EUVD-2026-86956

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range smb3insertrange and smb3collapserange use truncatepagecacherange to invalidate the affected page cache. However, if off or oldeof is not page-aligned, the boundary pages a...

CVE-2026-98125

The Linux kernel contains a vulnerability in the smb/client component where smb3_insert_range() and smb3_collapse_range() may return stale data . The issue occurs because truncate_pagecache_range() only partially zeroes boundary pages when the offset or old EOF is not page-aligned , leaving them ...

CVE-2026-98124

In the Linux kernel, the following vulnerability has been resolved: smb/client: invalidate fscache for fallocate range operations smb3zerorange, smb3punchhole, smb3insertrange, and smb3collapserange modify file contents through server-side range operations. These operations discard the affected...

CVE-2026-98124

The Linux kernel contains a vulnerability in the smb/client component where specific server-side range operations—smb3_zero_range() , smb3_punch_hole() , smb3_insert_range() , and smb3_collapse_range() —fail to properly invalidate the FS-Cache . While these operations discard the affected page ca...

EUVD-2026-86955

In the Linux kernel, the following vulnerability has been resolved: smb/client: invalidate fscache for fallocate range operations smb3zerorange, smb3punchhole, smb3insertrange, and smb3collapserange modify file contents through server-side range operations. These operations discard the affected...

cve-2022-25640-exploit

scapyを用いたCVE-2022-25640の悪用 参照: CVE-2022-25640.ipynb. CVE-2022-25640は、wolfSSL 5.2より前のバージョンに存在する脆弱性です。これにより、クライアントはTLS 1.3接続における相互認証を迂回できます。...

aardwolf

🚩 赞助商 如果你喜欢这个项目，可以考虑购买 OctoPwn 的许可证，这是我们完整的、可在浏览器中运行的渗透测试套件！ 如需获取新构建/发布通知和其他信息，请加入我们的 Discord AARDWOLF - 基于 Python 的异步 RDP/VNC 客户端（无头模式） 本项目旨在对 RDP 和 VNC 协议进行探索和实验。 该项目不包含 GUI，如需图形客户端请查看 aardwolfgui 🚩 在浏览器中运行 本项目与许多其他渗透测试工具一样，借助 OctoPwn 的力量在浏览器中运行！ 查看社区版请访问 OctoPwn - Live 重要提示 这是一个无头客户端，如需 GUI...

DET

DET extensible Data Exfiltration Toolkit DET is provided AS IS, is a proof of concept to perform Data Exfiltration using either single or multiple channels at the same time. This is a Proof of Concept aimed at identifying possible DLP failures. This should never be used to exfiltrate sensitive/li...

EUVD-2026-86870

In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tconsupercb stores a raw superblock pointer, but cifsgetsuper takes its active reference only after iteratesuperstype has dropped sumount and its passive reference. Concurrent...

CVE-2026-97561

The Linux kernel contains a vulnerability where the SMB client fails to honor forceuid and forcegid mount options. Specifically, the functions smb311_posix_info_to_fattr(), cifs_posix_to_fattr(), and parse_sec_desc() unconditionally called sid_to_id(), allowing server-provided values to overwrite...

EUVD-2026-86869

In the Linux kernel, the following vulnerability has been resolved: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid When the administrator mounts with forceuid or forcegid uid=/gid= mount options, they expect all files to appear owned by the specified user/group. However, severa...

CVE-2026-97562 smb: client: pin DFS superblock in iterator callback

In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tconsupercb stores a raw superblock pointer, but cifsgetsuper takes its active reference only after iteratesuperstype has dropped sumount and its passive reference. Concurrent...

CVE-2026-97560

The Linux kernel contains a one-byte out-of-bounds (OOB) read vulnerability within the smb2_parse_native_symlink() function of the SMB client. The flaw occurs when parsing a share-root relative native symlink, where memcpy copies smb_target+1 (skipping the leading separator) but incorrectly uses ...

CVE-2026-97559

The Linux kernel contains a vulnerability in the SMB client where the functions replace_sids_and_copy_aces() and set_chmod_dacl() incorrectly use a u16 accumulator to track DACL size. This causes an integer wraparound when the rewritten DACL exceeds 64K (specifically reaching a wraparound with 86...

CVE-2026-97558

The Linux kernel contains a vulnerability in the SMB client where a cifsFileInfo reference leak occurs during a deferred close operation. The issue stems from a race condition in cifs_close(): if deferred_close_scheduled becomes false while work is pending, subsequent cifs_open() calls may reuse ...

CVE-2026-97558 smb: client: fix cifsFileInfo reference leak in deferred close

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifsclose defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2deferredworkclose drops one su...

EUVD-2026-86865

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifsqueueoplockbreak cifsqueueoplockbreak unconditionally takes a reference on the target file before queueing cifsoplockbreak. Only that work item decreases the reference counter again. If...

CVE-2026-97556

The Linux kernel contains a vulnerability in the SMB client where a reference count leak occurs when cifs_sb_tlink() fails, specifically in setups using the "-o multiuser" option. The cifs_oplock_break() function fails to release the file reference in this specific failure path, which can lead to...

CVE-2026-97557

The Linux kernel contains a vulnerability in the CIFS (SMB) client where cifs_queue_oplock_break() unconditionally increments a file reference count before attempting to queue cifs_oplock_break(). If the work item is already queued, queue_work() returns false, causing the reference count to leak....

CVE-2026-97555 smb: client: fix heap overflow in DACL owner/group rewrite

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...