CVE-2026-89632 smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

CVE-2026-89632 smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

CVE-2026-89632

CVE-2026-89632 is an out-of-bounds read in the Linux kernel's SMB client , specifically in the reparse_buf_ptr() function. The root cause is a use-before-check of ReparseDataLength (offset 4, 2 bytes): the value is read before verifying that the received buffer length (count) is at least the full...

EUVD-2026-76544

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-before-check of ReparseDataLength in reparsebufptr reparsebufptr reads buf-ReparseDataLength before checking that count covers the full fixed header: buf = struct reparsedatabuffer u8 io + off; len = sizeofbu...

EUVD-2026-76543

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89631

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89631 smb: client: reject a tree connect response whose byte count is too small

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89631 smb: client: reject a tree connect response whose byte count is too small

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89631

CVE-2026-89631 affects the Linux kernel SMB (CIFS) client . In CIFSTCon(), the strnlen() bound over the byte area uses the server's ByteCount minus two; when ByteCount is 0 or 1, the value underflows to a huge size_t, causing cifs_strndup_from_utf16() to read up to 65,535 bytes past the ~16 KB sl...

EUVD-2026-76542

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smbhdr" changed the quantity this bound is measured against. It used to be srv-totalread minus the 4-byte...

CVE-2026-89630

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smbhdr" changed the quantity this bound is measured against. It used to be srv-totalread minus the 4-byte...

CVE-2026-89630 smb: client: restore the data_offset bound in is_valid_oplock_break()

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smbhdr" changed the quantity this bound is measured against. It used to be srv-totalread minus the 4-byte...

CVE-2026-89630

CVE-2026-89630 is a critical vulnerability in the Linux kernel's CIFS/SMB client . A regression introduced by commit 83bfbd0bb902 (which removed the RFC1002 header from smb_hdr) caused the data_offset bound check in is_valid_oplock_break() to evaluate to zero, effectively disabling the overflow g...

CVE-2026-89630 smb: client: restore the data_offset bound in is_valid_oplock_break()

In the Linux kernel, the following vulnerability has been resolved: smb: client: restore the dataoffset bound in isvalidoplockbreak Commit 83bfbd0bb902 "cifs: Remove the RFC1002 header from smbhdr" changed the quantity this bound is measured against. It used to be srv-totalread minus the 4-byte...

EUVD-2026-76403

In the Linux kernel, the following vulnerability has been resolved: orangefs: skip leading spaces before parsing client debug masks orangefspreparecdmarray sizes each client debug keyword buffer with strcspncdshead, " ", but then parses the keyword with %s. The %s conversion skips leading...

EUVD-2026-76390

In the Linux kernel, the following vulnerability has been resolved: lockd: fix NULL dereference on lockowner allocation failure nlmclntlocksinitprivate installs NLM file lock operations even when nlmclntfindlockowner fails to allocate a lockowner. nlmclntproc then returns -ENOMEM, but the VFS sti...

CVE-2026-78546 Out-of-Bounds Read

Out-of-bounds read vulnerability in Citirx Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.11 Current Release CR, before 2507.1 LTSR CU3, and before LTSR 2607...

[SECURITY] Fedora 45 Update: rest-0.10.2-12.fc45

This library was designed to make it easier to access web services that claim to be "RESTful". A RESTful service should have urls that represent remote objects, which methods can then be called on. The majority of services don't actually adhere to this strict definition. Instead, their RESTful en...

CVE-2026-54047

Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in the application's OAuth2 login flow. The application relies on client-side state by trusting the UID field inside the...

CVE-2026-9160 CSTI in Arma Digital's Website Template

Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection. This issue affects Website Template: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...