CVE-2026-64380

The CVE-2026-64380 issue affects the Linux kernel SMB client path handling of POSIX SIDs. The root cause is in posix_info_sid_size(), which reads sid[1] to obtain the subauthority count but previously allowed buffers with only one remaining byte, potentially enabling unsafe rejection of truncated...

CVE-2026-64379 smb: client: mask server-provided mode to 07777 in modefromsid

In the Linux kernel, the following vulnerability has been resolved: smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mode SID to cfmode without masking to 07777. Apply the correct masking,...

CVE-2026-64257 smb: client: reject overlapping data areas in SMB2 responses

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b "smb: client: restrict implied bcc0 exemption to responses without data area" restricted the implied bcc0 length exception to responses without a da...

EUVD-2026-48969

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b "smb: client: restrict implied bcc0 exemption to responses without data area" restricted the implied bcc0 length exception to responses without a da...

CVE-2026-64257

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b "smb: client: restrict implied bcc0 exemption to responses without data area" restricted the implied bcc0 length exception to responses without a da...

CVE-2026-64257

CVE-2026-64257 affects the Linux kernel SMB2 client logic. The issue arose from overlap handling in __smb2_calc_size(), where clearing data_length could cause an invalid SMB2 response to appear as if it has no data area, allowing an unintended length-exemption path. The fix tracks data area overl...

kernel: Fix of 43 CVEs

Bluetooth: hcisysfs: Fix attempting to call deviceadd multiple times CVE-2022-50419 - firewire: net: fix use after free in fwnetfinishincomingpacket CVE-2023-53432 - wifi: brcmfmac: fix use-after-free bug in brcmfnetdevstartxmit CVE-2022-50408 - wifi: brcmfmac: slab-out-of-bounds read in...

PT-2026-64615

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the Linux kernel, the ksmbd module contains a permission bypass. The smb2 set info sec function calls set info sec without performing a per-handle access check. This allows a client t...

PT-2026-64606

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMB client. A response-bearing attempt may return a replayable error and free its response buffer. If the SMB2 ioctl init function fails before the...

Linux Distros Unpatched Vulnerability : CVE-2026-64383

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix double-free in SMB2flush replay SMB2flush keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is...

PT-2026-64618

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the ksmbd module, the smb2 query dir function stores a pointer to stack-allocated private data within the ksmbd file readdir data. When concurrent QUERY DIRECTORY requests use the sam...

PT-2026-64604

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMB client. The SMB2 flush function maintains response buffer bookkeeping across replay attempts. If a replayable flush response is received and the...

PT-2026-64601

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB client regarding the parsing of POSIX SID lengths. The function posix info sid size reads sid1 to determine the subauthority count, but the boundary check...

Linux Distros Unpatched Vulnerability : CVE-2026-64382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix double-free in SMB2open replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2openinit fails...

Linux Distros Unpatched Vulnerability : CVE-2026-64384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2notifyinit fails...

PT-2026-64605

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the SMB client. A response-bearing attempt may return a replayable error and free its response buffer. If the SMB2 notify init function fails before the...

PT-2026-64609

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Ownership and group modifications were ignored when mounting with SMB3 POSIX Extensions, unless CIFS MOUNT CIFS ACL or CIFS MOUNT MODE FROM SID were explicitly set. The issue occurs with...

PT-2026-64478

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMB2 client where the smb2 calc size function clears data length during overlap handling. This behavior can cause an invalid response to be incorrectly identified ...

Linux Distros Unpatched Vulnerability : CVE-2026-64379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: mask server-provided mode to 07777 in modefromsid When modefromsid is active, parsedacl applies the server-provided subauth2 value from the NFS mod...

Linux Distros Unpatched Vulnerability : CVE-2026-64437

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: fix use-after-free of a deferred filelock on SMB2CLOSE then SMB2CANCEL Commit f580d27e8928 ksmbd: fix use-after-free of a deferred filelock on double...