel . A retained file_lock used for byte-range lock bookkeeping can remain part of the VFS blocked-request graph when freed directly in __ksmbd_close_fd() or the cross-request unlock path. If a dependent waiter is still attac...
CVE-2026-90154
In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope session state changes to bound connections ksmbdallconnsetstatus treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move...
EUVD-2026-81746
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...
CVE-2026-90153 ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...
CVE-2026-90153
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound smbcheckpermdacl ACE walks by DACL size smbcheckpermdacl validates that the DACL fits inside the NT security descriptor, but then bounds its two ACE walks by the remaining NTSD length aclsize rather than the DACL's...
CVE-2026-90153
CVE-2026-90153 affects the Linux kernel ksmbd subsystem (in-kernel SMB server). The vulnerable function smb_check_perm_dacl() bounds its ACE walks by the remaining NT security descriptor length (acl_size) instead of the DACL's declared size (pdacl_size). An attacker with low privileges can craft ...
EUVD-2026-81745
In the Linux kernel, the following vulnerability has been resolved: smb/server: fix session leak in ksmbdsessionregister See the procedure below: smb2sesssetup ksmbdsmb2sessioncreate sessioncreate atomicset&sess-refcnt, 2 hashaddsessionstable, &sess-hlist, sess-id ksmbdsessionregister...