EUVD-2026-48925

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix next buffer leak in receiveencryptedstandard receiveencryptedstandard allocates nextbuffer before checking whether the number of compound PDUs already reached MAXCOMPOUND. If the limit check fails, the function...

CVE-2026-64381

The CVE-2026-64381 issue is in the Linux kernel SMB client code path used by receive_encrypted_standard()/receive encrypted standard(): a next_buffer is allocated before validating that the number of compound PDUs has not exceeded MAX_COMPOUND. If the limit check fails, the function returns early...

CVE-2026-64381 smb: client: Fix next buffer leak in receive_encrypted_standard()

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix next buffer leak in receiveencryptedstandard receiveencryptedstandard allocates nextbuffer before checking whether the number of compound PDUs already reached MAXCOMPOUND. If the limit check fails, the function...

EUVD-2026-48926

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2open replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2openinit fails before the next send, cleanup retains the previous buffer type and frees...

CVE-2026-64382

CVE-2026-64382 describes a Linux kernel SMB client-use-after-free issue in SMB2_open() replay handling. The vulnerability arises because a response-bearing SMB2_open attempt could return a replayable error and free its response buffer; if SMB2_open_init() fails before the next send, cleanup may f...

CVE-2026-64382 smb: client: fix double-free in SMB2_open() replay

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2open replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2openinit fails before the next send, cleanup retains the previous buffer type and frees...

EUVD-2026-48924

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posixinfosidsize reads sid1 to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid1 ...

CVE-2026-64380 smb: client: harden POSIX SID length parsing

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posixinfosidsize reads sid1 to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid1 ...

CVE-2026-64380

The CVE-2026-64380 issue affects the Linux kernel SMB client path handling of POSIX SIDs. The root cause is in posix_info_sid_size(), which reads sid[1] to obtain the subauthority count but previously allowed buffers with only one remaining byte, potentially enabling unsafe rejection of truncated...

CVE-2026-64379 smb: client: mask server-provided mode to 07777 in modefromsid

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...

EUVD-2026-48922

In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroupwritebackumount and inodeswitchwbs When a container exits, the following BUGON is occasionally triggered: ================================================================== VFS: Busy inodes after...

CVE-2026-64378

CVE-2026-64378 is a Linux kernel race between cgroup_writeback_umount() and inode_switch_wbs()/cleanup_offline_cgwb() triggered when a container exits. The root cause is a window between inode_prepare_wbs_switch() returning true and wb_queue_isw(), which can lead to a VFS: Busy inodes after unmou...

CVE-2026-64379

The CVE-2026-64379 issue affects the Linux kernel SMB client: when modefromsid is active, parse_dacl() could apply the server-provided NFS mode SID sub_auth[2] to cf_mode without masking to 07777. The root cause is missing masking in cf_mode; the fix applies the correct masking (07777) the same a...

CVE-2026-64378 writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()

In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroupwritebackumount and inodeswitchwbs When a container exits, the following BUGON is occasionally triggered: ================================================================== VFS: Busy inodes after...

EUVD-2026-48923

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...

EUVD-2026-48921

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcomcpufreq.data is allocated with devmkzalloc in probe as an array of per-domain data. qcomcpufreqhwcpuinit stores a pointer to one element of this array in policy-driverdata...

CVE-2026-64377

In the Linux kernel, the cpufreq: qcom-cpufreq-hw driver has a double-free fix. qcom_cpufreq.data is allocated with devm_kzalloc() as a per-domain array, and qcom_cpufreq_hw_cpu_init() stores a pointer to an element in policy->driver_data. The driver’s exit path previously invoked kfree() on p...

CVE-2026-64376

CVE-2026-64376 affects the Linux kernel firmware_loader: in firmware_upload_register(), after fw_create_instance() succeeds, a failure path frees fw_sysfs without balancing the embedded device reference, risking a refcount leak of the embedded struct device. The recommended fix is to use put_devi...

CVE-2026-64374 sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT

In the Linux kernel, the following vulnerability has been resolved: sched/rt: Have RTPUSHIPI be default off for non PREEMPTRT RT migration is done aggressively. When a CPU schedules out a high priority RT task for a lower priority task, it will look to see if there's any RT tasks that are waiting...

CVE-2026-64374

CVE-2026-64374 concerns the Linux kernel’s RT scheduling path. The vulnerability stems from making RT_PUSH_IPI default off for non-PREEMPT_RT configurations, which could affect RT migration when high-priority RT tasks are scheduled across CPUs. The mechanism normally pulls RT tasks between CPUs u...