CVE-2026-97565

The Linux kernel contains a vulnerability in the CIFSSMBRead() function where it fails to verify that a complete READ_RSP has been received from a server. Specifically, the code dereferences DataLengthHigh , DataLength , and DataOffset without ensuring the response length is at least read_rsp_siz...

EUVD-2026-86873

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short READ responses in CIFSSMBRead CIFSSMBRead reads DataLengthHigh, DataLength and DataOffset out of the READRSP returned by the server without first checking that a whole READRSP was actually received. The...

CVE-2026-97565

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short READ responses in CIFSSMBRead CIFSSMBRead reads DataLengthHigh, DataLength and DataOffset out of the READRSP returned by the server without first checking that a whole READRSP was actually received. The...

CVE-2026-97563

The Linux kernel contains a vulnerability in the SMB1 synchronous read helper CIFSSMBRead() . The function fails to validate the DataOffset field, allowing a malicious or compromised SMB1 server to provide a large DataOffset with an in-range DataLength . This can cause memcpy() to read past the e...

CVE-2026-97563

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead The SMB1 synchronous read helper CIFSSMBRead validates the server's DataLength against CIFSMaxBufSize and the caller's count, but never validates DataOffset. The copy...

EUVD-2026-86871

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead The SMB1 synchronous read helper CIFSSMBRead validates the server's DataLength against CIFSMaxBufSize and the caller's count, but never validates DataOffset. The copy...