CVE-2026-74522 ksmbd: fix use-after-free in __close_file_table_ids()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained through ksmbdlookupfdinode. ksmbdclosefd currently marks the file closed a...

CVE-2026-74521

The CVE-2026-74521 vulnerability affects the Linux kernel’s ksmbd component, where ClientGUIDs were compared with strncmp() and could misclassify distinct GUIDs that contain embedded NUL bytes. The fix uses memcmp() to compare all SMB2_CLIENT_GUID_SIZE bytes in SMB3 multichannel session binding a...

CVE-2026-74522

The CVE-2026-74522 entry describes a Linux kernel ksmbd use-after-free in __close_file_table_ids(). A ksmbd_file can stay alive after logical close while another session holds a temporary reference, leading to a potential use-after-free when the final ksmbd_fd_put() path frees the object without ...

CVE-2026-74521 ksmbd: use memcmp() to compare ClientGUIDs

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use memcmp to compare ClientGUIDs ClientGUID is a fixed-size binary value and can contain embedded NUL bytes. strncmp stops comparing at the first NUL byte, so different ClientGUID values can incorrectly be treated as equa...

CVE-2026-74494

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject repeated SMB2 NEGOTIATE requests Unauthenticated client can send multiple successful SMB2 NEGOTIATE requests on one connection before SESSIONSETUP. While the connection is in KSMBDSESSNEEDSETUP, smb2handlenegotiate...

CVE-2026-74494 ksmbd: reject repeated SMB2 NEGOTIATE requests

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject repeated SMB2 NEGOTIATE requests Unauthenticated client can send multiple successful SMB2 NEGOTIATE requests on one connection before SESSIONSETUP. While the connection is in KSMBDSESSNEEDSETUP, smb2handlenegotiate...

CVE-2026-74494 ksmbd: reject repeated SMB2 NEGOTIATE requests

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject repeated SMB2 NEGOTIATE requests Unauthenticated client can send multiple successful SMB2 NEGOTIATE requests on one connection before SESSIONSETUP. While the connection is in KSMBDSESSNEEDSETUP, smb2handlenegotiate...

CVE-2026-74494

CVE-2026-74494 relates to ksmbd in the Linux kernel. Unauthenticated clients can issue multiple SMB2 NEGOTIATE requests on a single connection before SESSION_SETUP; during KSMBD_SESS_NEED_SETUP, smb2_handle_negotiate() may accept another SMB3.1.1 NEGOTIATE and overwrite conn->preauth_info, cau...

CVE-2026-74494

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject repeated SMB2 NEGOTIATE requests Unauthenticated client can send multiple successful SMB2 NEGOTIATE requests on one connection before SESSIONSETUP. While the connection is in KSMBDSESSNEEDSETUP, smb2handlenegotiate...

EUVD-2026-59687

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject repeated SMB2 NEGOTIATE requests Unauthenticated client can send multiple successful SMB2 NEGOTIATE requests on one connection before SESSIONSETUP. While the connection is in KSMBDSESSNEEDSETUP, smb2handlenegotiate...

CVE-2026-72492

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in sameclienthaslease sameclienthaslease returns an opinfo pointer from ci-moplist after dropping ci-mlock without taking a reference. smbgrantoplock then dereferences that pointer in copylease and when...

CVE-2026-72422

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn-preauthinfo in concurrent SMB2 NEGOTIATE conn-preauthinfo is shared connection state struct preauthintegrityinfo, kmalloc-96 that is allocated and freed by the SMB2 NEGOTIATE handler and read by...

CVE-2026-72381

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the fp-owner.name compare-read in ksmbdvfscomparedurableowner against the kfr...

CVE-2026-72382

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

CVE-2026-72382

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

CVE-2026-72492

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in sameclienthaslease sameclienthaslease returns an opinfo pointer from ci-moplist after dropping ci-mlock without taking a reference. smbgrantoplock then dereferences that pointer in copylease and when...

UBUNTU-CVE-2026-72381

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the fp-owner.name compare-read in ksmbdvfscomparedurableowner against the kfr...

UBUNTU-CVE-2026-72382

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

UBUNTU-CVE-2026-72492

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in sameclienthaslease sameclienthaslease returns an opinfo pointer from ci-moplist after dropping ci-mlock without taking a reference. smbgrantoplock then dereferences that pointer in copylease and when...

CVE-2026-72422

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn-preauthinfo in concurrent SMB2 NEGOTIATE conn-preauthinfo is shared connection state struct preauthintegrityinfo, kmalloc-96 that is allocated and freed by the SMB2 NEGOTIATE handler and read by...