EUVD-2026-103942

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tbremovework There is a slight race between tbremovework and tbdomainremove which leads to dereferencing a NULL tb-rootswitch pointer inside tbfreeunpluggedxdomains: Thread A Thread B...

CVE-2026-98688 thunderbolt: Fix NULL dereference in tb_remove_work()

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tbremovework There is a slight race between tbremovework and tbdomainremove which leads to dereferencing a NULL tb-rootswitch pointer inside tbfreeunpluggedxdomains: Thread A Thread B...

EUVD-2026-103941

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tbxdppropertiesrequest allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can set...

CVE-2026-98687 thunderbolt: Reject oversized XDomain properties responses

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tbxdppropertiesrequest allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can set...

CVE-2026-98687 thunderbolt: Reject oversized XDomain properties responses

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tbxdppropertiesrequest allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can set...

CVE-2026-98687

The Linux kernel thunderbolt driver contains a heap out-of-bounds read vulnerability in the tb_xdp_properties_request() function. A malicious peer can set an XDomain length field to 63, leading the driver to treat the data as 48 dwords despite only allocating room for 45. This mismatch causes mem...

CVE-2026-98686 smb: client: discard post-EOF pagecache when extending a file via zero range

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via zero range smb3zerorange removed the pagecache only for the range being zeroed, so when it extends the file the folio straddling the old EOF - which may hold data...

EUVD-2026-103940

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via zero range smb3zerorange removed the pagecache only for the range being zeroed, so when it extends the file the folio straddling the old EOF - which may hold data...

CVE-2026-98686

The Linux kernel contains a vulnerability in the smb client component where smb3_zero_range() fails to discard the pagecache for folios straddling the old EOF when extending a file via a zero range. This allows data dirtied past the EOF—potentially through an mmap —to remain in the pagecache and ...

CVE-2026-98686 smb: client: discard post-EOF pagecache when extending a file via zero range

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via zero range smb3zerorange removed the pagecache only for the range being zeroed, so when it extends the file the folio straddling the old EOF - which may hold data...

EUVD-2026-103939

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via clone range cifsremapfilerange discarded the pagecache only for the folios overlapping the destination region, so when a clone extends the file the folio straddlin...

CVE-2026-98685

The Linux kernel contains a vulnerability in the smb client where the cifs_remap_file_range() function fails to correctly discard the pagecache when extending a file via a clone range. Specifically, folios straddling the old EOF (which might contain data dirtied past the EOF via an mmap ) were no...

CVE-2026-98685 smb: client: discard post-EOF pagecache when extending a file via clone range

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via clone range cifsremapfilerange discarded the pagecache only for the folios overlapping the destination region, so when a clone extends the file the folio straddlin...

CVE-2026-98685 smb: client: discard post-EOF pagecache when extending a file via clone range

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via clone range cifsremapfilerange discarded the pagecache only for the folios overlapping the destination region, so when a clone extends the file the folio straddlin...

CVE-2026-98684 smb: client: flush and commit data before querying allocated ranges

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOCFLKEEPSIZE fallocate emulation for small interior ranges in smb3simplefallocaterange issues FSCTLQUERYALLOCATEDRANGES and zero-fills any...

CVE-2026-98684 smb: client: flush and commit data before querying allocated ranges

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOCFLKEEPSIZE fallocate emulation for small interior ranges in smb3simplefallocaterange issues FSCTLQUERYALLOCATEDRANGES and zero-fills any...

EUVD-2026-103938

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush and commit data before querying allocated ranges The mode 0 / FALLOCFLKEEPSIZE fallocate emulation for small interior ranges in smb3simplefallocaterange issues FSCTLQUERYALLOCATEDRANGES and zero-fills any...

CVE-2026-98684

The Linux kernel contains a vulnerability in the smb3_simple_fallocate_range() function's emulation of mode 0 / FALLOC_FL_KEEP_SIZE for small interior ranges. The issue arises because the system issues FSCTL_QUERY_ALLOCATED_RANGES and zero-fills reported unallocated holes to force block allocatio...

EUVD-2026-103937

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3zerorange emulates FALLOCFLZERORANGE by invalidating the page cache over the target range with truncatepagecacherange and then issuing FSCTLSETZERODATA to the server. Dirty...

CVE-2026-98683 smb: client: flush dirty data before zeroing a range

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3zerorange emulates FALLOCFLZERORANGE by invalidating the page cache over the target range with truncatepagecacherange and then issuing FSCTLSETZERODATA to the server. Dirty...