CVE-2026-72382 ksmbd: reject undersized DACLs before parsing ACEs

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...

CVE-2026-72382

CVE-2026-72382 affects the Linux kernel ksmbd component. The issue is an unsigned underflow in parse_dacl() when computing the ACE count for a security descriptor, caused by subtracting sizeof(struct smb_acl) from a 16-bit DACL size. This can allow a malformed security descriptor to bypass the AC...

CVE-2026-72381

The CVE covers a Linux kernel use-after-free in ksmbd: fp->owner.name (a per-open kstrdup buffer) can be read while freed during a race between two concurrent SMB2 durable reconnects (DH2C/DHnC) on the same persistent_id. The issue stems from a read in ksmbd_vfs_compare_durable_owner() against...

EUVD-2026-59280

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the fp-owner.name compare-read in ksmbdvfscomparedurableowner against the kfr...

CVE-2026-72381 ksmbd: fix use-after-free of fp->owner.name in durable handle owner check

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the fp-owner.name compare-read in ksmbdvfscomparedurableowner against the kfr...

CVE-2026-72381 ksmbd: fix use-after-free of fp->owner.name in durable handle owner check

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistentid race the fp-owner.name compare-read in ksmbdvfscomparedurableowner against the kfr...

CVE-2026-72044 ksmbd: fix stack buffer overflow in multichannel session-key copy

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix stack buffer overflow in multichannel session-key copy Commit 4b706360ffb7 "ksmbd: fix multichannel binding and enforce channel limit" moved the binding-path session key out of the session-wide sess-sesskey CIFSKEYSIZE...

EUVD-2026-59002

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix stack buffer overflow in multichannel session-key copy Commit 4b706360ffb7 "ksmbd: fix multichannel binding and enforce channel limit" moved the binding-path session key out of the session-wide sess-sesskey CIFSKEYSIZE...

CVE-2026-72044

...

CVE-2026-72044

The CVE-2026-72044 issue is a Linux kernel ksmbd multichannel vulnerability. Root cause: a per-channel key buffer was sized to 16 bytes while two call sites validated/copied session keys against CIFS_KEY_SIZE (40). On binding sessions, an NTLM/ Kerberos session key up to 40 bytes could be written...

CVE-2026-68457

CVE-2026-68457 affects the Linux kernel ksmbd: FSCTL mutations (SET_SPARSE, SET_ZERO_DATA, SET_COMPRESSION) on an open SMB handle. The vulnerability arises because these operations call VFS helpers (xattr, fallocate, fileattr) using the current ksmbd worker credentials, which can revalidate inode...

EUVD-2026-59079

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations SETSPARSE, SETZERODATA and SETCOMPRESSION operate on an open SMB handle but call VFS xattr, fallocate or fileattr helpers with the current ksmbd worker credentials. Those helpers...

CVE-2026-68457 ksmbd: use opener credentials for FSCTL mutations

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations SETSPARSE, SETZERODATA and SETCOMPRESSION operate on an open SMB handle but call VFS xattr, fallocate or fileattr helpers with the current ksmbd worker credentials. Those helpers...

CVE-2026-68457 ksmbd: use opener credentials for FSCTL mutations

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations SETSPARSE, SETZERODATA and SETCOMPRESSION operate on an open SMB handle but call VFS xattr, fallocate or fileattr helpers with the current ksmbd worker credentials. Those helpers...

PT-2026-72569

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp-owner.name in durable handle owner check Two concurrent SMB2 durable reconnects DH2C/DHnC on the same persistent id race the fp-owner.name compare-read in ksmbd vfs compare durable owner against th...

PT-2026-72610

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn-preauth info in concurrent SMB2 NEGOTIATE conn-preauth info is shared connection state struct preauth integrity info, kmalloc-96 that is allocated and freed by the SMB2 NEGOTIATE handler and read...

PT-2026-72946

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject repeated SMB2 NEGOTIATE requests Unauthenticated client can send multiple successful SMB2 NEGOTIATE requests on one connection before SESSION SETUP. While the connection is in KSMBD SESS NEED SETUP, smb2 handle...

Linux Distros Unpatched Vulnerability : CVE-2026-74494

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: reject repeated SMB2 NEGOTIATE requests Unauthenticated client can send multiple successful SMB2 NEGOTIATE requests on one connection before SESSIONSETUP...

Linux Distros Unpatched Vulnerability : CVE-2026-72382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit i...

Linux Distros Unpatched Vulnerability : CVE-2026-74522

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: fix use-after-free in closefiletableids A ksmbdfile can remain alive after logical close while another session holds a temporary reference obtained throu...