CVE-2026-98453 smb: client: close handle after create-context parsing failure

In the Linux kernel, the following vulnerability has been resolved: smb: client: close handle after create-context parsing failure SMB2open accounts a successful CREATE response as a remote open before parsing its create contexts. If smb2parsecontexts rejects malformed context data, SMB2open...

CVE-2026-98453

The Linux kernel contains a vulnerability in the SMB client where SMB2_open() incorrectly handles the lifecycle of a remote handle. Specifically, the function accounts for a successful CREATE response as a remote open before parsing the create contexts. If smb2_parse_contexts() encounters malform...

CVE-2026-98452 smb: client: clean up failed cached directory opens

In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens opencacheddir sends CREATE and QUERYINFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common...

CVE-2026-98452 smb: client: clean up failed cached directory opens

In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens opencacheddir sends CREATE and QUERYINFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common...

CVE-2026-98452

The Linux kernel contains a vulnerability in the SMB client where open_cached_dir() fails to properly handle compound requests. Specifically, if a CREATE succeeds but a subsequent command in the compound request returns an error, the system fails to retain the CREATE FID for proper cleanup using ...

EUVD-2026-103692

In the Linux kernel, the following vulnerability has been resolved: smb: client: clean up failed cached directory opens opencacheddir sends CREATE and QUERYINFO as a compound request. If the CREATE succeeds but a later command returns an error, the function must retain the CREATE FID so common...

CVE-2026-98451 smb: client: use finish_no_open() for non-regular inodes

In the Linux kernel, the following vulnerability has been resolved: smb: client: use finishnoopen for non-regular inodes An OCREAT open can find an existing symlink or another non-regular inode. cifsatomicopen calls finishopen on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release...

CVE-2026-98451 smb: client: use finish_no_open() for non-regular inodes

In the Linux kernel, the following vulnerability has been resolved: smb: client: use finishnoopen for non-regular inodes An OCREAT open can find an existing symlink or another non-regular inode. cifsatomicopen calls finishopen on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release...

EUVD-2026-103691

In the Linux kernel, the following vulnerability has been resolved: smb: client: use finishnoopen for non-regular inodes An OCREAT open can find an existing symlink or another non-regular inode. cifsatomicopen calls finishopen on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release...

CVE-2026-98451

The Linux kernel contains a vulnerability in the SMB client where an O_CREAT open operation on an existing symlink or non-regular inode causes a dentry reference leak . This occurs because cifs_atomic_open() calls finish_open() on these inodes, but symlink inodes lack a CIFS release operation. Th...

EUVD-2026-103690

In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compoundsendrecv waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already ha...

CVE-2026-98450 smb: client: close completed creates on compound wait errors

In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compoundsendrecv waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already ha...

CVE-2026-98450 smb: client: close completed creates on compound wait errors

In the Linux kernel, the following vulnerability has been resolved: smb: client: close completed creates on compound wait errors compoundsendrecv waits for responses in order. If a later wait is interrupted, or if a later MID fails during response synchronization, an earlier CREATE may already ha...

CVE-2026-98450

The Linux kernel contains a vulnerability in the SMB client where the compound_send_recv() function fails to properly manage remote handles during compound wait errors. If a later wait is interrupted or a later MID fails during synchronization, an earlier CREATE operation might already have opene...

CVE-2026-98449

The Linux kernel contains a vulnerability in the SMB client where compound requests fail to properly manage mids during a reconnect. Specifically, compound_send_recv() unlocks the server without removing mids from the pending_mid_q after a send failure. During reconnection, cifs_abort_connection(...

CVE-2026-98449 smb: client: delete compound mids on send failure before unlock

In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a compound request fails, smbsendrqst kicks off a reconnect. compoundsendrecv still has those mids on pendingmidq, but it unlocks the server without...

EUVD-2026-103689

In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a compound request fails, smbsendrqst kicks off a reconnect. compoundsendrecv still has those mids on pendingmidq, but it unlocks the server without...

CVE-2026-98449 smb: client: delete compound mids on send failure before unlock

In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a compound request fails, smbsendrqst kicks off a reconnect. compoundsendrecv still has those mids on pendingmidq, but it unlocks the server without...

CVE-2026-98448

The Linux kernel contains a vulnerability within the xfs filesystem component where the system fails to release an igrab'd reference to an orphanage directory inode if a chown operation fails. This flaw results in a reference leak. Remediation is available through kernel updates, as evidenced by ...

CVE-2026-98448 xfs: release orphanage dir inode if chown fails

In the Linux kernel, the following vulnerability has been resolved: xfs: release orphanage dir inode if chown fails LOLLM points out that we leak the igrab'd reference to the orphanage directory inode if chowning it fails. Fix that...